diff --git a/salt/ssl/init.sls b/salt/ssl/init.sls
index 0a3de6d1e..ea39726df 100644
--- a/salt/ssl/init.sls
+++ b/salt/ssl/init.sls
@@ -63,6 +63,12 @@ fbcrtlink:
 
 {% endif %}
 {% if grains['role'] == 'so-SENSOR' %}
+
+fbcertdir:
+  file.directory:
+    - name: /opt/so/conf/filebeat/etc/pki
+    - mkdirs: True
+
 # Request a cert and drop it where it needs to go to be distributed
 /opt/so/conf/filebeat/etc/pki/filebeat.crt:
   x509.certificate_managed: