Howto create a Concatenation/Combined CA file using salt?

I would like to have to following a bit more clean, I'm trying to create concatenated CA file using Salt.
To accomplish this I first have to collect all glusterfs.pem files from all my minions to the salt-master minions cache and then output all glusterfs.pem into a single CA file (glusterfs.ca) on the salt-master to later on enroll them again on all minions.
Actually my solution is working but its simply out of the salt context and looks crappy to me. I'm new to salt, I never worked with reactors or so and I was hoping to find some help (preferably with a example if possible) around here.

This is my current situation only using states:

glusterfs/init.sls (only runs on minions)

/etc/ssl/glusterfs.key:
  x509.private_key_managed:
    - order: 9
    - bits: 2048
    - name: /etc/ssl/glusterfs.key

/etc/ssl/glusterfs.pem:
  x509.certificate_managed:
    - order: 10
    - signing_private_key: /etc/ssl/glusterfs.key
    - CN: {{ grains.id }}
    - C: UA
    - ST: Unavailable
    - L: Unavailable
    - basicConstraints: "critical CA:true"
    - keyUsage: "critical cRLSign, keyCertSign"
    - subjectKeyIdentifier: hash
    - authorityKeyIdentifier: keyid,issuer:always
    - days_valid: 3650
    - days_remaining: 0

/etc/ssl/glusterfs.ca:
  file:
    - order: 11
    - managed
    - source: salt://glusterfs/glusterfs.ca

ca.sls (only runs on salt-master):

collect_glusterfs_certs:
  cmd.run:
    - order: 1
    - name: salt -C 'not salt' cp.push /etc/ssl/glusterfs.pem

concatenation_glusterfs_certs:
  cmd.run:
    - order: 2
    - onlyif: 'test ! -e /var/cache/salt/master/minions/{master*,worker*}/files/etc/ssl/glusterfs.pem && test ! -e /srv/salt/glusterfs/glusterfs.ca'
    - name: 'cat /var/cache/salt/master/minions/*/files/etc/ssl/glusterfs.pem > /srv/salt/glusterfs/glusterfs.ca'

So I basically first pull all glusterfs.pem to the local salt-master minion cache and afterwards create the concatenated glusterfs.ca file which I than later on deploy onto all minion I previously collected the glusterfs.pem file from ...
Is there maybe a better way to get this done? Currently I also have the problem that my very first enrolment fails as
/etc/ssl/glusterfs.pem might be not present at that moment.

Thanks in advance

Start with glusterfs/init.sls and ca.sls, then review the shown cp.push and state ordering steps. Done means the first enrollment does not fail, certificates can be collected and concatenated on the salt-master, and the resulting CA file is deployed to the minions.