anchor.diff:    RequestHeader set X-Client-DN %{SSL_CLIENT_S_DN}e
     RequestHeader set X-Client-Verify %{SSL_CLIENT_VERIFY}e
   
  -  DocumentRoot <%= puppet_docroot %>
     RackBaseURI /
     <Directory /etc/puppet/rack/>
       Options None
  
positive.code: Listen <%= @puppet_passenger_port %>
  
  <VirtualHost *:<%= @puppet_passenger_port %>>
    ServerName <%= @puppet_site %>
  
    SSLProtocol -ALL +SSLv3 +TLSv1
    SSLCipherSuite ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:-LOW:-SSLv2:-EXP
  
negative.code: 
    ProxyPassMatch ^/([^/]+/certificate.*)$ <%= @puppet_central_ca %>/$1
  <% end -%>
  
  