The cert download from fleet and config in the osquery is the server cert or client cert?

It's the server cert. You can use this flag to include the server cert in the client install to ensure the client trusts the server's cert, even if it is self-signed