TLS termination is easy when client certificates are not involved. With Puppet, client certificates are the main load bearing pillar of identity in the system.