From c755c8bc61255ef20d50c26dfbd40cccd633c297 Mon Sep 17 00:00:00 2001
From: Josh Patterson <josh.patterson@securityonionsolutions.com>
Date: Thu, 16 Jul 2026 13:46:12 -0400
Subject: [PATCH] Gracefully skip SSL cert states when the CA is unavailable

The *.ssl x509.certificate_managed states hard-failed the state run when
the CA/manager minion was unreachable (ca_server did not respond), and the
paired private_key_managed states then failed on the prereq requisite. The
- timeout: 30 on these states was a no-op (Salt has no per-state timeout
requisite; only retry accepts until/attempts/interval/splay).

Add an onlyif CA-reachability gate to every certificate_managed state so the
state is skipped as a clean success when the CA does not answer a peer
test.ping within 3s and the cert already exists. When the cert is missing
(initial provisioning) the state still runs so the existing retry waits for
the CA. The reachability command is centralized as CA.reachable_cmd in
ca/map.jinja, and the master peer config now permits test.ping. The no-op
- timeout: 30 is removed from all cert states.
---
 files/salt/master/master   |  1 +
 salt/ca/map.jinja          |  4 ++++
 salt/elasticfleet/ssl.sls  |  9 ++++++---
 salt/elasticsearch/ssl.sls |  3 ++-
 salt/influxdb/ssl.sls      |  3 ++-
 salt/kafka/ssl.sls         |  9 ++++++---
 salt/logstash/ssl.sls      | 12 ++++++++----
 salt/nginx/ssl.sls         |  3 ++-
 salt/postgres/ssl.sls      |  3 ++-
 salt/redis/ssl.sls         |  3 ++-
 salt/registry/ssl.sls      |  3 ++-
 salt/telegraf/ssl.sls      |  3 ++-
 12 files changed, 39 insertions(+), 17 deletions(-)

diff --git a/files/salt/master/master b/files/salt/master/master
index 2333a50aa..15b4247bd 100644
--- a/files/salt/master/master
+++ b/files/salt/master/master
@@ -64,5 +64,6 @@ pillar_roots:
 peer:
   .*:
     - x509.sign_remote_certificate
+    - test.ping
 
 
diff --git a/salt/ca/map.jinja b/salt/ca/map.jinja
index 87641198d..a8daf95cb 100644
--- a/salt/ca/map.jinja
+++ b/salt/ca/map.jinja
@@ -1,3 +1,7 @@
 {% set CA = {
     'server': pillar.ca.server
 }%}
+{# reachable_cmd: shell test used by the *.ssl cert states' onlyif to skip cert
+   management gracefully when the CA minion is unreachable. Returns exit 0 when
+   the CA answers a peer test.ping within 3s, non-zero otherwise. #}
+{% do CA.update({'reachable_cmd': "salt-call --out=json publish.publish '" ~ CA.server ~ "' test.ping timeout=3 2>/dev/null | grep -q true"}) %}
diff --git a/salt/elasticfleet/ssl.sls b/salt/elasticfleet/ssl.sls
index 8d19ea68c..992f67922 100644
--- a/salt/elasticfleet/ssl.sls
+++ b/salt/elasticfleet/ssl.sls
@@ -38,7 +38,8 @@ etc_elasticfleet_crt:
     - days_remaining: 7
     - days_valid: 820
     - backup: True
-    - timeout: 30
+    - onlyif:
+      - test ! -f /etc/pki/elasticfleet-server.crt || {{ CA.reachable_cmd }}
     - retry:
         attempts: 5
         interval: 30
@@ -94,7 +95,8 @@ etc_elasticfleet_agent_crt:
     - days_remaining: 7
     - days_valid: 820
     - backup: True
-    - timeout: 30
+    - onlyif:
+      - test ! -f /etc/pki/elasticfleet-agent.crt || {{ CA.reachable_cmd }}
     - retry:
         attempts: 5
         interval: 30
@@ -155,7 +157,8 @@ elasticfleet_kafka_crt:
     - days_remaining: 7
     - days_valid: 820
     - backup: True
-    - timeout: 30
+    - onlyif:
+      - test ! -f /etc/pki/elasticfleet-kafka.crt || {{ CA.reachable_cmd }}
     - retry:
         attempts: 5
         interval: 30
diff --git a/salt/elasticsearch/ssl.sls b/salt/elasticsearch/ssl.sls
index a2d327830..878db286b 100644
--- a/salt/elasticsearch/ssl.sls
+++ b/salt/elasticsearch/ssl.sls
@@ -34,7 +34,8 @@ elasticsearch_crt:
     - days_remaining: 7
     - days_valid: 820
     - backup: True
-    - timeout: 30
+    - onlyif:
+      - test ! -f /etc/pki/elasticsearch.crt || {{ CA.reachable_cmd }}
     - retry:
         attempts: 5
         interval: 30
diff --git a/salt/influxdb/ssl.sls b/salt/influxdb/ssl.sls
index 930879c75..39b216dfd 100644
--- a/salt/influxdb/ssl.sls
+++ b/salt/influxdb/ssl.sls
@@ -34,7 +34,8 @@ influxdb_crt:
     - days_remaining: 7
     - days_valid: 820
     - backup: True
-    - timeout: 30
+    - onlyif:
+      - test ! -f /etc/pki/influxdb.crt || {{ CA.reachable_cmd }}
     - retry:
         attempts: 5
         interval: 30
diff --git a/salt/kafka/ssl.sls b/salt/kafka/ssl.sls
index 2ee19f731..414c385fc 100644
--- a/salt/kafka/ssl.sls
+++ b/salt/kafka/ssl.sls
@@ -38,7 +38,8 @@ kafka_client_crt:
     - days_remaining: 7
     - days_valid: 820
     - backup: True
-    - timeout: 30
+    - onlyif:
+      - test ! -f /etc/pki/kafka-client.crt || {{ CA.reachable_cmd }}
     - retry:
         attempts: 5
         interval: 30
@@ -86,7 +87,8 @@ kafka_crt:
     - days_remaining: 7
     - days_valid: 820
     - backup: True
-    - timeout: 30
+    - onlyif:
+      - test ! -f /etc/pki/kafka.crt || {{ CA.reachable_cmd }}
     - retry:
         attempts: 5
         interval: 30
@@ -148,7 +150,8 @@ kafka_logstash_crt:
     - days_remaining: 7
     - days_valid: 820
     - backup: True
-    - timeout: 30
+    - onlyif:
+      - test ! -f /etc/pki/kafka-logstash.crt || {{ CA.reachable_cmd }}
     - retry:
         attempts: 5
         interval: 30
diff --git a/salt/logstash/ssl.sls b/salt/logstash/ssl.sls
index 935088e30..f25c762ae 100644
--- a/salt/logstash/ssl.sls
+++ b/salt/logstash/ssl.sls
@@ -38,7 +38,8 @@ etc_elasticfleet_logstash_crt:
     - days_remaining: 7
     - days_valid: 820
     - backup: True
-    - timeout: 30
+    - onlyif:
+      - test ! -f /etc/pki/elasticfleet-logstash.crt || {{ CA.reachable_cmd }}
     - retry:
         attempts: 5
         interval: 30
@@ -99,7 +100,8 @@ etc_elasticfleetlumberjack_crt:
     - days_remaining: 7
     - days_valid: 820
     - backup: True
-    - timeout: 30
+    - onlyif:
+      - test ! -f /etc/pki/elasticfleet-lumberjack.crt || {{ CA.reachable_cmd }}
     - retry:
         attempts: 5
         interval: 30
@@ -168,7 +170,8 @@ etc_filebeat_crt:
     - days_remaining: 7
     - days_valid: 820
     - backup: True
-    - timeout: 30
+    - onlyif:
+      - test ! -f /etc/pki/filebeat.crt || {{ CA.reachable_cmd }}
     - retry:
         attempts: 5
         interval: 30
@@ -249,7 +252,8 @@ conf_filebeat_crt:
     - days_remaining: 7
     - days_valid: 820
     - backup: True
-    - timeout: 30
+    - onlyif:
+      - test ! -f /opt/so/conf/filebeat/etc/pki/filebeat.crt || {{ CA.reachable_cmd }}
     - retry:
         attempts: 5
         interval: 30
diff --git a/salt/nginx/ssl.sls b/salt/nginx/ssl.sls
index b90f4af0a..6de8e8e7d 100644
--- a/salt/nginx/ssl.sls
+++ b/salt/nginx/ssl.sls
@@ -71,7 +71,8 @@ managerssl_crt:
     - days_remaining: 7
     - days_valid: 820
     - backup: True
-    - timeout: 30
+    - onlyif:
+      - test ! -f /etc/pki/managerssl.crt || {{ CA.reachable_cmd }}
     - retry:
         attempts: 5
         interval: 30
diff --git a/salt/postgres/ssl.sls b/salt/postgres/ssl.sls
index 4223ead34..2fcf072f8 100644
--- a/salt/postgres/ssl.sls
+++ b/salt/postgres/ssl.sls
@@ -33,7 +33,8 @@ postgres_crt:
     - days_remaining: 7
     - days_valid: 820
     - backup: True
-    - timeout: 30
+    - onlyif:
+      - test ! -f /etc/pki/postgres.crt || {{ CA.reachable_cmd }}
     - retry:
         attempts: 5
         interval: 30
diff --git a/salt/redis/ssl.sls b/salt/redis/ssl.sls
index cd68d900f..459162833 100644
--- a/salt/redis/ssl.sls
+++ b/salt/redis/ssl.sls
@@ -33,7 +33,8 @@ redis_crt:
     - days_remaining: 7
     - days_valid: 820
     - backup: True
-    - timeout: 30
+    - onlyif:
+      - test ! -f /etc/pki/redis.crt || {{ CA.reachable_cmd }}
     - retry:
         attempts: 5
         interval: 30
diff --git a/salt/registry/ssl.sls b/salt/registry/ssl.sls
index b739e9cc4..dc94ea745 100644
--- a/salt/registry/ssl.sls
+++ b/salt/registry/ssl.sls
@@ -55,7 +55,8 @@ registry_crt:
     - backup: True
     - require:
       - file: registry_crt_cleanup
-    - timeout: 30
+    - onlyif:
+      - test ! -f /etc/pki/registry.crt || {{ CA.reachable_cmd }}
     - retry:
         attempts: 15
         interval: 10
diff --git a/salt/telegraf/ssl.sls b/salt/telegraf/ssl.sls
index c222f5cda..8a69a81d0 100644
--- a/salt/telegraf/ssl.sls
+++ b/salt/telegraf/ssl.sls
@@ -34,7 +34,8 @@ telegraf_crt:
     - days_remaining: 7
     - days_valid: 820
     - backup: True
-    - timeout: 30
+    - onlyif:
+      - test ! -f /etc/pki/telegraf.crt || {{ CA.reachable_cmd }}
     - retry:
         attempts: 5
         interval: 30