Whilst most open source puppet installations put ssldir under vardir, it's not always the case - Puppet Enterprise puts it under confdir, for instance. A separate puppetssldir setting should be available, defaulting to "#{SETTINGS[:puppetvardir]}/ssl".