cert and CAfile are not global options

[micah]

In tun.erb, there is this:

# This file managed by Puppet
<% if @cert_real != '' -%>
cert = <%= @cert_real %>
<% end -%>
<% if @cafile_real != '' -%>
CAfile = <%= @cafile_real %>
<% else -%>
# CAfile = /path/to/cafile.crt
<% end -%>

however, in stunnel4(8) it explicitly details which options are valid global options, and which options are service-specific options (have to occur underneath a [service name] block), and the cert and CAfile options are only specified under the SERVICE-LEVEL OPTIONS section.