custom.yml

sslcert:
  gencert:
    name: /etc/pki/{{ grains.id }}.crt
    days_remaining: 30
    user: vagrant
    group: vagrant
    mode: 640
    kwargs:
      ca_server: salt
      signing_policy: testingca
      CN: {{ grains.id }}
      days_valid: 90
      public_key: /etc/pki/{{ grains.id }}.key
      subjectAltName: DNS:myvirthost.local, DNS:{{ grains.id }}

gencert.sls

...

sslcert_gen_cert:
  x509.certificate_managed:
    - name: {{ sslcert.gencert.name }}
    - days_remaining: {{ sslcert.gencert.days_remaining }}
    - backup: True
    {% for k, v in sslcert.gencert.kwargs.iteritems() -%}
    - {{ k }}: {{ v }}
    {% endfor %}
    - onlyif: test -s /usr/local/share/ca-certificates/{{ sslcert.gencert.kwargs.signing_policy }}.crt
    
...

signing_policy.conf

x509_signing_policies:
  testingca:
    - minions: '*'
    - signing_private_key: /etc/pki/testingca/ca.key
    - signing_cert: /etc/pki/testingca/ca.crt
    - C: US
    - ST: MyState
    - L: MyCity
    - basicConstraints: "critical CA:false"
    - keyUsage: "critical digitalSignature, keyEncipherment"
    - subjectKeyIdentifier: hash
    - authorityKeyIdentifier: keyid,issuer:always
    - days_valid: 90
    - copypath: /etc/pki/testingca/issued_certs/