I'm fine with having ssl disabled by default. This will require my puppet-nssdb (for qpid) and puppet-certmonger modules, both on github.