First version in Galaxy

seb4itik/byow/roles/local_ca_certs/tasks/create_cert.yml

@@ -0,0 +1,42 @@
+- name: Create private key for new certificate
+  community.crypto.openssl_privatekey:
+    path: "/etc/ssl/private/{{ cert.cn }}.key"
+    mode: "0640"
+    group: "ssl-cert"
+
+- name: Create CSR for new certificate
+  community.crypto.openssl_csr:
+    path: "/etc/ssl/certs/{{ cert.cn }}.csr"
+    privatekey_path: "/etc/ssl/private/{{ cert.cn }}.key"
+    common_name: "{{ cert.cn }}"
+    subject_alt_name: "{{ cert.domains }}"
+    country_name: "{{ cert.country_name | default(local_ca_certs_default_country_name) | mandatory }}"
+    locality_name: "{{ cert.locality_name | default(local_ca_certs_default_locality_name) | mandatory }}"
+    organization_name: "{{ cert.organization_name | default(local_ca_certs_default_organization_name) | mandatory }}"
+    email_address: "{{ cert.email_address | default(local_ca_certs_default_email_address) | mandatory }}"
+    return_content: true
+  register: local_ca_certs_csr
+
+- name: Sign certificate with our CA
+  delegate_to: "localhost"
+  # noqa: no-handler
+  when: "local_ca_certs_csr.changed"
+  community.crypto.x509_certificate_pipe:
+    csr_content: "{{ local_ca_certs_csr.csr }}"
+    provider: "ownca"
+    ownca_path: "ca/ca-certificate.crt"
+    ownca_privatekey_path: "ca/ca-certificate.key"
+    ownca_privatekey_passphrase: "{{ local_ca_certs_ca_passphrase }}"
+    ownca_not_after: "{{ cert.not_after | default(local_ca_certs_default_not_after) }}"
+    ownca_not_before: "{{ cert.not_before | default(local_ca_certs_default_not_before) }}"
+  register: local_ca_certs_certificate
+
+- name: Write certificate file on server
+  # noqa: no-handler
+  when: "local_ca_certs_csr.changed"
+  ansible.builtin.copy:
+    dest: "/etc/ssl/certs/{{ cert.cn }}.crt"
+    content: "{{ local_ca_certs_certificate.certificate }}"
+    mode: "0644"
+  notify:
+    - "Reboot host"