Move the client ssl variables to top level, they are not params, they are set  based upon params and should only be set after params are evaluated.
dont manage user by default
have package require user