Merged to 6.x in 5586097377, passed CI in 2056487938.
This solution, seems to me, is good for showing an agent's own cert.
Could this also be implemented as a 'puppetserver ca <action>' so we can inspect any certificate on the CA server. (Not it's own agent cert)