Puppet CA and Satellite 6 with multiple capsules

Hi!

Assuming we have 5000+ RHEL servers, one satellite 6 server and several load balanced capsules providing content and configuration management. How do we handle the puppetCA?
The goal is that any client can use any of the capsules, in such a setup it does not make sense to have both Puppet and PuppetCA functionality in every capsule. If possible a dedicated capsule or satellite server itself should probably provide puppetCA functionality, and all puppet nodes should be pointed to the CA via the "ca_server" parameter in puppet.conf.

Thanks,
Erling