The console certificate expires every 824 days. Regenerate the console certificate when it's nearing or past expiration, or if the certificate is corrupted and you're unable to access the console.
On your primary server, run:
rm /etc/puppetlabs/puppetserver/ca/signed/console-cert.pem /etc/puppetlabs/puppet/ssl/certs/console-cert.pem /etc/puppetlabs/puppet/ssl/private_keys/console-cert.pem /etc/puppetlabs/puppet/ssl/public_keys/console-cert.pem
puppet agent -t, or wait for the next Puppet run.