diff --git a/spec/defines/resource_vhost_spec.rb b/spec/defines/resource_vhost_spec.rb
index 1d4353750..d09b52b6f 100644
--- a/spec/defines/resource_vhost_spec.rb
+++ b/spec/defines/resource_vhost_spec.rb
@@ -956,6 +956,24 @@
             |/)
         end
       end
+
+      context 'when add_header is set and ssl => true' do
+        let :params do default_params.merge({
+          :add_header => { 'header3' => 'test value 3', 'header2' => 'test value 2', 'header1' => 'test value 1' },
+          :ssl        => true,
+          :ssl_key    => 'dummy.key',
+          :ssl_cert   => 'dummy.cert',
+        }) end
+
+        it 'should have correctly ordered entries in the config' do
+          is_expected.to contain_concat__fragment("#{title}-ssl-header").with_content(/
+            %r|
+            \s+add_header\s+header1 test value 1;\n
+            \s+add_header\s+header2 test value 2;\n
+            \s+add_header\s+header3 test value 3;\n
+            |/)
+        end
+      end
     end
   end
 end
diff --git a/templates/vhost/vhost_ssl_header.erb b/templates/vhost/vhost_ssl_header.erb
index c1de6ad30..707618271 100644
--- a/templates/vhost/vhost_ssl_header.erb
+++ b/templates/vhost/vhost_ssl_header.erb
@@ -131,6 +131,8 @@ server {
 <% Array(@passenger_env_var).each do |key,value| -%>
   passenger_env_var  <%= key %> <%= value %>;
 <% end -%>
-<% Array(@add_header).each do |key,value| -%>
-  add_header              <%= key %> <%= value %>;
+<% if @add_header -%>
+  <%- @add_header.keys.sort.each do |key| -%>
+  add_header              <%= key %> <%= @add_header[key] %>;
+  <%- end -%>
 <% end -%>