server {
    listen                     8140 ssl;
    server_name                puppet.example.com;

    passenger_enabled          on;
    passenger_set_cgi_param    SSL_CLIENT_S_DN $ssl_client_s_dn;
    passenger_set_cgi_param    SSL_CLIENT_VERIFY $ssl_client_verify;

    access_log                 /var/log/nginx/puppet_access.log;
    error_log                  /var/log/nginx/puppet_error.log;

    root                       /etc/puppet/rack/public;

    ssl_certificate            /var/lib/puppet/ssl/certs/puppet.example.com.pem;
    ssl_certificate_key        /var/lib/puppet/ssl/private_keys/puppet.example.com.pem;
    ssl_crl                    /var/lib/puppet/ssl/ca/ca_crl.pem;
    ssl_client_certificate     /var/lib/puppet/ssl/certs/ca.pem;
    ssl_prefer_server_ciphers  on;
    ssl_verify_client          optional;
    ssl_verify_depth           1;
    ssl_session_cache          shared:SSL:128m;
    ssl_session_timeout        5m;
}