diff --git a/nginx/files/_ssl.conf b/nginx/files/_ssl.conf
index 2914885..f073653 100644
--- a/nginx/files/_ssl.conf
+++ b/nginx/files/_ssl.conf
@@ -1,5 +1,11 @@
 
   {%- if site.get('ssl', {'enabled': False}).get('enabled', False) %}
+
+  {%- set ca_file=site.ssl.get('ca_file', '') %}
+  {%- set key_file=site.ssl.get('key_file', '/etc/ssl/private/{0}.key'.format(site.host.name)) %}
+  {%- set cert_file=site.ssl.get('cert_file', '/etc/ssl/certs/{0}.crt'.format(site.host.name)) %}
+  {%- set chain_file=site.ssl.get('chain_file', '/etc/ssl/certs/{0}-with-chain.crt'.format(site.host.name)) %}
+
   ssi on;
   ssl on;
   ssl_session_cache shared:SSL:10m;
@@ -7,16 +13,11 @@
 
   {%- if site.ssl.engine is not defined %}
 
-  {%- if site.ssl.key_file is defined %}
-  ssl_certificate_key {{ site.ssl.key_file }};
-  ssl_certificate {{ site.ssl.cert_file }};
-  {%- else %}
-  ssl_certificate_key /etc/ssl/private/{{ site.host.name }}.key;
+  ssl_certificate_key {{ key_file }};
   {%- if site.ssl.chain is defined or site.ssl.authority is defined %}
-  ssl_certificate /etc/ssl/certs/{{ site.host.name }}-with-chain.crt;
+  ssl_certificate {{ chain_file }};
   {%- else %}
-  ssl_certificate /etc/ssl/certs/{{ site.host.name }}.crt;
-  {%- endif %}
+  ssl_certificate {{ cert_file }};
   {%- endif %}
 
   {%- elif site.ssl.engine == 'letsencrypt' %}
@@ -29,8 +30,8 @@
 
   {%- elif site.ssl.engine == 'salt' %}
 
-  ssl_certificate_key /etc/ssl/private/{{ site.host.name }}.key;
-  ssl_certificate /etc/ssl/certs/{{ site.host.name }}-with-chain.crt;
+  ssl_certificate_key {{ key_file }};
+  ssl_certificate {{ chain_file }};
 
   {%- endif %}