psf-ca-group:
  group.present:
    - name: psf-ca
    - system: True

{% for name in salt["pillar.get"]("psf-ca-server-certificate", {}) %}
/etc/ssl/private/{{ name }}:
  file.managed:
    - contents_pillar: psf-ca-server-certificate:{{ name }}
    - user: root
    - group: psf-ca
    - mode: 640
    - require:
      - group: psf-ca-group
{% endfor %}

/etc/ssl/certs/psf-ca.pem:
  file.managed:
    - contents_pillar: psf-ca:ca.crt
    - user: root
    - group: root
    - mode: 644


/etc/ssl/crl:
  file.directory:
    - user: root
    - group: root
    - mode: 755


/etc/ssl/crl/psf-crl.pem:
  file.managed:
    - contents_pillar: psf-ca:crl.pem
    - user: root
    - group: root
    - mode: 644
    - requires:
      - file: /etc/ssl/crl

{% for name in salt["pillar.get"]("psf-ca-server-certificate", {}) %}
/etc/ssl/private/{{ name }}:
  file.managed:
    - contents_pillar: psf-ca-server-certificate:{{ name }}
    - user: root
    - group: ssl-cert
    - mode: 640
    - require:
      - group: psf-ca-group
{% endfor %}

/etc/ssl/certs/psf-ca.pem:
  file.managed:
    - contents_pillar: psf-ca:ca.crt
    - user: root
    - group: root
    - mode: 644


/etc/ssl/crl:
  file.directory:
    - user: root
    - group: root
    - mode: 755


/etc/ssl/crl/psf-crl.pem:
  file.managed:
    - contents_pillar: psf-ca:crl.pem
    - user: root
    - group: root
    - mode: 644
    - requires:
      - file: /etc/ssl/crl

Use the normal group name
Use the normal group name

zooba/psf-salt,caktus/psf-salt,zware/psf-salt,python/psf-salt,zware/psf-salt,dstufft/psf-salt,zooba/psf-salt,python/psf-salt,python/psf-salt,zooba/psf-salt,dstufft/psf-salt,caktus/psf-salt,caktus/psf-salt,dstufft/psf-salt,zware/psf-salt,python/psf-salt,zware/psf-salt