refactor: fix root ca rotation

I'm fucked

roles/create_rootca/tasks/main.yml

@@ -15,30 +15,44 @@
     owner: root
     group: root
 
-- name: Create private key for root ca
-  community.crypto.openssl_privatekey:
-    path: /etc/pki/konchin.com/rootca.key
-    cipher: auto
-    passphrase: "{{ secret_ca_passphrase }}"
-
-- name: Create CSR for root ca
-  community.crypto.openssl_csr_pipe:
-    privatekey_path: /etc/pki/konchin.com/rootca.key
-    privatekey_passphrase: "{{ secret_ca_passphrase }}"
-    common_name: Konchin.com CA
-    use_common_name_for_san: false
-    basic_constraints:
-      - 'CA:TRUE'
-    basic_constraints_critical: true
-    key_usage:
-      - keyCertSign
-    key_usage_critical: true
-  register: create_rootca_ca_csr
-
-- name: Create cert for root ca
-  community.crypto.x509_certificate:
+- name: Check for existing root ca certificate
+  ansible.builtin.stat:
     path: /etc/pki/konchin.com/rootca.pem
-    csr_content: "{{ create_rootca_ca_csr.csr }}"
-    privatekey_path: /etc/pki/konchin.com/rootca.key
-    privatekey_passphrase: "{{ secret_ca_passphrase }}"
-    provider: selfsigned
+  register: create_rootca_existing
+
+# The x509_certificate/openssl_privatekey modules recompute their relative
+# validity/date options on every run, which never exactly matches the fixed
+# timestamps baked into an already-issued certificate. Left unguarded, that
+# makes them "regenerate" the CA (and invalidate every certificate it
+# signed) on every playbook run. The CA is not meant to auto-rotate, so we
+# only ever create it once.
+- name: Create root ca
+  when: not create_rootca_existing.stat.exists
+  block:
+    - name: Create private key for root ca
+      community.crypto.openssl_privatekey:
+        path: /etc/pki/konchin.com/rootca.key
+        cipher: auto
+        passphrase: "{{ secret_ca_passphrase }}"
+
+    - name: Create CSR for root ca
+      community.crypto.openssl_csr_pipe:
+        privatekey_path: /etc/pki/konchin.com/rootca.key
+        privatekey_passphrase: "{{ secret_ca_passphrase }}"
+        common_name: Konchin.com CA
+        use_common_name_for_san: false
+        basic_constraints:
+          - 'CA:TRUE'
+        basic_constraints_critical: true
+        key_usage:
+          - keyCertSign
+        key_usage_critical: true
+      register: create_rootca_ca_csr
+
+    - name: Create cert for root ca
+      community.crypto.x509_certificate:
+        path: /etc/pki/konchin.com/rootca.pem
+        csr_content: "{{ create_rootca_ca_csr.csr }}"
+        privatekey_path: /etc/pki/konchin.com/rootca.key
+        privatekey_passphrase: "{{ secret_ca_passphrase }}"
+        provider: selfsigned