[BUG] acme.cert fails with OpenSSL error only when using salt tls module

Description

When obtaining certificates using acme.cert with my internal acme server, I receive a traceback. I am using https://github.com/smallstep/certificates to run this acme server. Certificates obtained for the normal letsencrypt servers work just fine.

Setup

{{ pillar['letsencrypt']['domain'] }}:
  acme.cert:
    - email: {{ pillar['letsencrypt']['email'] }}
      preferred_challenges: {{ pillar['letsencrypt']['authenticator'] }}
      {% if pillar['letsencrypt']['domain'].endswith('<internal dns name>') %}
      server: https://<internal ca url>
      {% endif %}
    - require:
      - pkg: certbot
      - file: /etc/letsencrypt/cli.ini

Steps to Reproduce the behavior

1. Setup an internal ca using https://github.com/smallstep/certificates
2. Attempt to obtain certificate using acme.cert

    Function: acme.cert
      Result: False
     Comment: An exception occurred in this state: Traceback (most recent call last):
                File "/usr/lib/python3.6/site-packages/salt/state.py", line 2154, in call
                  *cdata["args"], **cdata["kwargs"]
                File "/usr/lib/python3.6/site-packages/salt/loader.py", line 2106, in wrapper
                  return f(*args, **kwargs)
                File "/usr/lib/python3.6/site-packages/salt/states/acme.py", line 110, in cert
                  elif __salt__["acme.needs_renewal"](certname, renew):
                File "/usr/lib/python3.6/site-packages/salt/modules/acme.py", line 431, in needs_renewal
                  return _renew_by(name, window) <= datetime.datetime.today()
                File "/usr/lib/python3.6/site-packages/salt/modules/acme.py", line 112, in _renew_by
                  expiry = _expires(name)
                File "/usr/lib/python3.6/site-packages/salt/modules/acme.py", line 92, in _expires
                  expiry = __salt__["tls.cert_info"](cert_file).get("not_after", 0)
                File "/usr/lib/python3.6/site-packages/salt/modules/tls.py", line 1706, in cert_info
                  ret["extensions"][key] = str(ext).strip()
                File "/usr/lib/python3.6/site-packages/OpenSSL/crypto.py", line 822, in __str__
                  _openssl_assert(print_result != 0)
                File "/usr/lib/python3.6/site-packages/OpenSSL/_util.py", line 67, in openssl_assert
                  exception_from_error_queue(error)
                File "/usr/lib/python3.6/site-packages/OpenSSL/_util.py", line 54, in exception_from_error_queue
                  raise exception_type(errors)
              OpenSSL.crypto.Error: []

acme.cert works perfectly when I force the acme module to use openssl by setting

https://github.com/saltstack/salt/blob/214ae8a9af972b9c5f50bf13f9f0b76d092af952/salt/modules/acme.py#L87

to if False:

Expected behavior
acme.cert should obtain a certificate successfully as using the cli works fine.

Versions Report

</details>

Start with salt/modules/acme.py at the renewal path around lines 87, 92, 112, and 431, then inspect salt/modules/tls.py around line 1706 where the traceback occurs. Reproduce against the smallstep/certificates server and compare the ACME module path with the working CLI or forced OpenSSL path. Done means acme.cert obtains the certificate without the OpenSSL.crypto.Error while normal Let’s Encrypt behavior remains working.