Debian seems to think the default puppetmaster port is 18140... but all the documentation I found and my puppet client running on Ubuntu says the default port is 8140. Strange.
Opening the configuration file /etc/default/puppetmaster and changing the last line to the right port did the trick.
PORT=8140
I also got the following error when trying to use my newly-signed client certificate:
notice: Got signed certificate
