Cannot create CA

[fipscode]

I'm unable to create a CA with the following state:

ca.org.example:
  tls.create_ca:
    - ca_name: example.org
    - bits: 4096
    - CN: example.org
    - C: 'CH'
    - ST: 'Bern'
    - L: 'Burgdorf'
    - O: example.org

The error I get is:

          ID: ca.org.example
    Function: tls.create_ca
      Result: False
     Comment: State 'tls.create_ca' was not found in SLS 'ca'
              Reason: 'tls' __virtual__ returned False: tls module could not be loaded
     Changes:   

I've configured ca.cert_base_path in minion config and also tried to salt-pip install pyopenssl, pip install pyopenssl and apt-get install python3-openssl (followed by a systemctl restart salt-master and systemctl restart salt-minion, but without any change of the problem.

The output of salt --versions-report is:

Salt Version:
          Salt: 3008.2
 
Python Version:
        Python: 3.14.6 (main, Jun 11 2026, 02:19:05) [GCC 11.2.0]
 
Dependency Versions:
          cffi: 2.0.0
      cherrypy: 18.10.0
  cryptography: 48.0.0
      dateutil: 2.9.0.post0
     docker-py: Not Installed
         gitdb: 4.0.12
     gitpython: Not Installed
        Jinja2: 3.1.6
       libgit2: Not Installed
  looseversion: 1.3.0
      M2Crypto: Not Installed
          Mako: Not Installed
       msgpack: 1.1.2
  msgpack-pure: Not Installed
  mysql-python: Not Installed
     packaging: 24.0
     pycparser: 3.00
      pycrypto: Not Installed
  pycryptodome: 3.23.0
        pygit2: Not Installed
  python-gnupg: 0.5.6
        PyYAML: 6.0.3
         PyZMQ: 27.1.0
        relenv: 0.22.14
         smmap: 5.0.2
       timelib: 0.3.0
       Tornado: 6.5.7
           ZMQ: 4.3.5
 
Salt Package Information:
  Package Type: onedir
 
System Versions:
          dist: debian 13.6 trixie
        locale: utf-8
       machine: x86_64
       release: 6.12.96+deb13-amd64
        system: Linux
       version: Debian GNU/Linux 13.6 trixie

Can you (help me) fix this, please?

[welcome]

Hi there! Welcome to the Salt Community! Thank you for making your first contribution. We have a lengthy process for issues and PRs. Someone from the Core Team will follow up as soon as possible. In the meantime, here's some information that may help as you continue your Salt journey.
Please be sure to review our Code of Conduct. Also, check out some of our community resources including:

• Salt's Contributor Guide
• Join our Community Discord
• Salt Project YouTube channel
• GitHub Discussions

There are lots of ways to get involved in our community. Every month, there are around a dozen opportunities to meet with other contributors and the Salt Core team and collaborate in real time. The best way to keep track is by subscribing to the Salt Community Events Calendar.
If you have additional questions, email us at saltproject.pdl@broadcom.com. We're glad you've joined our community and look forward to doing awesome things with you!

[lkubb]

You should get a reason for the tls modules not being loaded by invoking salt-call tls.cert_base_path on the affected minion.

salt-pip install 'pyopenssl<25' should be the correct command. You want to install it in Salt's venv, not globally. Apparently, the tls module requires releases below 25. Restarting the minion after installation is also correct.

Alternatively, you can use https://docs.saltproject.io/en/master/ref/states/all/salt.states.x509_v2.html, which is more low-level, but more powerful and should work without any extra installations.