Puppet Version: 7.0.0, Facter 4.0.46
OS Name/Version: Debian 10
Puppet 6 used fqdn for certname. Puppet 7 uses hostname. This change isn't mentioned in the release notes:
Documentation still says certname defaults to the fully qualified domain name: https://puppet.com/docs/puppet/7.0/config_important_settings.html
Keep using fqdn for certname.
Suddenly agents want to use their short hostname for the certname, which causes them to request new certificates.
This is despite facter still having the correct values: