/etc/puppet is installed as 0750, belonging to root:root, while the standalone puppetmaster runs under the puppet user. This results in rather misleading errors: "Error: Could not request certificate: Error 400 on SERVER: Permission denied - /etc/puppet/auth.conf" A chgrp puppet /etc/puppet fixes that.
fixed in 3.5.1 made the dir owner puppet for /etc/puppet