diff --git a/README.rst b/README.rst
index 4873cfa..872aca0 100644
--- a/README.rst
+++ b/README.rst
@@ -101,6 +101,24 @@
                 - grants:
                   - all privileges
 
+Additional mysql SSL grants:
+
+.. code-block:: yaml
+
+    mysql:
+      server:
+        users:
+          - name: clustercheck
+            password: clustercheck
+            database: '*.*'
+            grants: PROCESS
+            ssl_option:
+              - SSL: True
+              - X509: True
+              - SUBJECT: <subject>
+              - ISSUER: <issuer>
+              - CIPHER: <cipher>
+
 Additional check params:
 ========================
 
diff --git a/galera/master.sls b/galera/master.sls
index 871124d..a4fa680 100644
--- a/galera/master.sls
+++ b/galera/master.sls
@@ -132,7 +132,7 @@
       service: {{ master|yaml }}
   - template: jinja
 
-{%- if salt['cmd.run']('test -e /var/lib/mysql/.galera_bootstrap; echo $?') != '0'  %}
+{%- if salt['cmd.shell']('test -e /var/lib/mysql/.galera_bootstrap; echo $?') != '0'  %}
 
 # Enforce config before package installation
 galera_pre_config:
diff --git a/galera/meta/collectd.yml b/galera/meta/collectd.yml
index 4533ad0..9aeb35b 100644
--- a/galera/meta/collectd.yml
+++ b/galera/meta/collectd.yml
@@ -1,29 +1,25 @@
-{%- if pillar.galera is defined  %}
-{%- if pillar.galera.master is defined %}
-{%- from "galera/map.jinja" import master with context %}
-{%- set server = master %}
-{%- elif pillar.galera.slave is defined %}
-{%- from "galera/map.jinja" import slave with context %}
-{%- set server = slave %}
+{%- from "galera/map.jinja" import master, slave with context %}
+{%- if master.get('enabled', False) %}
+  {%- set service = master %}
+{%-  elif slave.get('enabled', False) %}
+  {%- set service = slave %}
 {%- endif %}
-{%- endif %}
-
-{%- if server is defined %}
+{%- if service is defined %}
 local_plugin:
   mysql:
     template: galera/files/collectd_mysql.conf
-    socket: {{ server.socket }}
-    password: {{ server.admin.password }}
-    username: {{ server.admin.user }}
+    socket: {{ service.socket }}
+    password: {{ service.admin.password }}
+    username: {{ service.admin.user }}
   mysql_status:
     template: galera/files/collectd_mysql_status.conf
-    socket: {{ server.socket }}
-    password: {{ server.admin.password }}
-    username: {{ server.admin.user }}
+    socket: {{ service.socket }}
+    password: {{ service.admin.password }}
+    username: {{ service.admin.user }}
   mysql_check:
     plugin: python
     template: galera/files/collectd_mysql_check.conf
-    socket: {{ server.socket }}
-    password: {{ server.admin.password }}
-    username: {{ server.admin.user }}
+    socket: {{ service.socket }}
+    password: {{ service.admin.password }}
+    username: {{ service.admin.user }}
 {%- endif %}
diff --git a/galera/meta/telegraf.yml b/galera/meta/telegraf.yml
index 0361455..5869765 100644
--- a/galera/meta/telegraf.yml
+++ b/galera/meta/telegraf.yml
@@ -1,19 +1,16 @@
-{%- if pillar.galera is defined  %}
-{%- if pillar.galera.master is defined %}
-{%- from "galera/map.jinja" import master with context %}
-{%- set server = master %}
-{%- elif pillar.galera.slave is defined %}
-{%- from "galera/map.jinja" import slave with context %}
-{%- set server = slave %}
-{%- endif %}
+{%- from "galera/map.jinja" import master, slave with context %}
+{%- if master.get('enabled', False) %}
+  {%- set service = master %}
+{%-  elif slave.get('enabled', False) %}
+  {%- set service = slave %}
 {%- endif %}
 
-{%- if server is defined %}
+{%- if service is defined %}
 agent:
   input:
     mysql:
-      address: {{ server.socket }}
-      username: {{ server.admin.user }}
-      password: {{ server.admin.password }}
-      tagexclude: [server]
+      address: {{ service.socket }}
+      username: {{ service.admin.user }}
+      password: {{ service.admin.password }}
+      tagexclude: [service]
 {%- endif %}
diff --git a/galera/server.sls b/galera/server.sls
index 4b84654..7d070d4 100644
--- a/galera/server.sls
+++ b/galera/server.sls
@@ -38,6 +38,7 @@
   - database: '{{ database_name }}.*'
   - user: '{{ user.name }}'
   - host: '{{ user.host }}'
+  - ssl_option: {{ user.get('ssl_option', False) }}
   #- connection_user: {{ connection.user }}
   #- connection_pass: {{ connection.password }}
   #- connection_charset: {{ connection.charset }}
@@ -58,7 +59,7 @@
   - defaults:
     database_name: {{ database_name }}
     database: {{ database }}
-  - require: 
+  - require:
     - file: mysql_dirs
     - mysql_database: mysql_database_{{ database_name }}
 
@@ -92,7 +93,7 @@
   {%- if grains.get('noservices') %}
   - onlyif: /bin/false
   {%- endif %}
-  
+
 {%- if 'grants' in user %}
 mysql_user_{{ user.name }}_{{ host }}_grants:
   mysql_grants.present:
@@ -102,6 +103,7 @@
     - grant_option: {{ user['grant_option'] | default(False) }}
     - user: {{ user.name }}
     - host: '{{ host }}'
+    - ssl_option: {{ user.get('ssl_option', False) }}
     #- connection_user: {{ connection.user }}
     #- connection_pass: {{ connection.password }}
     #- connection_charset: {{ connection.charset }}
@@ -122,6 +124,7 @@
     - grant_option: {{ db['grant_option'] | default(False) }}
     - user: {{ user.name }}
     - host: '{{ host }}'
+    - ssl_option: {{ db.get('ssl_option', False) }}
     #- connection_user: {{ connection.user }}
     #- connection_pass: {{ connection.password }}
     #- connection_charset: {{ connection.charset }}
diff --git a/galera/slave.sls b/galera/slave.sls
index 6d9f0d3..2a70672 100644
--- a/galera/slave.sls
+++ b/galera/slave.sls
@@ -130,7 +130,7 @@
   - source: salt://galera/files/bootstrap.sh
   - template: jinja
 
-{%- if salt['cmd.run']('test -e /var/lib/mysql/.galera_bootstrap; echo $?') != '0'  %}
+{%- if salt['cmd.shell']('test -e /var/lib/mysql/.galera_bootstrap; echo $?') != '0'  %}
 
 # Enforce config before package installation
 galera_pre_config:
diff --git a/tests/run_tests.sh b/tests/run_tests.sh
index 4ee4e0f..9761585 100755
--- a/tests/run_tests.sh
+++ b/tests/run_tests.sh
@@ -39,7 +39,7 @@
     log_info "Setting up Python virtualenv"
     virtualenv $VENV_DIR
     source ${VENV_DIR}/bin/activate
-    pip install salt${PIP_SALT_VERSION}
+    python -m pip install salt${PIP_SALT_VERSION}
 }
 
 setup_mock_bin() {
@@ -125,7 +125,7 @@
 
 salt_run() {
     [ -e ${VENV_DIR}/bin/activate ] && source ${VENV_DIR}/bin/activate
-    salt-call ${SALT_OPTS} $*
+    python $(which salt-call) ${SALT_OPTS} $*
 }
 
 prepare() {