I've seen setups where all the certs and keys are lumped together in one directory, but more commonly I've seen things with separate subdirectories for public certificates, private keys, _and_ the CA certificates. I don't think we could plan the module to handle all situations, it'd be better to set it up one way and handle the exceptions as they come in as issues.

In this case, the CA certificates are not stored in the same place as `$ssl_cert_path` (i.e. not with the certificates or the keys...) and were installed by the puppetmaster-passenger package so relocating them would be complicated...

What I'd really like to see in Puppet is an x509 certificate module that behaves like [`ssh::auth`](http://projects.puppetlabs.com/projects/1/wiki/Module_Ssh_Auth_Patterns) so that the puppetmaster generates and stores self signed certificates, and then deploys them to nodes, but that's outside the scope of this module.