diff --git a/test/integration/default/files/_mapdata/amazonlinux-2.yaml b/test/integration/default/files/_mapdata/amazonlinux-2.yaml
index 48e868d..4a42174 100644
--- a/test/integration/default/files/_mapdata/amazonlinux-2.yaml
+++ b/test/integration/default/files/_mapdata/amazonlinux-2.yaml
@@ -9,11 +9,32 @@ values:
   cert_source_dir: /tmp/kitchen/srv/salt/files/
   cert_tmp_dir: /tmp/certs/
   cert_user: root
+  certlist:
+    cert.and.key.to.add:
+      cert: "-----BEGIN CERTIFICATE-----\n1MOCKED CERT AND KEY\n-----END CERTIFICATE----- "
+      key: "-----BEGIN RSA PRIVATE KEY-----\n1MOCKED CERT AND KEY\n-----END RSA PRIVATE
+        KEY----- "
+    cert.and.key.to.remove:
+      cert: "-----BEGIN CERTIFICATE-----\n3MOCKED CERT AND KEY\n-----END CERTIFICATE----- "
+      key: "-----BEGIN RSA PRIVATE KEY-----\n3MOCKED CERT AND KEY\n-----END RSA PRIVATE
+        KEY----- "
+      remove: true
+    cert.and.key.with.ext.to.add:
+      cert: "-----BEGIN CERTIFICATE-----\n4MOCKED CERT AND KEY\n-----END CERTIFICATE----- "
+      cert_ext: ".pem"
+      key: "-----BEGIN RSA PRIVATE KEY-----\n4MOCKED CERT AND KEY\n-----END RSA PRIVATE
+        KEY----- "
+      key_ext: ".priv"
+    cert.from.src.to.add: {}
+    cert.to.add:
+      cert: "-----BEGIN CERTIFICATE-----\n2MOCKED CERT\n-----END CERTIFICATE----- "
   key_dir: /etc/pki/tls/private
   key_ext: .key
   key_group: root
   key_mode: 600
   key_user: root
+  lookup:
+    cert_source_dir: "/tmp/kitchen/srv/salt/files/"
   map_jinja:
     sources:
     - Y:G@osarch
@@ -21,6 +42,7 @@ values:
     - Y:G@os
     - Y:G@osfinger
     - C@cert:lookup
+    - C@cert
     - Y:G@id
   pkgs:
   - ca-certificates
diff --git a/test/integration/default/files/_mapdata/arch-base-latest.yaml b/test/integration/default/files/_mapdata/arch-base-latest.yaml
index fe6aecd..7cccb62 100644
--- a/test/integration/default/files/_mapdata/arch-base-latest.yaml
+++ b/test/integration/default/files/_mapdata/arch-base-latest.yaml
@@ -9,11 +9,32 @@ values:
   cert_source_dir: /tmp/kitchen/srv/salt/files/
   cert_tmp_dir: /tmp/certs/
   cert_user: root
+  certlist:
+    cert.and.key.to.add:
+      cert: "-----BEGIN CERTIFICATE-----\n1MOCKED CERT AND KEY\n-----END CERTIFICATE----- "
+      key: "-----BEGIN RSA PRIVATE KEY-----\n1MOCKED CERT AND KEY\n-----END RSA PRIVATE
+        KEY----- "
+    cert.and.key.to.remove:
+      cert: "-----BEGIN CERTIFICATE-----\n3MOCKED CERT AND KEY\n-----END CERTIFICATE----- "
+      key: "-----BEGIN RSA PRIVATE KEY-----\n3MOCKED CERT AND KEY\n-----END RSA PRIVATE
+        KEY----- "
+      remove: true
+    cert.and.key.with.ext.to.add:
+      cert: "-----BEGIN CERTIFICATE-----\n4MOCKED CERT AND KEY\n-----END CERTIFICATE----- "
+      cert_ext: ".pem"
+      key: "-----BEGIN RSA PRIVATE KEY-----\n4MOCKED CERT AND KEY\n-----END RSA PRIVATE
+        KEY----- "
+      key_ext: ".priv"
+    cert.from.src.to.add: {}
+    cert.to.add:
+      cert: "-----BEGIN CERTIFICATE-----\n2MOCKED CERT\n-----END CERTIFICATE----- "
   key_dir: /etc/ssl/private
   key_ext: .key
   key_group: root
   key_mode: 600
   key_user: root
+  lookup:
+    cert_source_dir: "/tmp/kitchen/srv/salt/files/"
   map_jinja:
     sources:
     - Y:G@osarch
@@ -21,6 +42,7 @@ values:
     - Y:G@os
     - Y:G@osfinger
     - C@cert:lookup
+    - C@cert
     - Y:G@id
   pkgs:
   - ca-certificates
diff --git a/test/integration/default/files/_mapdata/centos-7.yaml b/test/integration/default/files/_mapdata/centos-7.yaml
index 8c53750..0139961 100644
--- a/test/integration/default/files/_mapdata/centos-7.yaml
+++ b/test/integration/default/files/_mapdata/centos-7.yaml
@@ -9,11 +9,32 @@ values:
   cert_source_dir: /tmp/kitchen/srv/salt/files/
   cert_tmp_dir: /tmp/certs/
   cert_user: root
+  certlist:
+    cert.and.key.to.add:
+      cert: "-----BEGIN CERTIFICATE-----\n1MOCKED CERT AND KEY\n-----END CERTIFICATE----- "
+      key: "-----BEGIN RSA PRIVATE KEY-----\n1MOCKED CERT AND KEY\n-----END RSA PRIVATE
+        KEY----- "
+    cert.and.key.to.remove:
+      cert: "-----BEGIN CERTIFICATE-----\n3MOCKED CERT AND KEY\n-----END CERTIFICATE----- "
+      key: "-----BEGIN RSA PRIVATE KEY-----\n3MOCKED CERT AND KEY\n-----END RSA PRIVATE
+        KEY----- "
+      remove: true
+    cert.and.key.with.ext.to.add:
+      cert: "-----BEGIN CERTIFICATE-----\n4MOCKED CERT AND KEY\n-----END CERTIFICATE----- "
+      cert_ext: ".pem"
+      key: "-----BEGIN RSA PRIVATE KEY-----\n4MOCKED CERT AND KEY\n-----END RSA PRIVATE
+        KEY----- "
+      key_ext: ".priv"
+    cert.from.src.to.add: {}
+    cert.to.add:
+      cert: "-----BEGIN CERTIFICATE-----\n2MOCKED CERT\n-----END CERTIFICATE----- "
   key_dir: /etc/pki/tls/private
   key_ext: .key
   key_group: root
   key_mode: 600
   key_user: root
+  lookup:
+    cert_source_dir: "/tmp/kitchen/srv/salt/files/"
   map_jinja:
     sources:
     - Y:G@osarch
@@ -21,6 +42,7 @@ values:
     - Y:G@os
     - Y:G@osfinger
     - C@cert:lookup
+    - C@cert
     - Y:G@id
   pkgs:
   - ca-certificates
diff --git a/test/integration/default/files/_mapdata/centos-8.yaml b/test/integration/default/files/_mapdata/centos-8.yaml
index 9e50025..4d8218c 100644
--- a/test/integration/default/files/_mapdata/centos-8.yaml
+++ b/test/integration/default/files/_mapdata/centos-8.yaml
@@ -9,11 +9,32 @@ values:
   cert_source_dir: /tmp/kitchen/srv/salt/files/
   cert_tmp_dir: /tmp/certs/
   cert_user: root
+  certlist:
+    cert.and.key.to.add:
+      cert: "-----BEGIN CERTIFICATE-----\n1MOCKED CERT AND KEY\n-----END CERTIFICATE----- "
+      key: "-----BEGIN RSA PRIVATE KEY-----\n1MOCKED CERT AND KEY\n-----END RSA PRIVATE
+        KEY----- "
+    cert.and.key.to.remove:
+      cert: "-----BEGIN CERTIFICATE-----\n3MOCKED CERT AND KEY\n-----END CERTIFICATE----- "
+      key: "-----BEGIN RSA PRIVATE KEY-----\n3MOCKED CERT AND KEY\n-----END RSA PRIVATE
+        KEY----- "
+      remove: true
+    cert.and.key.with.ext.to.add:
+      cert: "-----BEGIN CERTIFICATE-----\n4MOCKED CERT AND KEY\n-----END CERTIFICATE----- "
+      cert_ext: ".pem"
+      key: "-----BEGIN RSA PRIVATE KEY-----\n4MOCKED CERT AND KEY\n-----END RSA PRIVATE
+        KEY----- "
+      key_ext: ".priv"
+    cert.from.src.to.add: {}
+    cert.to.add:
+      cert: "-----BEGIN CERTIFICATE-----\n2MOCKED CERT\n-----END CERTIFICATE----- "
   key_dir: /etc/pki/tls/private
   key_ext: .key
   key_group: root
   key_mode: 600
   key_user: root
+  lookup:
+    cert_source_dir: "/tmp/kitchen/srv/salt/files/"
   map_jinja:
     sources:
     - Y:G@osarch
@@ -21,6 +42,7 @@ values:
     - Y:G@os
     - Y:G@osfinger
     - C@cert:lookup
+    - C@cert
     - Y:G@id
   pkgs:
   - ca-certificates
diff --git a/test/integration/default/files/_mapdata/debian-10.yaml b/test/integration/default/files/_mapdata/debian-10.yaml
index 17fe3a4..afe7c1a 100644
--- a/test/integration/default/files/_mapdata/debian-10.yaml
+++ b/test/integration/default/files/_mapdata/debian-10.yaml
@@ -9,11 +9,32 @@ values:
   cert_source_dir: /tmp/kitchen/srv/salt/files/
   cert_tmp_dir: /tmp/certs/
   cert_user: root
+  certlist:
+    cert.and.key.to.add:
+      cert: "-----BEGIN CERTIFICATE-----\n1MOCKED CERT AND KEY\n-----END CERTIFICATE----- "
+      key: "-----BEGIN RSA PRIVATE KEY-----\n1MOCKED CERT AND KEY\n-----END RSA PRIVATE
+        KEY----- "
+    cert.and.key.to.remove:
+      cert: "-----BEGIN CERTIFICATE-----\n3MOCKED CERT AND KEY\n-----END CERTIFICATE----- "
+      key: "-----BEGIN RSA PRIVATE KEY-----\n3MOCKED CERT AND KEY\n-----END RSA PRIVATE
+        KEY----- "
+      remove: true
+    cert.and.key.with.ext.to.add:
+      cert: "-----BEGIN CERTIFICATE-----\n4MOCKED CERT AND KEY\n-----END CERTIFICATE----- "
+      cert_ext: ".pem"
+      key: "-----BEGIN RSA PRIVATE KEY-----\n4MOCKED CERT AND KEY\n-----END RSA PRIVATE
+        KEY----- "
+      key_ext: ".priv"
+    cert.from.src.to.add: {}
+    cert.to.add:
+      cert: "-----BEGIN CERTIFICATE-----\n2MOCKED CERT\n-----END CERTIFICATE----- "
   key_dir: /etc/ssl/private
   key_ext: .key
   key_group: ssl-cert
   key_mode: 640
   key_user: root
+  lookup:
+    cert_source_dir: "/tmp/kitchen/srv/salt/files/"
   map_jinja:
     sources:
     - Y:G@osarch
@@ -21,6 +42,7 @@ values:
     - Y:G@os
     - Y:G@osfinger
     - C@cert:lookup
+    - C@cert
     - Y:G@id
   pkgs:
   - ca-certificates
diff --git a/test/integration/default/files/_mapdata/debian-9.yaml b/test/integration/default/files/_mapdata/debian-9.yaml
index cba9072..f88c01b 100644
--- a/test/integration/default/files/_mapdata/debian-9.yaml
+++ b/test/integration/default/files/_mapdata/debian-9.yaml
@@ -9,11 +9,32 @@ values:
   cert_source_dir: /tmp/kitchen/srv/salt/files/
   cert_tmp_dir: /tmp/certs/
   cert_user: root
+  certlist:
+    cert.and.key.to.add:
+      cert: "-----BEGIN CERTIFICATE-----\n1MOCKED CERT AND KEY\n-----END CERTIFICATE----- "
+      key: "-----BEGIN RSA PRIVATE KEY-----\n1MOCKED CERT AND KEY\n-----END RSA PRIVATE
+        KEY----- "
+    cert.and.key.to.remove:
+      cert: "-----BEGIN CERTIFICATE-----\n3MOCKED CERT AND KEY\n-----END CERTIFICATE----- "
+      key: "-----BEGIN RSA PRIVATE KEY-----\n3MOCKED CERT AND KEY\n-----END RSA PRIVATE
+        KEY----- "
+      remove: true
+    cert.and.key.with.ext.to.add:
+      cert: "-----BEGIN CERTIFICATE-----\n4MOCKED CERT AND KEY\n-----END CERTIFICATE----- "
+      cert_ext: ".pem"
+      key: "-----BEGIN RSA PRIVATE KEY-----\n4MOCKED CERT AND KEY\n-----END RSA PRIVATE
+        KEY----- "
+      key_ext: ".priv"
+    cert.from.src.to.add: {}
+    cert.to.add:
+      cert: "-----BEGIN CERTIFICATE-----\n2MOCKED CERT\n-----END CERTIFICATE----- "
   key_dir: /etc/ssl/private
   key_ext: .key
   key_group: ssl-cert
   key_mode: 640
   key_user: root
+  lookup:
+    cert_source_dir: "/tmp/kitchen/srv/salt/files/"
   map_jinja:
     sources:
     - Y:G@osarch
@@ -21,6 +42,7 @@ values:
     - Y:G@os
     - Y:G@osfinger
     - C@cert:lookup
+    - C@cert
     - Y:G@id
   pkgs:
   - ca-certificates
diff --git a/test/integration/default/files/_mapdata/fedora-32.yaml b/test/integration/default/files/_mapdata/fedora-32.yaml
index c76dd04..b717869 100644
--- a/test/integration/default/files/_mapdata/fedora-32.yaml
+++ b/test/integration/default/files/_mapdata/fedora-32.yaml
@@ -9,11 +9,32 @@ values:
   cert_source_dir: /tmp/kitchen/srv/salt/files/
   cert_tmp_dir: /tmp/certs/
   cert_user: root
+  certlist:
+    cert.and.key.to.add:
+      cert: "-----BEGIN CERTIFICATE-----\n1MOCKED CERT AND KEY\n-----END CERTIFICATE----- "
+      key: "-----BEGIN RSA PRIVATE KEY-----\n1MOCKED CERT AND KEY\n-----END RSA PRIVATE
+        KEY----- "
+    cert.and.key.to.remove:
+      cert: "-----BEGIN CERTIFICATE-----\n3MOCKED CERT AND KEY\n-----END CERTIFICATE----- "
+      key: "-----BEGIN RSA PRIVATE KEY-----\n3MOCKED CERT AND KEY\n-----END RSA PRIVATE
+        KEY----- "
+      remove: true
+    cert.and.key.with.ext.to.add:
+      cert: "-----BEGIN CERTIFICATE-----\n4MOCKED CERT AND KEY\n-----END CERTIFICATE----- "
+      cert_ext: ".pem"
+      key: "-----BEGIN RSA PRIVATE KEY-----\n4MOCKED CERT AND KEY\n-----END RSA PRIVATE
+        KEY----- "
+      key_ext: ".priv"
+    cert.from.src.to.add: {}
+    cert.to.add:
+      cert: "-----BEGIN CERTIFICATE-----\n2MOCKED CERT\n-----END CERTIFICATE----- "
   key_dir: /etc/pki/tls/private
   key_ext: .key
   key_group: root
   key_mode: 600
   key_user: root
+  lookup:
+    cert_source_dir: "/tmp/kitchen/srv/salt/files/"
   map_jinja:
     sources:
     - Y:G@osarch
@@ -21,6 +42,7 @@ values:
     - Y:G@os
     - Y:G@osfinger
     - C@cert:lookup
+    - C@cert
     - Y:G@id
   pkgs:
   - ca-certificates
diff --git a/test/integration/default/files/_mapdata/fedora-33.yaml b/test/integration/default/files/_mapdata/fedora-33.yaml
index 4ca81b4..7b5ffc9 100644
--- a/test/integration/default/files/_mapdata/fedora-33.yaml
+++ b/test/integration/default/files/_mapdata/fedora-33.yaml
@@ -9,11 +9,32 @@ values:
   cert_source_dir: /tmp/kitchen/srv/salt/files/
   cert_tmp_dir: /tmp/certs/
   cert_user: root
+  certlist:
+    cert.and.key.to.add:
+      cert: "-----BEGIN CERTIFICATE-----\n1MOCKED CERT AND KEY\n-----END CERTIFICATE----- "
+      key: "-----BEGIN RSA PRIVATE KEY-----\n1MOCKED CERT AND KEY\n-----END RSA PRIVATE
+        KEY----- "
+    cert.and.key.to.remove:
+      cert: "-----BEGIN CERTIFICATE-----\n3MOCKED CERT AND KEY\n-----END CERTIFICATE----- "
+      key: "-----BEGIN RSA PRIVATE KEY-----\n3MOCKED CERT AND KEY\n-----END RSA PRIVATE
+        KEY----- "
+      remove: true
+    cert.and.key.with.ext.to.add:
+      cert: "-----BEGIN CERTIFICATE-----\n4MOCKED CERT AND KEY\n-----END CERTIFICATE----- "
+      cert_ext: ".pem"
+      key: "-----BEGIN RSA PRIVATE KEY-----\n4MOCKED CERT AND KEY\n-----END RSA PRIVATE
+        KEY----- "
+      key_ext: ".priv"
+    cert.from.src.to.add: {}
+    cert.to.add:
+      cert: "-----BEGIN CERTIFICATE-----\n2MOCKED CERT\n-----END CERTIFICATE----- "
   key_dir: /etc/pki/tls/private
   key_ext: .key
   key_group: root
   key_mode: 600
   key_user: root
+  lookup:
+    cert_source_dir: "/tmp/kitchen/srv/salt/files/"
   map_jinja:
     sources:
     - Y:G@osarch
@@ -21,6 +42,7 @@ values:
     - Y:G@os
     - Y:G@osfinger
     - C@cert:lookup
+    - C@cert
     - Y:G@id
   pkgs:
   - ca-certificates
diff --git a/test/integration/default/files/_mapdata/gentoo-2-sysd.yaml b/test/integration/default/files/_mapdata/gentoo-2-sysd.yaml
index c6f06cc..b033fd7 100644
--- a/test/integration/default/files/_mapdata/gentoo-2-sysd.yaml
+++ b/test/integration/default/files/_mapdata/gentoo-2-sysd.yaml
@@ -9,11 +9,32 @@ values:
   cert_source_dir: /tmp/kitchen/srv/salt/files/
   cert_tmp_dir: /tmp/certs/
   cert_user: root
+  certlist:
+    cert.and.key.to.add:
+      cert: "-----BEGIN CERTIFICATE-----\n1MOCKED CERT AND KEY\n-----END CERTIFICATE----- "
+      key: "-----BEGIN RSA PRIVATE KEY-----\n1MOCKED CERT AND KEY\n-----END RSA PRIVATE
+        KEY----- "
+    cert.and.key.to.remove:
+      cert: "-----BEGIN CERTIFICATE-----\n3MOCKED CERT AND KEY\n-----END CERTIFICATE----- "
+      key: "-----BEGIN RSA PRIVATE KEY-----\n3MOCKED CERT AND KEY\n-----END RSA PRIVATE
+        KEY----- "
+      remove: true
+    cert.and.key.with.ext.to.add:
+      cert: "-----BEGIN CERTIFICATE-----\n4MOCKED CERT AND KEY\n-----END CERTIFICATE----- "
+      cert_ext: ".pem"
+      key: "-----BEGIN RSA PRIVATE KEY-----\n4MOCKED CERT AND KEY\n-----END RSA PRIVATE
+        KEY----- "
+      key_ext: ".priv"
+    cert.from.src.to.add: {}
+    cert.to.add:
+      cert: "-----BEGIN CERTIFICATE-----\n2MOCKED CERT\n-----END CERTIFICATE----- "
   key_dir: /etc/ssl/private
   key_ext: .key
   key_group: root
   key_mode: 600
   key_user: root
+  lookup:
+    cert_source_dir: "/tmp/kitchen/srv/salt/files/"
   map_jinja:
     sources:
     - Y:G@osarch
@@ -21,5 +42,6 @@ values:
     - Y:G@os
     - Y:G@osfinger
     - C@cert:lookup
+    - C@cert
     - Y:G@id
   remove: false
diff --git a/test/integration/default/files/_mapdata/gentoo-2-sysv.yaml b/test/integration/default/files/_mapdata/gentoo-2-sysv.yaml
index c6f06cc..b033fd7 100644
--- a/test/integration/default/files/_mapdata/gentoo-2-sysv.yaml
+++ b/test/integration/default/files/_mapdata/gentoo-2-sysv.yaml
@@ -9,11 +9,32 @@ values:
   cert_source_dir: /tmp/kitchen/srv/salt/files/
   cert_tmp_dir: /tmp/certs/
   cert_user: root
+  certlist:
+    cert.and.key.to.add:
+      cert: "-----BEGIN CERTIFICATE-----\n1MOCKED CERT AND KEY\n-----END CERTIFICATE----- "
+      key: "-----BEGIN RSA PRIVATE KEY-----\n1MOCKED CERT AND KEY\n-----END RSA PRIVATE
+        KEY----- "
+    cert.and.key.to.remove:
+      cert: "-----BEGIN CERTIFICATE-----\n3MOCKED CERT AND KEY\n-----END CERTIFICATE----- "
+      key: "-----BEGIN RSA PRIVATE KEY-----\n3MOCKED CERT AND KEY\n-----END RSA PRIVATE
+        KEY----- "
+      remove: true
+    cert.and.key.with.ext.to.add:
+      cert: "-----BEGIN CERTIFICATE-----\n4MOCKED CERT AND KEY\n-----END CERTIFICATE----- "
+      cert_ext: ".pem"
+      key: "-----BEGIN RSA PRIVATE KEY-----\n4MOCKED CERT AND KEY\n-----END RSA PRIVATE
+        KEY----- "
+      key_ext: ".priv"
+    cert.from.src.to.add: {}
+    cert.to.add:
+      cert: "-----BEGIN CERTIFICATE-----\n2MOCKED CERT\n-----END CERTIFICATE----- "
   key_dir: /etc/ssl/private
   key_ext: .key
   key_group: root
   key_mode: 600
   key_user: root
+  lookup:
+    cert_source_dir: "/tmp/kitchen/srv/salt/files/"
   map_jinja:
     sources:
     - Y:G@osarch
@@ -21,5 +42,6 @@ values:
     - Y:G@os
     - Y:G@osfinger
     - C@cert:lookup
+    - C@cert
     - Y:G@id
   remove: false
diff --git a/test/integration/default/files/_mapdata/opensuse-15.yaml b/test/integration/default/files/_mapdata/opensuse-15.yaml
index 5d1d62e..c489e05 100644
--- a/test/integration/default/files/_mapdata/opensuse-15.yaml
+++ b/test/integration/default/files/_mapdata/opensuse-15.yaml
@@ -9,11 +9,32 @@ values:
   cert_source_dir: /tmp/kitchen/srv/salt/files/
   cert_tmp_dir: /tmp/certs/
   cert_user: root
+  certlist:
+    cert.and.key.to.add:
+      cert: "-----BEGIN CERTIFICATE-----\n1MOCKED CERT AND KEY\n-----END CERTIFICATE----- "
+      key: "-----BEGIN RSA PRIVATE KEY-----\n1MOCKED CERT AND KEY\n-----END RSA PRIVATE
+        KEY----- "
+    cert.and.key.to.remove:
+      cert: "-----BEGIN CERTIFICATE-----\n3MOCKED CERT AND KEY\n-----END CERTIFICATE----- "
+      key: "-----BEGIN RSA PRIVATE KEY-----\n3MOCKED CERT AND KEY\n-----END RSA PRIVATE
+        KEY----- "
+      remove: true
+    cert.and.key.with.ext.to.add:
+      cert: "-----BEGIN CERTIFICATE-----\n4MOCKED CERT AND KEY\n-----END CERTIFICATE----- "
+      cert_ext: ".pem"
+      key: "-----BEGIN RSA PRIVATE KEY-----\n4MOCKED CERT AND KEY\n-----END RSA PRIVATE
+        KEY----- "
+      key_ext: ".priv"
+    cert.from.src.to.add: {}
+    cert.to.add:
+      cert: "-----BEGIN CERTIFICATE-----\n2MOCKED CERT\n-----END CERTIFICATE----- "
   key_dir: /etc/ssl/private
   key_ext: .key
   key_group: root
   key_mode: 600
   key_user: root
+  lookup:
+    cert_source_dir: "/tmp/kitchen/srv/salt/files/"
   map_jinja:
     sources:
     - Y:G@osarch
@@ -21,6 +42,7 @@ values:
     - Y:G@os
     - Y:G@osfinger
     - C@cert:lookup
+    - C@cert
     - Y:G@id
   pkgs:
   - ca-certificates
diff --git a/test/integration/default/files/_mapdata/opensuse-tumbleweed.yaml b/test/integration/default/files/_mapdata/opensuse-tumbleweed.yaml
index ee09ad5..b14bb86 100644
--- a/test/integration/default/files/_mapdata/opensuse-tumbleweed.yaml
+++ b/test/integration/default/files/_mapdata/opensuse-tumbleweed.yaml
@@ -9,11 +9,32 @@ values:
   cert_source_dir: /tmp/kitchen/srv/salt/files/
   cert_tmp_dir: /tmp/certs/
   cert_user: root
+  certlist:
+    cert.and.key.to.add:
+      cert: "-----BEGIN CERTIFICATE-----\n1MOCKED CERT AND KEY\n-----END CERTIFICATE----- "
+      key: "-----BEGIN RSA PRIVATE KEY-----\n1MOCKED CERT AND KEY\n-----END RSA PRIVATE
+        KEY----- "
+    cert.and.key.to.remove:
+      cert: "-----BEGIN CERTIFICATE-----\n3MOCKED CERT AND KEY\n-----END CERTIFICATE----- "
+      key: "-----BEGIN RSA PRIVATE KEY-----\n3MOCKED CERT AND KEY\n-----END RSA PRIVATE
+        KEY----- "
+      remove: true
+    cert.and.key.with.ext.to.add:
+      cert: "-----BEGIN CERTIFICATE-----\n4MOCKED CERT AND KEY\n-----END CERTIFICATE----- "
+      cert_ext: ".pem"
+      key: "-----BEGIN RSA PRIVATE KEY-----\n4MOCKED CERT AND KEY\n-----END RSA PRIVATE
+        KEY----- "
+      key_ext: ".priv"
+    cert.from.src.to.add: {}
+    cert.to.add:
+      cert: "-----BEGIN CERTIFICATE-----\n2MOCKED CERT\n-----END CERTIFICATE----- "
   key_dir: /etc/ssl/private
   key_ext: .key
   key_group: root
   key_mode: 600
   key_user: root
+  lookup:
+    cert_source_dir: "/tmp/kitchen/srv/salt/files/"
   map_jinja:
     sources:
     - Y:G@osarch
@@ -21,6 +42,7 @@ values:
     - Y:G@os
     - Y:G@osfinger
     - C@cert:lookup
+    - C@cert
     - Y:G@id
   pkgs:
   - ca-certificates
diff --git a/test/integration/default/files/_mapdata/oraclelinux-7.yaml b/test/integration/default/files/_mapdata/oraclelinux-7.yaml
index 261d0b9..01a77dc 100644
--- a/test/integration/default/files/_mapdata/oraclelinux-7.yaml
+++ b/test/integration/default/files/_mapdata/oraclelinux-7.yaml
@@ -9,11 +9,32 @@ values:
   cert_source_dir: /tmp/kitchen/srv/salt/files/
   cert_tmp_dir: /tmp/certs/
   cert_user: root
+  certlist:
+    cert.and.key.to.add:
+      cert: "-----BEGIN CERTIFICATE-----\n1MOCKED CERT AND KEY\n-----END CERTIFICATE----- "
+      key: "-----BEGIN RSA PRIVATE KEY-----\n1MOCKED CERT AND KEY\n-----END RSA PRIVATE
+        KEY----- "
+    cert.and.key.to.remove:
+      cert: "-----BEGIN CERTIFICATE-----\n3MOCKED CERT AND KEY\n-----END CERTIFICATE----- "
+      key: "-----BEGIN RSA PRIVATE KEY-----\n3MOCKED CERT AND KEY\n-----END RSA PRIVATE
+        KEY----- "
+      remove: true
+    cert.and.key.with.ext.to.add:
+      cert: "-----BEGIN CERTIFICATE-----\n4MOCKED CERT AND KEY\n-----END CERTIFICATE----- "
+      cert_ext: ".pem"
+      key: "-----BEGIN RSA PRIVATE KEY-----\n4MOCKED CERT AND KEY\n-----END RSA PRIVATE
+        KEY----- "
+      key_ext: ".priv"
+    cert.from.src.to.add: {}
+    cert.to.add:
+      cert: "-----BEGIN CERTIFICATE-----\n2MOCKED CERT\n-----END CERTIFICATE----- "
   key_dir: /etc/pki/tls/private
   key_ext: .key
   key_group: root
   key_mode: 600
   key_user: root
+  lookup:
+    cert_source_dir: "/tmp/kitchen/srv/salt/files/"
   map_jinja:
     sources:
     - Y:G@osarch
@@ -21,6 +42,7 @@ values:
     - Y:G@os
     - Y:G@osfinger
     - C@cert:lookup
+    - C@cert
     - Y:G@id
   pkgs:
   - ca-certificates
diff --git a/test/integration/default/files/_mapdata/oraclelinux-8.yaml b/test/integration/default/files/_mapdata/oraclelinux-8.yaml
index 29ae226..0d68658 100644
--- a/test/integration/default/files/_mapdata/oraclelinux-8.yaml
+++ b/test/integration/default/files/_mapdata/oraclelinux-8.yaml
@@ -9,11 +9,32 @@ values:
   cert_source_dir: /tmp/kitchen/srv/salt/files/
   cert_tmp_dir: /tmp/certs/
   cert_user: root
+  certlist:
+    cert.and.key.to.add:
+      cert: "-----BEGIN CERTIFICATE-----\n1MOCKED CERT AND KEY\n-----END CERTIFICATE----- "
+      key: "-----BEGIN RSA PRIVATE KEY-----\n1MOCKED CERT AND KEY\n-----END RSA PRIVATE
+        KEY----- "
+    cert.and.key.to.remove:
+      cert: "-----BEGIN CERTIFICATE-----\n3MOCKED CERT AND KEY\n-----END CERTIFICATE----- "
+      key: "-----BEGIN RSA PRIVATE KEY-----\n3MOCKED CERT AND KEY\n-----END RSA PRIVATE
+        KEY----- "
+      remove: true
+    cert.and.key.with.ext.to.add:
+      cert: "-----BEGIN CERTIFICATE-----\n4MOCKED CERT AND KEY\n-----END CERTIFICATE----- "
+      cert_ext: ".pem"
+      key: "-----BEGIN RSA PRIVATE KEY-----\n4MOCKED CERT AND KEY\n-----END RSA PRIVATE
+        KEY----- "
+      key_ext: ".priv"
+    cert.from.src.to.add: {}
+    cert.to.add:
+      cert: "-----BEGIN CERTIFICATE-----\n2MOCKED CERT\n-----END CERTIFICATE----- "
   key_dir: /etc/pki/tls/private
   key_ext: .key
   key_group: root
   key_mode: 600
   key_user: root
+  lookup:
+    cert_source_dir: "/tmp/kitchen/srv/salt/files/"
   map_jinja:
     sources:
     - Y:G@osarch
@@ -21,6 +42,7 @@ values:
     - Y:G@os
     - Y:G@osfinger
     - C@cert:lookup
+    - C@cert
     - Y:G@id
   pkgs:
   - ca-certificates
diff --git a/test/integration/default/files/_mapdata/ubuntu-16.yaml b/test/integration/default/files/_mapdata/ubuntu-16.yaml
index 96a68e6..85ccc94 100644
--- a/test/integration/default/files/_mapdata/ubuntu-16.yaml
+++ b/test/integration/default/files/_mapdata/ubuntu-16.yaml
@@ -9,11 +9,32 @@ values:
   cert_source_dir: /tmp/kitchen/srv/salt/files/
   cert_tmp_dir: /tmp/certs/
   cert_user: root
+  certlist:
+    cert.and.key.to.add:
+      cert: "-----BEGIN CERTIFICATE-----\n1MOCKED CERT AND KEY\n-----END CERTIFICATE----- "
+      key: "-----BEGIN RSA PRIVATE KEY-----\n1MOCKED CERT AND KEY\n-----END RSA PRIVATE
+        KEY----- "
+    cert.and.key.to.remove:
+      cert: "-----BEGIN CERTIFICATE-----\n3MOCKED CERT AND KEY\n-----END CERTIFICATE----- "
+      key: "-----BEGIN RSA PRIVATE KEY-----\n3MOCKED CERT AND KEY\n-----END RSA PRIVATE
+        KEY----- "
+      remove: true
+    cert.and.key.with.ext.to.add:
+      cert: "-----BEGIN CERTIFICATE-----\n4MOCKED CERT AND KEY\n-----END CERTIFICATE----- "
+      cert_ext: ".pem"
+      key: "-----BEGIN RSA PRIVATE KEY-----\n4MOCKED CERT AND KEY\n-----END RSA PRIVATE
+        KEY----- "
+      key_ext: ".priv"
+    cert.from.src.to.add: {}
+    cert.to.add:
+      cert: "-----BEGIN CERTIFICATE-----\n2MOCKED CERT\n-----END CERTIFICATE----- "
   key_dir: /etc/ssl/private
   key_ext: .key
   key_group: ssl-cert
   key_mode: 640
   key_user: root
+  lookup:
+    cert_source_dir: "/tmp/kitchen/srv/salt/files/"
   map_jinja:
     sources:
     - Y:G@osarch
@@ -21,6 +42,7 @@ values:
     - Y:G@os
     - Y:G@osfinger
     - C@cert:lookup
+    - C@cert
     - Y:G@id
   pkgs:
   - ca-certificates
diff --git a/test/integration/default/files/_mapdata/ubuntu-18.yaml b/test/integration/default/files/_mapdata/ubuntu-18.yaml
index e599ebf..50d8ad7 100644
--- a/test/integration/default/files/_mapdata/ubuntu-18.yaml
+++ b/test/integration/default/files/_mapdata/ubuntu-18.yaml
@@ -9,11 +9,32 @@ values:
   cert_source_dir: /tmp/kitchen/srv/salt/files/
   cert_tmp_dir: /tmp/certs/
   cert_user: root
+  certlist:
+    cert.and.key.to.add:
+      cert: "-----BEGIN CERTIFICATE-----\n1MOCKED CERT AND KEY\n-----END CERTIFICATE----- "
+      key: "-----BEGIN RSA PRIVATE KEY-----\n1MOCKED CERT AND KEY\n-----END RSA PRIVATE
+        KEY----- "
+    cert.and.key.to.remove:
+      cert: "-----BEGIN CERTIFICATE-----\n3MOCKED CERT AND KEY\n-----END CERTIFICATE----- "
+      key: "-----BEGIN RSA PRIVATE KEY-----\n3MOCKED CERT AND KEY\n-----END RSA PRIVATE
+        KEY----- "
+      remove: true
+    cert.and.key.with.ext.to.add:
+      cert: "-----BEGIN CERTIFICATE-----\n4MOCKED CERT AND KEY\n-----END CERTIFICATE----- "
+      cert_ext: ".pem"
+      key: "-----BEGIN RSA PRIVATE KEY-----\n4MOCKED CERT AND KEY\n-----END RSA PRIVATE
+        KEY----- "
+      key_ext: ".priv"
+    cert.from.src.to.add: {}
+    cert.to.add:
+      cert: "-----BEGIN CERTIFICATE-----\n2MOCKED CERT\n-----END CERTIFICATE----- "
   key_dir: /etc/ssl/private
   key_ext: .key
   key_group: ssl-cert
   key_mode: 640
   key_user: root
+  lookup:
+    cert_source_dir: "/tmp/kitchen/srv/salt/files/"
   map_jinja:
     sources:
     - Y:G@osarch
@@ -21,6 +42,7 @@ values:
     - Y:G@os
     - Y:G@osfinger
     - C@cert:lookup
+    - C@cert
     - Y:G@id
   pkgs:
   - ca-certificates
diff --git a/test/integration/default/files/_mapdata/ubuntu-20.yaml b/test/integration/default/files/_mapdata/ubuntu-20.yaml
index d90d60a..1402414 100644
--- a/test/integration/default/files/_mapdata/ubuntu-20.yaml
+++ b/test/integration/default/files/_mapdata/ubuntu-20.yaml
@@ -9,11 +9,32 @@ values:
   cert_source_dir: /tmp/kitchen/srv/salt/files/
   cert_tmp_dir: /tmp/certs/
   cert_user: root
+  certlist:
+    cert.and.key.to.add:
+      cert: "-----BEGIN CERTIFICATE-----\n1MOCKED CERT AND KEY\n-----END CERTIFICATE----- "
+      key: "-----BEGIN RSA PRIVATE KEY-----\n1MOCKED CERT AND KEY\n-----END RSA PRIVATE
+        KEY----- "
+    cert.and.key.to.remove:
+      cert: "-----BEGIN CERTIFICATE-----\n3MOCKED CERT AND KEY\n-----END CERTIFICATE----- "
+      key: "-----BEGIN RSA PRIVATE KEY-----\n3MOCKED CERT AND KEY\n-----END RSA PRIVATE
+        KEY----- "
+      remove: true
+    cert.and.key.with.ext.to.add:
+      cert: "-----BEGIN CERTIFICATE-----\n4MOCKED CERT AND KEY\n-----END CERTIFICATE----- "
+      cert_ext: ".pem"
+      key: "-----BEGIN RSA PRIVATE KEY-----\n4MOCKED CERT AND KEY\n-----END RSA PRIVATE
+        KEY----- "
+      key_ext: ".priv"
+    cert.from.src.to.add: {}
+    cert.to.add:
+      cert: "-----BEGIN CERTIFICATE-----\n2MOCKED CERT\n-----END CERTIFICATE----- "
   key_dir: /etc/ssl/private
   key_ext: .key
   key_group: ssl-cert
   key_mode: 640
   key_user: root
+  lookup:
+    cert_source_dir: "/tmp/kitchen/srv/salt/files/"
   map_jinja:
     sources:
     - Y:G@osarch
@@ -21,6 +42,7 @@ values:
     - Y:G@os
     - Y:G@osfinger
     - C@cert:lookup
+    - C@cert
     - Y:G@id
   pkgs:
   - ca-certificates