Set up a certificate whitelist file and configure it in PuppetDB so that only the Puppet master has access by default.