See https://community.theforeman.org/t/foreman-provision-template-host-doesnt-have-correct-puppetserver-or-puppetca/19440 for extended discussion, the "Puppet Master" and "Puppet CA" fields on a single host entry don't reflect that you are selecting the Smart Proxy host for the Puppetserver and Puppet CA, not the FQDN of the Puppetserver and Puppet CA itself.

(Pull request incoming) The language should be adjusted, along with the tooltip to make the functionality of the field more apparent.