# Buggy code
def sign_remote_certificate(argdic, **kwargs):
    """
    Request a certificate to be remotely signed according to a signing policy.

    argdic:
        A dict containing all the arguments to be passed into the
        create_certificate function. This will become kwargs when passed
        to create_certificate.

    kwargs:
        kwargs delivered from publish.publish

    CLI Example:

    .. code-block:: bash

        salt '*' x509.sign_remote_certificate argdic="{'public_key': '/etc/pki/www.key', 'signing_policy': 'www'}" __pub_id='www1'
    """
    if "signing_policy" not in argdic:
        return "signing_policy must be specified"

    if not isinstance(argdic, dict):
        argdic = ast.literal_eval(argdic)

    signing_policy = {}
    if "signing_policy" in argdic:
        signing_policy = _get_signing_policy(argdic["signing_policy"])
        if not signing_policy:
            return "Signing policy {0} does not exist.".format(argdic["signing_policy"])

        if isinstance(signing_policy, list):
            dict_ = {}
            for item in signing_policy:
                dict_.update(item)
            signing_policy = dict_

    if "minions" in signing_policy:
        if "__pub_id" not in kwargs:
            return "minion sending this request could not be identified"
        matcher = "match.glob"
        if "@" in signing_policy["minions"]:
            matcher = "match.compound"
        if not __salt__[matcher](signing_policy["minions"], kwargs["__pub_id"]):
            return "{0} not permitted to use signing policy {1}".format(
                kwargs["__pub_id"], argdic["signing_policy"]
            )

    try:
        return create_certificate(path=None, text=True, **argdic)
    except Exception as except_:  # pylint: disable=broad-except
        return six.text_type(except_)


# Traceback (salt.exceptions.SaltInvocationError)
Jun 20 20:11:52 sb1 salt-minion[24565]: [ERROR   ] An exception occurred in this state: Traceback (most recent call last):
Jun 20 20:11:52 sb1 salt-minion[24565]:   File "/usr/lib/python2.7/dist-packages/salt/state.py", line 1746, in call
Jun 20 20:11:52 sb1 salt-minion[24565]:     **cdata['kwargs'])
Jun 20 20:11:52 sb1 salt-minion[24565]:   File "/usr/lib/python2.7/dist-packages/salt/loader.py", line 1704, in wrapper
Jun 20 20:11:52 sb1 salt-minion[24565]:     return f(*args, **kwargs)
Jun 20 20:11:52 sb1 salt-minion[24565]:   File "/usr/lib/python2.7/dist-packages/salt/states/x509.py", line 568, in certificate_managed
Jun 20 20:11:52 sb1 salt-minion[24565]:     'New': __salt__['x509.read_certificate'](certificate=certificate)}
Jun 20 20:11:52 sb1 salt-minion[24565]:   File "/usr/lib/python2.7/dist-packages/salt/modules/x509.py", line 536, in read_certificate
Jun 20 20:11:52 sb1 salt-minion[24565]:     cert = _get_certificate_obj(certificate)
Jun 20 20:11:52 sb1 salt-minion[24565]:   File "/usr/lib/python2.7/dist-packages/salt/modules/x509.py", line 349, in _get_certificate_obj
Jun 20 20:11:52 sb1 salt-minion[24565]:     text = get_pem_entry(text, pem_type='CERTIFICATE')
Jun 20 20:11:52 sb1 salt-minion[24565]:   File "/usr/lib/python2.7/dist-packages/salt/modules/x509.py", line 472, in get_pem_entry
Jun 20 20:11:52 sb1 salt-minion[24565]:     raise salt.exceptions.SaltInvocationError(errmsg)
Jun 20 20:11:52 sb1 salt-minion[24565]: SaltInvocationError: PEM does not contain a single entry of type CERTIFICATE:

# Fixed code
def sign_remote_certificate(argdic, **kwargs):
    """
    Request a certificate to be remotely signed according to a signing policy.

    argdic:
        A dict containing all the arguments to be passed into the
        create_certificate function. This will become kwargs when passed
        to create_certificate.

    kwargs:
        kwargs delivered from publish.publish

    CLI Example:

    .. code-block:: bash

        salt '*' x509.sign_remote_certificate argdic="{'public_key': '/etc/pki/www.key', 'signing_policy': 'www'}" __pub_id='www1'
    """
    if "signing_policy" not in argdic:
        return "signing_policy must be specified"

    if not isinstance(argdic, dict):
        argdic = ast.literal_eval(argdic)

    signing_policy = {}
    if "signing_policy" in argdic:
        signing_policy = _get_signing_policy(argdic["signing_policy"])
        if not signing_policy:
            return "Signing policy {0} does not exist.".format(argdic["signing_policy"])

        if isinstance(signing_policy, list):
            dict_ = {}
            for item in signing_policy:
                dict_.update(item)
            signing_policy = dict_

    if "minions" in signing_policy:
        if "__pub_id" not in kwargs:
            return "minion sending this request could not be identified"
        if not _match_minions(signing_policy["minions"], kwargs["__pub_id"]):
            return "{0} not permitted to use signing policy {1}".format(
                kwargs["__pub_id"], argdic["signing_policy"]
            )

    try:
        return create_certificate(path=None, text=True, **argdic)
    except Exception as except_:  # pylint: disable=broad-except
        return six.text_type(except_)