By default, puppet agents attempt to download their signed certificate indefinitely. Puppet 6.5.0 adds a `maxwaitforcert` setting, which specifies the maximum amount of time an agent should wait for its certificate. Acceptable values are "unlimited" (the current behavior) or a duration such as 10m, 1h, etc. If a duration is specified and the agent waits the full amount of time, then it will exit with an error.