This might not be an ideal solution but this is what I was doing before moving to saltstack:
When rolling out a new EC2 box (I am using fabric to achieve this, this is all done on the puppetmaster):
1) On PuppetMaster(certificate and machine host name was already known; naming convention):
local('sudo puppetca -c {}' .format(cert_name));
local('sudo puppetca -g {}' .format(cert_name));
This would take care of the old certificate problem you mentioned.
After this copy over the following files to the new rolled out box using scp:
1) /var/lib/puppet/ssl/ca/signed/signed-cert_name.pem
2) /var/lib/puppet/ssl/private_keys/private-cert_name.pem
3) /var/lib/puppet/ssl/certs/ca.pem
Fabric Code for the above said:
local("sudo cp /var/lib/puppet/ssl/ca/signed/{}.pem /tmp/signed-{}.pem" .format(cert_name,cert_name))
local("sudo chown ubuntu:ubuntu /tmp/signed-{}.pem" .format(cert_name))
local("sudo cp /var/lib/puppet/ssl/private_keys/{}.pem /tmp/private-{}.pem" .format(cert_name,cert_name))
local("sudo chown ubuntu:ubuntu /tmp/private-{}.pem" .format(cert_name))
local("sudo cp /var/lib/puppet/ssl/certs/ca.pem /tmp/ca.pem")
local("sudo chown ubuntu:ubuntu /tmp/ca.pem")
put("/tmp/signed-{}.pem" .format(cert_name), "/home/ubuntu/signed-{}.pem" .format(cert_name))
put("/tmp/private-{}.pem" .format(cert_name) , "/home/ubuntu/private-{}.pem" .format(cert_name))
put("/tmp/ca.pem" , "/home/ubuntu/ca.pem")
Now on the new box run the following(I had a simple bash script doing this and fqdn was a param passed):
sudo chown root:root /home/ubuntu/ca.pem /home/ubuntu/signed-$fqdn.pem /home/ubuntu/private-$fqdn.pem
sudo chmod 600 /home/ubuntu/private-$fqdn.pem
sudo mkdir -p /var/lib/puppet/ssl/certs/ /var/lib/puppet/ssl/ca/signed/ /var/lib/puppet/ssl/private_keys/
sudo mv /home/ubuntu/ca.pem /var/lib/puppet/ssl/certs/ca.pem
sudo mv /home/ubuntu/signed-$fqdn.pem /var/lib/puppet/ssl/ca/signed/$fqdn.pem
sudo mv /home/ubuntu/private-$fqdn.pem /var/lib/puppet/ssl/private_keys/$fqdn.pem
I hope this was a little helpful.
note:local, and put are Fabric operations