In my audit logs I found this entry:
type=AVC msg=audit(1434769414.956:562): avc: denied { open } for pid=3558 comm="ruby" path="/etc/puppet/environments/production/modules/bacula/files/monitor1/monitor1.mydomain.com.crt" dev="vda1" ino=1842005 scontext=system_u:system_r:passenger_t:s0 tcontext=system_u:object_r:nfs_t:s0 tclass=file
Knowing nothing of your scenario, look at the source and target context.
Looks like you copied a crt from an nfs location and you don't have a file context defined to transition labels, maybe something like:
semanage fcontext -a -t passenger_t "/etc/puppet/environments(/.*)?"
However, I know nothing of puppets selinux infrastructure, you may need a more applicable type.
In these cases, audit2allow can't possibly guess the right thing and will certainly produce a rule that is either unsafe or simply wrong.
jlc