PKI client cert paths

salt/minion/cert.sls

 {%- from "salt/map.jinja" import minion with context %}
 {%- if minion.enabled %}
 
-include:
-- salt.minion.service
-
-{%- for cert_name,cert in minion.cert.iteritems() %}
+{%- for cert_name,cert in minion.get('cert', {}).iteritems() %}
 {%- set rowloop = loop %}
 
-ca_dir_{{ cert.authority }}_{{ loop.index }}:
-  file.directory:
-  - name: /etc/pki/cert/{{ cert.authority }}
-  - makedirs: true
-
-/etc/pki/cert/{{ cert.authority }}/{{ cert.common_name }}.key:
+/etc/ssl/private/{{ cert.common_name }}.key:
   x509.private_key_managed:
   - bits: 4096
 
-/etc/pki/cert/{{ cert.authority }}/{{ cert.common_name }}.crt:
+/etc/ssl/certs/{{ cert.common_name }}.crt:
   x509.certificate_managed:
   - ca_server: {{ cert.host }}
   - signing_policy: {{ cert.authority }}_{{ cert.signing_policy }}
-  - public_key: /etc/pki/cert/{{ cert.authority }}/{{ cert.common_name }}.key
+  - public_key: /etc/ssl/private/{{ cert.common_name }}.key
   - CN: {{ cert.common_name }}
+  {%- if cert.alternative_names is defined %}
+  - subjectAltName: {{ cert.alternative_names }}
+  {%- endif %}
   - days_remaining: 30
   - backup: True
 
 
 ca_cert_{{ cert.authority }}_{{ rowloop.index }}:
   x509.pem_managed:
-  - name: /etc/pki/cert/{{ cert.authority }}/ca.crt
+  - name: /etc/ssl/certs/ca-{{ cert.authority }}.crt
   - text: {{ ca_cert|replace('\n', '') }}
 
 {%- endif %}

tests/pillar/minion_pki_cert.sls

         signing_policy: cert_server
         authority: Company CA
         common_name: test.server.domain.tld
+        alternative_names: DNS:www1.server.domain.tld,DNS:www2.server.domain.tld,IP:1.2.3.4,IP:2.3.4.5
       test_client:
         host: minion.with.ca
         signing_policy: cert_client
         host: minion.with.ca
         signing_policy: ca_edge
         authority: Company CA
-        common_name: test.ca.domain.tld
+        common_name: test.ca.domain.tld