First run is made during salt-master cloud-init and thus it is onchanges is not suitable here because ca.crt file is already generated.