59 lines
1.9 KiB
YAML
59 lines
1.9 KiB
YAML
---
|
|
- name: Install pki directory
|
|
ansible.builtin.file:
|
|
path: /etc/pki/
|
|
state: directory
|
|
mode: '0700'
|
|
owner: root
|
|
group: root
|
|
|
|
- name: Install CA directory
|
|
ansible.builtin.file:
|
|
path: /etc/pki/konchin.com/
|
|
state: directory
|
|
mode: '0700'
|
|
owner: root
|
|
group: root
|
|
|
|
- name: Check for existing root ca certificate
|
|
ansible.builtin.stat:
|
|
path: /etc/pki/konchin.com/rootca.pem
|
|
register: create_rootca_existing
|
|
|
|
# The x509_certificate/openssl_privatekey modules recompute their relative
|
|
# validity/date options on every run, which never exactly matches the fixed
|
|
# timestamps baked into an already-issued certificate. Left unguarded, that
|
|
# makes them "regenerate" the CA (and invalidate every certificate it
|
|
# signed) on every playbook run. The CA is not meant to auto-rotate, so we
|
|
# only ever create it once.
|
|
- name: Create root ca
|
|
when: not create_rootca_existing.stat.exists
|
|
block:
|
|
- name: Create private key for root ca
|
|
community.crypto.openssl_privatekey:
|
|
path: /etc/pki/konchin.com/rootca.key
|
|
cipher: auto
|
|
passphrase: "{{ secret_ca_passphrase }}"
|
|
|
|
- name: Create CSR for root ca
|
|
community.crypto.openssl_csr_pipe:
|
|
privatekey_path: /etc/pki/konchin.com/rootca.key
|
|
privatekey_passphrase: "{{ secret_ca_passphrase }}"
|
|
common_name: Konchin.com CA
|
|
use_common_name_for_san: false
|
|
basic_constraints:
|
|
- 'CA:TRUE'
|
|
basic_constraints_critical: true
|
|
key_usage:
|
|
- keyCertSign
|
|
key_usage_critical: true
|
|
register: create_rootca_ca_csr
|
|
|
|
- name: Create cert for root ca
|
|
community.crypto.x509_certificate:
|
|
path: /etc/pki/konchin.com/rootca.pem
|
|
csr_content: "{{ create_rootca_ca_csr.csr }}"
|
|
privatekey_path: /etc/pki/konchin.com/rootca.key
|
|
privatekey_passphrase: "{{ secret_ca_passphrase }}"
|
|
provider: selfsigned
|