[Freeipa-users] Command to export sub-ca certificate

[Jakob Ackermann]

 The client is joined to the IPA domain and gets a certificate from the
sub-ca `puppet` with `ipa-getcert request -x puppet`. In order to have the
puppet agent to be able to talk to puppet server I need the puppet sub-ca
certificate.

How can I distribute the sub-ca certificate to the client? Running
`ipa-certupdate` did not work.

Thanks