diff --git a/manifests/prepare/ssl.pp b/manifests/prepare/ssl.pp
index 639c0185f..54a2c7b8f 100644
--- a/manifests/prepare/ssl.pp
+++ b/manifests/prepare/ssl.pp
@@ -23,23 +23,30 @@
     'requestdir'    => 'certificate_requests',
   }
 
-  $sslpaths.each |String $setting, String $subdir| {
-    if $::puppet_sslpaths[$setting]['path_exists'] {
-      file { "${ssl_dir}/${subdir}":
-        ensure  => directory,
-        source  => $::puppet_sslpaths[$setting]['path'],
-        backup  => false,
-        recurse => true,
+  case $::puppet_sslpaths {
+    Hash: {
+      $sslpaths.each |String $setting, String $subdir| {
+        if $::puppet_sslpaths[$setting]['path_exists'] {
+          file { "${ssl_dir}/${subdir}":
+            ensure  => directory,
+            source  => $::puppet_sslpaths[$setting]['path'],
+            backup  => false,
+            recurse => true,
+          }
+        }
       }
-    }
-  }
 
-  # The only one that's a file, not a directory.
-  if $::puppet_sslpaths['hostcrl']['path_exists'] {
-    file { "${ssl_dir}/crl.pem":
-      ensure => file,
-      source => $::puppet_sslpaths['hostcrl']['path'],
-      backup => false
+      # The only one that's a file, not a directory.
+      if $::puppet_sslpaths['hostcrl']['path_exists'] {
+        file { "${ssl_dir}/crl.pem":
+          ensure => file,
+          source => $::puppet_sslpaths['hostcrl']['path'],
+          backup => false
+        }
+      }
+    }
+    default: {
+      fail('$::puppet-sslpaths is not a Hash. Is stringify_facts not set to false in the main section of the agent puppet.conf?')
     }
   }
 }