This is an exact copy of what we do here: https://github.com/puppetlabs/puppetserver/blob/master/acceptance/suites/tests/authorization/x509_auth.rb#L9-L16 . I can implement the behavior you've suggested but wanted to note that this would vary from the reference that I used.