diff --git a/manifests/params.pp b/manifests/params.pp
index 7e3bffb..b7d4858 100644
--- a/manifests/params.pp
+++ b/manifests/params.pp
@@ -20,6 +20,7 @@
 #    along with this program.  If not, see <http://www.gnu.org/licenses/>.
 # @summary  Class holds all parameters for the cd_nrpe module and is
 #   inherited by all classes except defines.
+# @see https://www.nagios.org/documentation/
 # @param  [string] pkg_ensure
 #   which [package type](https://confdroid.com/2017/05/puppet-type-package/)
 #   to choose, i.e. `latest` or `present`.
@@ -83,7 +84,8 @@
 #   config file.
 # @param  [string] ne_include_dir
 # @param  [string] ne_fw_order_no ordering prefix for he firewall rules. Adjust
-#   to yoru environment if needed.
+#   to your environment if needed.
+# @param  [string] ne_ssl_opts Specify additional SSL options.
 ###############################################################################
 class cd_nrpe::params (
 
@@ -123,6 +125,9 @@ $ne_ssl_logging             = '0x00',
 $ne_nasty_metachars         = '\"|`&><\'\\[]{};\r\n\"',
 $ne_include_file            = '',
 
+# nrpe.conf
+$ne_ssl_opts                = '',
+
 # firewall
 $ne_incl_fw                 = true,
 $ne_fw_order_no             = '50',
diff --git a/templates/nrpe_cfg.erb b/templates/nrpe_cfg.erb
index c3a931d..150652f 100644
--- a/templates/nrpe_cfg.erb
+++ b/templates/nrpe_cfg.erb
@@ -14,7 +14,7 @@ log_file=<%= @ne_log_file %>
 
 debug=<%= @ne_debug %>
 
-pid_file=<% @ne_nrpe_pid_file %>
+pid_file=<%= @ne_nrpe_pid_file %>
 server_port=<%= @ne_nrpe_port %>
 
 server_address=<%= @ne_server_address %>
@@ -47,7 +47,7 @@ ssl_privatekey_file=<%= @ne_ssl_privatekey_file %>
 ssl_client_certs=<%= @ne_ssl_client_certs %>
 ssl_logging=<%= @ne_ssl_logging %>
 
-nasty_metachars=<$= @ne_nasty_metachars  %>
+nasty_metachars=<%= @ne_nasty_metachars  %>
 
 <% unless @ne_include_file.empty? -%>
 include=<%= @ne_include_file %>
diff --git a/templates/nrpe_cfg_head.erb b/templates/nrpe_cfg_head.erb
deleted file mode 100644
index 150652f..0000000
--- a/templates/nrpe_cfg_head.erb
+++ /dev/null
@@ -1,59 +0,0 @@
-################################################################################
-##########                nrpe.cfg managed by Puppet                  ##########
-##########            manual changes will be overwritten !!!          ##########
-################################################################################
-##########          full reference is available at                    ##########
-##########      https://confdroid.com/2017/07/nrpe-nrpe-cfg/          ##########
-################################################################################
-
-log_facility=<%= @ne_log_facility %>
-
-<% unless @ne_log_file.empty? -%>
-log_file=<%= @ne_log_file %>
-<% end -%>
-
-debug=<%= @ne_debug %>
-
-pid_file=<%= @ne_nrpe_pid_file %>
-server_port=<%= @ne_nrpe_port %>
-
-server_address=<%= @ne_server_address %>
-listen_queue_size=<%= @ne_listen_queue_size %>
-
-nrpe_user=<%= @ne_user %>
-nrpe_group=<%= @ne_user %>
-
-allowed_hosts=127.0.0.1,::1,<%= @ne_nagios_server %>
-dont_blame_nrpe=<%= @ne_dont_blame_nrpe %>
-allow_bash_command_substitution=<%= @ne_allow_bash_cmd_subst %>
-
-<% if @ne_allow_sudo == true -%>
-command_prefix=<%= @ne_command_prefix %>
-<% end -%>
-
-command_timeout=<%= @ne_command_timeout %>
-connection_timeout=<%= @ne_connection_timeout %>
-
-allow_weak_random_seed=<%= @ne_allow_weak_rnd_seed %>
-
-ssl_version=<%= @ne_ssl_version %>
-ssl_use_adh=<%= @ne_ssl_use_adh %>
-ssl_cipher_list=<%= @ne_ssl_cipher_list %>
-
-ssl_cacert_file=<%= @ne_ssl_cacert_file %>
-ssl_cert_file=<%= @ne_ssl_cert_file %>
-ssl_privatekey_file=<%= @ne_ssl_privatekey_file %>
-
-ssl_client_certs=<%= @ne_ssl_client_certs %>
-ssl_logging=<%= @ne_ssl_logging %>
-
-nasty_metachars=<%= @ne_nasty_metachars  %>
-
-<% unless @ne_include_file.empty? -%>
-include=<%= @ne_include_file %>
-<% end -%>
-
-include_dir=<%= @ne_main_conf_d_dir  %>
-
-### command definitions have been moved to include_dir for easier external
-#   management
diff --git a/templates/nrpe_conf.erb b/templates/nrpe_conf.erb
new file mode 100644
index 0000000..e52eae8
--- /dev/null
+++ b/templates/nrpe_conf.erb
@@ -0,0 +1,2 @@
+# specify additional command line arguments for nrpe
+NRPE_SSL_OPT=""