From 4ab20c2454bd8be26403caf10a1b3e812fef66ed Mon Sep 17 00:00:00 2001
From: Josh Patterson <josh.patterson@securityonionsolutions.com>
Date: Wed, 7 Jan 2026 14:14:57 -0500
Subject: [PATCH] dont remove ca in ssl.remove

---
 salt/ssl/remove.sls | 9 +--------
 1 file changed, 1 insertion(+), 8 deletions(-)

diff --git a/salt/ssl/remove.sls b/salt/ssl/remove.sls
index 08e97180e..e91605551 100644
--- a/salt/ssl/remove.sls
+++ b/salt/ssl/remove.sls
@@ -3,14 +3,6 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
-trusttheca:
-  file.absent:
-    - name: /etc/pki/tls/certs/intca.crt
-
-symlinkca:
-  file.absent:
-    - name: /etc/ssl/certs/intca.crt
-
 influxdb_key:
   file.absent:
     - name: /etc/pki/influxdb.key
@@ -43,6 +35,7 @@ etc_filebeat_crt:
   file.absent:
     - name: /etc/pki/filebeat.crt
 
+# manager has symlink to /etc/pki/filebeat.crt and /etc/pki/filebeat.p8
 filebeatdir:
   file.absent:
     - name: /opt/so/saltstack/local/salt/filebeat/files