- name: Create private key for new certificate
  community.crypto.openssl_privatekey:
    path: "/etc/ssl/private/{{ cert.cn }}.key"
    mode: "0640"
    group: "ssl-cert"

- name: Create CSR for new certificate
  community.crypto.openssl_csr:
    path: "/etc/ssl/certs/{{ cert.cn }}.csr"
    privatekey_path: "/etc/ssl/private/{{ cert.cn }}.key"
    common_name: "{{ cert.cn }}"
    subject_alt_name: "{{ cert.domains }}"
    country_name: "{{ cert.country_name | default(certs_default_country_name) | mandatory }}"
    locality_name: "{{ cert.locality_name | default(certs_default_locality_name) | mandatory }}"
    organization_name: "{{ cert.organization_name | default(certs_default_organization_name) | mandatory }}"
    email_address: "{{ cert.email_address | default(certs_default_email_address) | mandatory }}"
    return_content: true
  register: certs_csr

- name: Sign certificate with our CA
  delegate_to: "localhost"
  # noqa: no-handler
  when: "certs_csr.changed"
  community.crypto.x509_certificate_pipe:
    csr_content: "{{ certs_csr.csr }}"
    provider: "ownca"
    ownca_path: "ca/ca-certificate.crt"
    ownca_privatekey_path: "ca/ca-certificate.key"
    ownca_privatekey_passphrase: "{{ certs_ca_passphrase }}"
    ownca_not_after: "{{ cert.not_after | default(certs_default_not_after) }}"
    ownca_not_before: "{{ cert.not_before | default(certs_default_not_before) }}"
  register: certs_certificate

- name: Write certificate file on server
  # noqa: no-handler
  when: "certs_csr.changed"
  ansible.builtin.copy:
    dest: "/etc/ssl/certs/{{ cert.cn }}.crt"
    content: "{{ certs_certificate.certificate }}"
    mode: "0644"
  notify:
    - "Reboot host"