anchor.diff:    ssl_stapling on; # Requires nginx >= 1.3.7
     ssl_stapling_verify on; # Requires nginx => 1.3.7
   
  -  ssl_certificate <%= @ssl_certificate %>; # Must be a bundle of crt and ca, or must be correct order or nginx will not start
  -  ssl_certificate_key <%= @ssl_certificate_key %>;
  -
  +  ssl_certificate /etc/ssl/<%= @application[:domains].first %>.crt;
  +  ssl_certificate_key /etc/ssl/<%= @application[:domains].first %>.key;
  +  <% if @application[:ssl_certificate_ca] -%>
  +  ssl_client_certificate /etc/ssl/<%= @application[:domains].first %>.ca;
  +  <% end -%>
     <% end -%>
   
     root   <%= @web_root %>;
  
positive.code:   error_log   /var/log/nginx/<%= @app_name %>.error.log;
  
    index index.php index.htm index.html;
    <% if @enable_ssl -%>
    if ($http_x_forwarded_proto != "https") {
      rewrite ^(.*)$ https://$server_name$1 permanent;
    }
  
negative.code:   listen 80;
    listen [::]:80;
  
    <% if @application[:ssl_support] %>
  
    listen 443 ssl;
    ssl_protocols TLSv1.2 TLSv1.1 TLSv1; #Turns off TLSv3 to protect against POODLE Attack
  