WIP

roles/local_ca/tasks/main.yml

@@ -0,0 +1,51 @@
+- name: Create CA directory
+  delegate_to: "localhost"
+  run_once: true
+  ansible.builtin.file:
+    path: "ca"
+    state: "directory"
+    mode: "0700"
+
+- name: Create private key with password protection
+  delegate_to: "localhost"
+  run_once: true
+  community.crypto.openssl_privatekey:
+    path: "ca/ca-certificate.key"
+    passphrase: "{{ local_ca_passphrase }}"
+    size: "{{ local_ca_key_size }}"
+    type: "{{ local_ca_key_type }}"
+    mode: "0640"
+
+- name: Create certificate signing request (CSR) for CA certificate
+  delegate_to: "localhost"
+  run_once: true
+  community.crypto.openssl_csr:
+    path: "ca/ca-certificate.csr"
+    privatekey_path: "ca/ca-certificate.key"
+    privatekey_passphrase: "{{ local_ca_passphrase }}"
+    common_name: "{{ local_ca_common_name }}"
+    use_common_name_for_san: false  # since we do not specify SANs, don't use CN as a SAN
+    country_name: "{{ local_ca_country_name }}"
+    locality_name: "{{ local_ca_locality_name }}"
+    organization_name: "{{ local_ca_organization_name }}"
+    email_address: "{{ local_ca_email_address }}"
+    basic_constraints:
+      - "CA:TRUE"
+    basic_constraints_critical: true
+    key_usage:
+      - "keyCertSign"
+    key_usage_critical: true
+    return_content: true
+  register: local_ca_csr
+
+- name: Create self-signed CA certificate from CSR
+  delegate_to: "localhost"
+  run_once: true
+  # noqa: no-handler
+  when: "local_ca_csr.changed"
+  community.crypto.x509_certificate:
+    path: "ca/ca-certificate.crt"
+    csr_content: "{{ local_ca_csr.csr }}"
+    privatekey_path: "ca/ca-certificate.key"
+    privatekey_passphrase: "{{ local_ca_passphrase }}"
+    provider: "selfsigned"