Before fixing this bug, the following patch has to merge in puppet-certmonger https://github.com/saltedsignal/puppet-certmonger/pull/21 and needs to be taken into use. The current puppet-certmonger code doesn't allow certmonger updates. The patch I linked to fixes that.
Fixed and verified on OSP 13