Puppet uses the legacy HTTP code (Puppet::Util::HttpProxy.request_with_redirects) to retrieve file metadata for http(s) file sources. That code does not use persistent connections, doesn't support basic auth, and doesn't trust the puppet CA for HTTPS connections.
Puppet should our HTTP client to ensure it behaves consistently.