/srv/salt/cert.sls /usr/local/share/ca-certificates: file.directory /usr/local/share/ca-certificates/intca.crt: x509.pem_managed: - text: {{ salt ['mine.get' ]( 'ca', 'x509.get_pem_entries' )[ 'ca' ][ '/etc/pki/ca.crt' ]| replace ( ' ', '' ) }} This state creates a private key then requests a certificate signed by ca according to the www policy.
/srv/salt/www.sls /etc/pki/www.crt : x509.private_key_managed : - name : /etc/pki/www.key - bits : 4096 - backup : True /etc/pki/www.crt : x509.certificate_managed : - ca_server : ca - signing_policy : www - public