saltstack/salt — pull request #11588 by mikn (2014-03-27 16:07:56+00:00)
Title: Automatic OpenSSL CA implementation

Not ready for merge!

This is a rather crude and in its current state poorly documented CA implementation for Salt. The idea is to enable minions to request certificates which are automatically signed by a central CA which Salt administers.

Right now it requires two state runs to be able to pick up a certificate, which is not ideal. But if we refresh the pillars during the state run after we've sent the CRL from the minion, we should be able to do it in one go.

The reason I'm putting this up as a pull request was to let other people help me finish this up as I'm rather pressed on time, and from the chatter in #salt on IRC, I figured that there's plenty of people that would like something like this.

It has a couple dependencies too, you need to allow minion to master file uploads and you must create the CA yourself.