diff --git a/nginx/files/_ssl.conf b/nginx/files/_ssl.conf
index ac6d841..a30ea4a 100644
--- a/nginx/files/_ssl.conf
+++ b/nginx/files/_ssl.conf
@@ -4,9 +4,10 @@
   ssl on;
   ssl_session_cache shared:SSL:10m;
   ssl_session_timeout  10m;
-  {%- if site.ssl.engine is not defined %}
-  ssl_certificate_key /etc/ssl/private/{{ site.host.name }}.key;
 
+  {%- if site.ssl.engine is not defined %}
+
+  ssl_certificate_key /etc/ssl/private/{{ site.host.name }}.key;
   {%- if site.ssl.chain is defined or site.ssl.authority is defined %}
   ssl_certificate /etc/ssl/certs/{{ site.host.name }}-with-chain.crt;
   {%- else %}
@@ -16,12 +17,18 @@
   {%- elif site.ssl.engine == 'letsencrypt' %}
 
   {%- set cert = site.ssl.get("certificate", site.host.name) %}
-
   ssl_certificate         /etc/letsencrypt/live/{{ cert }}/fullchain.pem;
   ssl_certificate_key     /etc/letsencrypt/live/{{ cert }}/privkey.pem;
   ssl_trusted_certificate /etc/letsencrypt/live/{{ cert }}/fullchain.pem;
   {%- include "nginx/files/_letsencrypt.conf" %}
+
+  {%- elif site.ssl.engine == 'salt' %}
+
+  ssl_certificate_key /etc/ssl/private/{{ site.host.name }}.key;
+  ssl_certificate /etc/ssl/certs/{{ site.host.name }}-with-chain.crt;
+
   {%- endif %}
+
   {%- set ssl_mode = site.ssl.get('mode', 'secure') %}
   {%- include "nginx/files/_ssl_"+ssl_mode+".conf" %}
   {%- endif %}
diff --git a/nginx/server/sites.sls b/nginx/server/sites.sls
index 00c1721..168d99f 100644
--- a/nginx/server/sites.sls
+++ b/nginx/server/sites.sls
@@ -1,5 +1,10 @@
 {%- from "nginx/map.jinja" import server with context %}
 
+{%- if pillar.salt.minion.cert is defined %}
+include:
+- salt.minion.cert
+{%- endif %}
+
 {%- set ssl_certificates = {} %}
 
 {%- for site_name, site in server.get('site', {}).iteritems() %}
@@ -59,6 +64,17 @@
 
 {%- endif %}
 
+{%- elif site.ssl.engine == 'salt' %}
+
+nginx_init_{{ site.host.name }}_tls:
+  cmd.wait:
+  - name: "cat /etc/ssl/certs/{{ site.host.name }}.crt /etc/ssl/certs/ca-{{ site.ssl.authority }}.crt > /etc/ssl/certs/{{ site.host.name }}-with-chain.crt"
+  - watch:
+    - x509: /etc/ssl/certs/{{ site.host.name }}.crt
+    - x509: /etc/ssl/certs/ca-{{ site.ssl.authority }}.crt
+  - watch_in:
+    - service: nginx_service
+
 {%- endif %}
 
 {% endif %}