52 lines
1.6 KiB
YAML
52 lines
1.6 KiB
YAML
- name: Create CA directory
|
|
delegate_to: "localhost"
|
|
run_once: true
|
|
ansible.builtin.file:
|
|
path: "ca"
|
|
state: "directory"
|
|
mode: "0700"
|
|
|
|
- name: Create private key with password protection
|
|
delegate_to: "localhost"
|
|
run_once: true
|
|
community.crypto.openssl_privatekey:
|
|
path: "ca/ca-certificate.key"
|
|
passphrase: "{{ local_ca_passphrase }}"
|
|
size: "{{ local_ca_key_size }}"
|
|
type: "{{ local_ca_key_type }}"
|
|
mode: "0640"
|
|
|
|
- name: Create certificate signing request (CSR) for CA certificate
|
|
delegate_to: "localhost"
|
|
run_once: true
|
|
community.crypto.openssl_csr:
|
|
path: "ca/ca-certificate.csr"
|
|
privatekey_path: "ca/ca-certificate.key"
|
|
privatekey_passphrase: "{{ local_ca_passphrase }}"
|
|
common_name: "{{ local_ca_common_name }}"
|
|
use_common_name_for_san: false # since we do not specify SANs, don't use CN as a SAN
|
|
country_name: "{{ local_ca_country_name }}"
|
|
locality_name: "{{ local_ca_locality_name }}"
|
|
organization_name: "{{ local_ca_organization_name }}"
|
|
email_address: "{{ local_ca_email_address }}"
|
|
basic_constraints:
|
|
- "CA:TRUE"
|
|
basic_constraints_critical: true
|
|
key_usage:
|
|
- "keyCertSign"
|
|
key_usage_critical: true
|
|
return_content: true
|
|
register: local_ca_csr
|
|
|
|
- name: Create self-signed CA certificate from CSR
|
|
delegate_to: "localhost"
|
|
run_once: true
|
|
# noqa: no-handler
|
|
when: "local_ca_csr.changed"
|
|
community.crypto.x509_certificate:
|
|
path: "ca/ca-certificate.crt"
|
|
csr_content: "{{ local_ca_csr.csr }}"
|
|
privatekey_path: "ca/ca-certificate.key"
|
|
privatekey_passphrase: "{{ local_ca_passphrase }}"
|
|
provider: "selfsigned"
|