We're using puppet to manage a group of Ubuntu boxes and will shortly require each of these servers to share a common SSL certificate, in order to serve a site over HTTPS. Naturally, we'd like to use puppet to manage the certificate but are conscious of the fact that putting it in a VCS (from where the puppet master gets its modules) mightn't be a great idea—because of the security implications.
Are there any better solutions anyone is aware of?