# Buggy code
def write_pem(text, path, overwrite=True, pem_type=None):
    """
    Writes out a PEM string fixing any formatting or whitespace
    issues before writing.

    text:
        PEM string input to be written out.

    path:
        Path of the file to write the pem out to.

    overwrite:
        If True(default), write_pem will overwrite the entire pem file.
        Set False to preserve existing private keys and dh params that may
        exist in the pem file.

    pem_type:
        The PEM type to be saved, for example ``CERTIFICATE`` or
        ``PUBLIC KEY``. Adding this will allow the function to take
        input that may contain multiple pem types.

    CLI Example:

    .. code-block:: bash

        salt '*' x509.write_pem \\
            "-----BEGIN CERTIFICATE-----MIIGMzCCBBugA..." \\
            path=/etc/pki/mycert.crt
    """
    old_umask = os.umask(0o77)
    text = get_pem_entry(text, pem_type=pem_type)
    _dhparams = ""
    _private_key = ""
    if (
        pem_type
        and pem_type == "CERTIFICATE"
        and os.path.isfile(path)
        and not overwrite
    ):
        _filecontents = _text_or_file(path)
        try:
            _dhparams = get_pem_entry(_filecontents, "DH PARAMETERS")
        except salt.exceptions.SaltInvocationError:
            pass
        try:
            _private_key = get_pem_entry(_filecontents, "RSA PRIVATE KEY")
        except salt.exceptions.SaltInvocationError:
            pass
    with salt.utils.fopen(path, "w") as _fp:
        if pem_type and pem_type == "CERTIFICATE" and _private_key:
            _fp.write(_private_key)
        _fp.write(text)
        if pem_type and pem_type == "CERTIFICATE" and _dhparams:
            _fp.write(_dhparams)
    os.umask(old_umask)
    return "PEM written to {0}".format(path)


# Traceback (SaltInvocationError)
Traceback (most recent call last):
File "/usr/lib/python2.7/site-packages/salt/cli/caller.py", line 197, in call
ret['return'] = func(*args, **kwargs)
File "/usr/lib/python2.7/site-packages/salt/modules/x509.py", line 1509, in create_certificate
passphrase=kwargs['signing_private_key_passphrase']),
File "/usr/lib/python2.7/site-packages/salt/modules/x509.py", line 358, in _get_private_key_obj
private_key = get_pem_entry(private_key, pem_type='RSA PRIVATE KEY')
File "/usr/lib/python2.7/site-packages/salt/modules/x509.py", line 472, in get_pem_entry
raise salt.exceptions.SaltInvocationError(errmsg)
SaltInvocationError: PEM does not contain a single entry of type RSA PRIVATE KEY:
-----BEGIN PRIVATE KEY-----
[PRIVATE KEY GOES HERE]
-----END PRIVATE KEY-----

# Fixed code
def write_pem(text, path, overwrite=True, pem_type=None):
    """
    Writes out a PEM string fixing any formatting or whitespace
    issues before writing.

    text:
        PEM string input to be written out.

    path:
        Path of the file to write the pem out to.

    overwrite:
        If True(default), write_pem will overwrite the entire pem file.
        Set False to preserve existing private keys and dh params that may
        exist in the pem file.

    pem_type:
        The PEM type to be saved, for example ``CERTIFICATE`` or
        ``PUBLIC KEY``. Adding this will allow the function to take
        input that may contain multiple pem types.

    CLI Example:

    .. code-block:: bash

        salt '*' x509.write_pem \\
            "-----BEGIN CERTIFICATE-----MIIGMzCCBBugA..." \\
            path=/etc/pki/mycert.crt
    """
    old_umask = os.umask(0o77)
    text = get_pem_entry(text, pem_type=pem_type)
    _dhparams = ""
    _private_key = ""
    if (
        pem_type
        and pem_type == "CERTIFICATE"
        and os.path.isfile(path)
        and not overwrite
    ):
        _filecontents = _text_or_file(path)
        try:
            _dhparams = get_pem_entry(_filecontents, "DH PARAMETERS")
        except salt.exceptions.SaltInvocationError:
            pass
        try:
            _private_key = get_pem_entry(_filecontents, "(?:RSA )?PRIVATE KEY")
        except salt.exceptions.SaltInvocationError:
            pass
    with salt.utils.fopen(path, "w") as _fp:
        if pem_type and pem_type == "CERTIFICATE" and _private_key:
            _fp.write(_private_key)
        _fp.write(text)
        if pem_type and pem_type == "CERTIFICATE" and _dhparams:
            _fp.write(_dhparams)
    os.umask(old_umask)
    return "PEM written to {0}".format(path)