I am a bit concerned about setting this to default to ssl being on for this first bit of integration, partly because it means you need dns setup for the openstack public and private networks, and partly because I am concerned how that will interact with the current Load Balancer configuration.  Both things need to be supported, but I am a little unsure how much having that defaulted to 'on' will raise the barrier to entry for using foreman (at least for the moment).  Would you vehemently opposed leaving this to the params.pp default of false for now, and then changing it later if it makes the most sense? In the meantime, it could easily be toggled on in the foreman ui.  I am going to test this with ssl off to see if everything continues to work as expected (ie, as it does before this patch).  If so, I am good with merging this and I can push a small patch to toggle it back off, since you are on pto.  That will also buy us a little time to figure out what to do about including your certmonger puppet module (and the freeipa one perhaps?) so this can be used in an rpm release.  One option for the (very) short term would be to include them in this package for the next tagged release via git submodules.  Then, as soon as we have an external rpm we can depend on, remove the references here and use the rpm instead.