diff --git a/files/salt/master/master b/files/salt/master/master
index 2333a50aa..15b4247bd 100644
--- a/files/salt/master/master
+++ b/files/salt/master/master
@@ -64,5 +64,6 @@ pillar_roots:
 peer:
   .*:
     - x509.sign_remote_certificate
+    - test.ping
 
 
diff --git a/salt/ca/map.jinja b/salt/ca/map.jinja
index 87641198d..a8daf95cb 100644
--- a/salt/ca/map.jinja
+++ b/salt/ca/map.jinja
@@ -1,3 +1,7 @@
 {% set CA = {
     'server': pillar.ca.server
 }%}
+{# reachable_cmd: shell test used by the *.ssl cert states' onlyif to skip cert
+   management gracefully when the CA minion is unreachable. Returns exit 0 when
+   the CA answers a peer test.ping within 3s, non-zero otherwise. #}
+{% do CA.update({'reachable_cmd': "salt-call --out=json publish.publish '" ~ CA.server ~ "' test.ping timeout=3 2>/dev/null | grep -q true"}) %}
diff --git a/salt/elasticfleet/ssl.sls b/salt/elasticfleet/ssl.sls
index 8d19ea68c..992f67922 100644
--- a/salt/elasticfleet/ssl.sls
+++ b/salt/elasticfleet/ssl.sls
@@ -38,7 +38,8 @@ etc_elasticfleet_crt:
     - days_remaining: 7
     - days_valid: 820
     - backup: True
-    - timeout: 30
+    - onlyif:
+      - test ! -f /etc/pki/elasticfleet-server.crt || {{ CA.reachable_cmd }}
     - retry:
         attempts: 5
         interval: 30
@@ -94,7 +95,8 @@ etc_elasticfleet_agent_crt:
     - days_remaining: 7
     - days_valid: 820
     - backup: True
-    - timeout: 30
+    - onlyif:
+      - test ! -f /etc/pki/elasticfleet-agent.crt || {{ CA.reachable_cmd }}
     - retry:
         attempts: 5
         interval: 30
@@ -155,7 +157,8 @@ elasticfleet_kafka_crt:
     - days_remaining: 7
     - days_valid: 820
     - backup: True
-    - timeout: 30
+    - onlyif:
+      - test ! -f /etc/pki/elasticfleet-kafka.crt || {{ CA.reachable_cmd }}
     - retry:
         attempts: 5
         interval: 30
diff --git a/salt/elasticsearch/ssl.sls b/salt/elasticsearch/ssl.sls
index a2d327830..878db286b 100644
--- a/salt/elasticsearch/ssl.sls
+++ b/salt/elasticsearch/ssl.sls
@@ -34,7 +34,8 @@ elasticsearch_crt:
     - days_remaining: 7
     - days_valid: 820
     - backup: True
-    - timeout: 30
+    - onlyif:
+      - test ! -f /etc/pki/elasticsearch.crt || {{ CA.reachable_cmd }}
     - retry:
         attempts: 5
         interval: 30
diff --git a/salt/influxdb/ssl.sls b/salt/influxdb/ssl.sls
index 930879c75..39b216dfd 100644
--- a/salt/influxdb/ssl.sls
+++ b/salt/influxdb/ssl.sls
@@ -34,7 +34,8 @@ influxdb_crt:
     - days_remaining: 7
     - days_valid: 820
     - backup: True
-    - timeout: 30
+    - onlyif:
+      - test ! -f /etc/pki/influxdb.crt || {{ CA.reachable_cmd }}
     - retry:
         attempts: 5
         interval: 30
diff --git a/salt/kafka/ssl.sls b/salt/kafka/ssl.sls
index 2ee19f731..414c385fc 100644
--- a/salt/kafka/ssl.sls
+++ b/salt/kafka/ssl.sls
@@ -38,7 +38,8 @@ kafka_client_crt:
     - days_remaining: 7
     - days_valid: 820
     - backup: True
-    - timeout: 30
+    - onlyif:
+      - test ! -f /etc/pki/kafka-client.crt || {{ CA.reachable_cmd }}
     - retry:
         attempts: 5
         interval: 30
@@ -86,7 +87,8 @@ kafka_crt:
     - days_remaining: 7
     - days_valid: 820
     - backup: True
-    - timeout: 30
+    - onlyif:
+      - test ! -f /etc/pki/kafka.crt || {{ CA.reachable_cmd }}
     - retry:
         attempts: 5
         interval: 30
@@ -148,7 +150,8 @@ kafka_logstash_crt:
     - days_remaining: 7
     - days_valid: 820
     - backup: True
-    - timeout: 30
+    - onlyif:
+      - test ! -f /etc/pki/kafka-logstash.crt || {{ CA.reachable_cmd }}
     - retry:
         attempts: 5
         interval: 30
diff --git a/salt/logstash/ssl.sls b/salt/logstash/ssl.sls
index 935088e30..f25c762ae 100644
--- a/salt/logstash/ssl.sls
+++ b/salt/logstash/ssl.sls
@@ -38,7 +38,8 @@ etc_elasticfleet_logstash_crt:
     - days_remaining: 7
     - days_valid: 820
     - backup: True
-    - timeout: 30
+    - onlyif:
+      - test ! -f /etc/pki/elasticfleet-logstash.crt || {{ CA.reachable_cmd }}
     - retry:
         attempts: 5
         interval: 30
@@ -99,7 +100,8 @@ etc_elasticfleetlumberjack_crt:
     - days_remaining: 7
     - days_valid: 820
     - backup: True
-    - timeout: 30
+    - onlyif:
+      - test ! -f /etc/pki/elasticfleet-lumberjack.crt || {{ CA.reachable_cmd }}
     - retry:
         attempts: 5
         interval: 30
@@ -168,7 +170,8 @@ etc_filebeat_crt:
     - days_remaining: 7
     - days_valid: 820
     - backup: True
-    - timeout: 30
+    - onlyif:
+      - test ! -f /etc/pki/filebeat.crt || {{ CA.reachable_cmd }}
     - retry:
         attempts: 5
         interval: 30
@@ -249,7 +252,8 @@ conf_filebeat_crt:
     - days_remaining: 7
     - days_valid: 820
     - backup: True
-    - timeout: 30
+    - onlyif:
+      - test ! -f /opt/so/conf/filebeat/etc/pki/filebeat.crt || {{ CA.reachable_cmd }}
     - retry:
         attempts: 5
         interval: 30
diff --git a/salt/nginx/ssl.sls b/salt/nginx/ssl.sls
index b90f4af0a..6de8e8e7d 100644
--- a/salt/nginx/ssl.sls
+++ b/salt/nginx/ssl.sls
@@ -71,7 +71,8 @@ managerssl_crt:
     - days_remaining: 7
     - days_valid: 820
     - backup: True
-    - timeout: 30
+    - onlyif:
+      - test ! -f /etc/pki/managerssl.crt || {{ CA.reachable_cmd }}
     - retry:
         attempts: 5
         interval: 30
diff --git a/salt/postgres/ssl.sls b/salt/postgres/ssl.sls
index 4223ead34..2fcf072f8 100644
--- a/salt/postgres/ssl.sls
+++ b/salt/postgres/ssl.sls
@@ -33,7 +33,8 @@ postgres_crt:
     - days_remaining: 7
     - days_valid: 820
     - backup: True
-    - timeout: 30
+    - onlyif:
+      - test ! -f /etc/pki/postgres.crt || {{ CA.reachable_cmd }}
     - retry:
         attempts: 5
         interval: 30
diff --git a/salt/redis/ssl.sls b/salt/redis/ssl.sls
index cd68d900f..459162833 100644
--- a/salt/redis/ssl.sls
+++ b/salt/redis/ssl.sls
@@ -33,7 +33,8 @@ redis_crt:
     - days_remaining: 7
     - days_valid: 820
     - backup: True
-    - timeout: 30
+    - onlyif:
+      - test ! -f /etc/pki/redis.crt || {{ CA.reachable_cmd }}
     - retry:
         attempts: 5
         interval: 30
diff --git a/salt/registry/ssl.sls b/salt/registry/ssl.sls
index b739e9cc4..dc94ea745 100644
--- a/salt/registry/ssl.sls
+++ b/salt/registry/ssl.sls
@@ -55,7 +55,8 @@ registry_crt:
     - backup: True
     - require:
       - file: registry_crt_cleanup
-    - timeout: 30
+    - onlyif:
+      - test ! -f /etc/pki/registry.crt || {{ CA.reachable_cmd }}
     - retry:
         attempts: 15
         interval: 10
diff --git a/salt/telegraf/ssl.sls b/salt/telegraf/ssl.sls
index c222f5cda..8a69a81d0 100644
--- a/salt/telegraf/ssl.sls
+++ b/salt/telegraf/ssl.sls
@@ -34,7 +34,8 @@ telegraf_crt:
     - days_remaining: 7
     - days_valid: 820
     - backup: True
-    - timeout: 30
+    - onlyif:
+      - test ! -f /etc/pki/telegraf.crt || {{ CA.reachable_cmd }}
     - retry:
         attempts: 5
         interval: 30