Reproduction:

1. Create a new host with the name 'test.example.com'
2. Render a provisioning template containing @host.certname. Output should contain 'test.example.com'
3. provision the host (I've not checked this step, but solely creating the host does not seem enough to repro this)
3. Edit the host and change the hostname to 'different.example.com'
4. Render a provisioning template containing @host.certname.

Expected output 'different.example.com'
Actual output 'test.example.com'

My specific use-case is renaming kickstartable hosts. When the certname does not change together with the hostname, this causes massive havok when trying to rebuild hosts.