43 lines
1.6 KiB
YAML
43 lines
1.6 KiB
YAML
- name: Create private key for new certificate
|
|
community.crypto.openssl_privatekey:
|
|
path: "/etc/ssl/private/{{ cert.cn }}.key"
|
|
mode: "0640"
|
|
group: "ssl-cert"
|
|
|
|
- name: Create CSR for new certificate
|
|
community.crypto.openssl_csr:
|
|
path: "/etc/ssl/certs/{{ cert.cn }}.csr"
|
|
privatekey_path: "/etc/ssl/private/{{ cert.cn }}.key"
|
|
common_name: "{{ cert.cn }}"
|
|
subject_alt_name: "{{ cert.domains }}"
|
|
country_name: "{{ cert.country_name | default(certs_default_country_name) | mandatory }}"
|
|
locality_name: "{{ cert.locality_name | default(certs_default_locality_name) | mandatory }}"
|
|
organization_name: "{{ cert.organization_name | default(certs_default_organization_name) | mandatory }}"
|
|
email_address: "{{ cert.email_address | default(certs_default_email_address) | mandatory }}"
|
|
return_content: true
|
|
register: certs_csr
|
|
|
|
- name: Sign certificate with our CA
|
|
delegate_to: "localhost"
|
|
# noqa: no-handler
|
|
when: "certs_csr.changed"
|
|
community.crypto.x509_certificate_pipe:
|
|
csr_content: "{{ certs_csr.csr }}"
|
|
provider: "ownca"
|
|
ownca_path: "ca/ca-certificate.crt"
|
|
ownca_privatekey_path: "ca/ca-certificate.key"
|
|
ownca_privatekey_passphrase: "{{ certs_ca_passphrase }}"
|
|
ownca_not_after: "{{ cert.not_after | default(certs_default_not_after) }}"
|
|
ownca_not_before: "{{ cert.not_before | default(certs_default_not_before) }}"
|
|
register: certs_certificate
|
|
|
|
- name: Write certificate file on server
|
|
# noqa: no-handler
|
|
when: "certs_csr.changed"
|
|
ansible.builtin.copy:
|
|
dest: "/etc/ssl/certs/{{ cert.cn }}.crt"
|
|
content: "{{ certs_certificate.certificate }}"
|
|
mode: "0644"
|
|
notify:
|
|
- "Reboot host"
|