# Buggy code
def _new_extension(name, value, critical=0, issuer=None, _pyfree=1):
    """
    Create new X509_Extension, This is required because M2Crypto
    doesn't support getting the publickeyidentifier from the issuer
    to create the authoritykeyidentifier extension.
    """
    if (
        name == "subjectKeyIdentifier"
        and value.strip("0123456789abcdefABCDEF:") is not ""
    ):
        raise salt.exceptions.SaltInvocationError("value must be precomputed hash")

    try:
        ctx = M2Crypto.m2.x509v3_set_nconf()
        _fix_ctx(ctx, issuer)
        if ctx is None:
            raise MemoryError("Not enough memory when creating a new X509 extension")
        x509_ext_ptr = M2Crypto.m2.x509v3_ext_conf(None, ctx, name, value)
        lhash = None
    except AttributeError:
        lhash = M2Crypto.m2.x509v3_lhash()  # pylint: disable=no-member
        ctx = M2Crypto.m2.x509v3_set_conf_lhash(lhash)  # pylint: disable=no-member
        # ctx not zeroed
        _fix_ctx(ctx, issuer)
        x509_ext_ptr = M2Crypto.m2.x509v3_ext_conf(lhash, ctx, name, value)  # pylint: disable=no-member
    # ctx,lhash freed

    if x509_ext_ptr is None:
        raise M2Crypto.X509.X509Error(
            "Cannot create X509_Extension with name '{0}' and value '{1}'".format(
                name, value
            )
        )
    x509_ext = M2Crypto.X509.X509_Extension(x509_ext_ptr, _pyfree)
    x509_ext.set_critical(critical)
    return x509_ext


# Traceback (CommandExecutionError)
----------
ID: certificate.authority::private-key
Function: x509.private_key_managed
Name: /salt/pki/ca.key
Result: False
Comment: An exception occurred in this state: Traceback (most recent call last):
File "/opt/local/lib/python2.7/site-packages/salt/state.py", line 1876, in call
**cdata['kwargs'])
File "/opt/local/lib/python2.7/site-packages/salt/loader.py", line 1823, in wrapper
return f(*args, **kwargs)
File "/opt/local/lib/python2.7/site-packages/salt/states/x509.py", line 303, in private_key_managed
name, bits=bits, passphrase=passphrase, new=new, overwrite=overwrite):
File "/opt/local/lib/python2.7/site-packages/salt/states/x509.py", line 240, in _check_private_key
'The provided passphrase cannot decrypt the private key.')
CommandExecutionError: The provided passphrase cannot decrypt the private key.
Started: 19:28:45.695662
Duration: 7.64 ms
Changes:
----------

# Fixed code
def _new_extension(name, value, critical=0, issuer=None, _pyfree=1):
    """
    Create new X509_Extension, This is required because M2Crypto
    doesn't support getting the publickeyidentifier from the issuer
    to create the authoritykeyidentifier extension.
    """
    if (
        name == "subjectKeyIdentifier"
        and value.strip("0123456789abcdefABCDEF:") is not ""
    ):
        raise salt.exceptions.SaltInvocationError("value must be precomputed hash")

    # ensure name and value are bytes
    name = salt.utils.stringutils.to_bytes(name)
    value = salt.utils.stringutils.to_bytes(value)

    try:
        ctx = M2Crypto.m2.x509v3_set_nconf()
        _fix_ctx(ctx, issuer)
        if ctx is None:
            raise MemoryError("Not enough memory when creating a new X509 extension")
        x509_ext_ptr = M2Crypto.m2.x509v3_ext_conf(None, ctx, name, value)
        lhash = None
    except AttributeError:
        lhash = M2Crypto.m2.x509v3_lhash()  # pylint: disable=no-member
        ctx = M2Crypto.m2.x509v3_set_conf_lhash(lhash)  # pylint: disable=no-member
        # ctx not zeroed
        _fix_ctx(ctx, issuer)
        x509_ext_ptr = M2Crypto.m2.x509v3_ext_conf(lhash, ctx, name, value)  # pylint: disable=no-member
    # ctx,lhash freed

    if x509_ext_ptr is None:
        raise M2Crypto.X509.X509Error(
            "Cannot create X509_Extension with name '{0}' and value '{1}'".format(
                name, value
            )
        )
    x509_ext = M2Crypto.X509.X509_Extension(x509_ext_ptr, _pyfree)
    x509_ext.set_critical(critical)
    return x509_ext