{% set CA = {
    'server': pillar.ca.server
}%}
{# reachable_cmd: shell test used by the *.ssl cert states' onlyif to skip cert
   management gracefully when the CA minion is unreachable. Returns exit 0 when
   the CA answers a peer test.ping within 3s, non-zero otherwise. #}
{% do CA.update({'reachable_cmd': "salt-call --out=json publish.publish '" ~ CA.server ~ "' test.ping timeout=3 2>/dev/null | grep -q true"}) %}