I don't think this is an SSL issue. For one thing, if you exactly clone a VM, including its Puppet certificate, then it has a certificate that the master will accept. Change the hostname / IP / whatever is not relevant to that. The clone will impersonate the original to the master, so you generally don't want to leave it like that, but its hostname does not need to match the certificate name (that's a feature).
Connection refusal is more likely happening at the firewall or at the rack host. The exact error message might shed some light on the specifics.
John