volker.raschek/ansible-role-certificate-authority
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

feat!: apply subject alternative names to root and intermediate CA

Browse Source 
The variables `certificate_authority_root_ca_subject_alternative_names` and
`certificate_authority_intermediate_ca_subject_alternative_names` were
documented but never referenced by any task, so both CA certificates were always
issued without SANs. Wire them into the corresponding CSR tasks and fall back to
`omit` when the list is empty.

SAN entries are now passed to `openssl_csr` unchanged instead of being prefixed
with `DNS:` by the role. This allows other types such as `IP:` or `email:`,
which the previous rewrite would have corrupted into values like `DNS:IP:...`.
The client tasks additionally dropped `join(',') | quote`, because `quote`
performs shell escaping and `openssl_csr` expects a list.

Since both client CSR tasks only differed in `subject_alt_name`, they collapse
into a single task per file.

BREAKING CHANGE: Entries of all `*_subject_alternative_names` variables must now
carry their type prefix, for example `DNS:example.local` instead of
`example.local`.

Co-authored-by: Copilot <copilot@github.com>
This commit is contained in:
volker.raschek
2026-09-07 22:28:52 +02:00
co-authored by Copilot
parent 38ab2f55bb
commit 41d06e4e6d
9 changed files with 20 additions and 56 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+6 -5
View File
@@ -13,8 +13,9 @@ the intermediate certificate authority.
certificate_authority_client_skip: false
certificate_authority_client_common_name: "{{ inventory_hostname }}"
certificate_authority_client_subject_alternative_names:
- "{{ inventory_hostname }}"
- san.example.local
- "DNS:{{ inventory_hostname }}"
- "DNS:san.example.local"
- "IP:10.11.12.13"
```
## Parameters
@@ -33,7 +34,7 @@ certificate_authority_client_subject_alternative_names:
| `certificate_authority_root_ca_organization_name` | Organization name of the root certificate authority owner. | `""` |
| `certificate_authority_root_ca_organizational_unit_name` | Organizational unit name of the root certificate authority. | `""` |
| `certificate_authority_root_ca_state_or_province_name` | State or province name where the owner of the root certificate authority is located. | `""` |
| `certificate_authority_root_ca_subject_alternative_names` | Subject Alternative Names (SAN) of the root certificate authority. | `[]` |
| `certificate_authority_root_ca_subject_alternative_names` | Subject Alternative Names (SAN) of the root certificate authority. Each entry must be prefixed by its type, for example `DNS:example.local` or `IP:10.11.12.13`. | `[]` |
| `certificate_authority_root_ca_not_after` | Time in the future from now when the TLS certificate should expire | `+3650d` |
| `certificate_authority_root_ca_not_before` | Time in the past from now when the TLS certificate should be valid. | `+0s` |
| `certificate_authority_root_ca_tls_key_content` | Content of a custom used root certificate authority. Will only be imported, when `certificate_authority_root_ca_create: false`. | `""` |
@@ -54,7 +55,7 @@ certificate_authority_client_subject_alternative_names:
| `certificate_authority_intermediate_ca_organization_name` | Organization name of the intermediate certificate authority owner. | `""` |
| `certificate_authority_intermediate_ca_organizational_unit_name` | Organizational unit name of the intermediate certificate authority. | `""` |
| `certificate_authority_intermediate_ca_state_or_province_name` | State or province name where the owner of the intermediate certificate authority is located. | `""` |
| `certificate_authority_intermediate_ca_subject_alternative_names` | Subject Alternative Names (SAN) of the intermediate certificate authority. | `[]` |
| `certificate_authority_intermediate_ca_subject_alternative_names` | Subject Alternative Names (SAN) of the intermediate certificate authority. Each entry must be prefixed by its type, for example `DNS:example.local` or `IP:10.11.12.13`. | `[]` |
| `certificate_authority_intermediate_ca_not_after` | Time in the future from now when the TLS certificate should expire | `+1825d` |
| `certificate_authority_intermediate_ca_not_before` | Time in the past from now when the TLS certificate should be valid. | `+0s` |
| `certificate_authority_intermediate_ca_tls_key_content` | Content of a custom used intermediate certificate authority. Will only be imported, when `certificate_authority_intermediate_ca_create: false`. | `""` |
@@ -75,7 +76,7 @@ certificate_authority_client_subject_alternative_names:
| `certificate_authority_client_organization_name` | Organization name of the client certificate owner. | `""` |
| `certificate_authority_client_organizational_unit_name` | Common Name (CN) of the client certificate. | `""` |
| `certificate_authority_client_state_or_province_name` | State or province name where the owner of the client certificate is located. | `""` |
| `certificate_authority_client_subject_alternative_names` | Subject Alternative Names (SAN) of the client certificate. | `[]` |
| `certificate_authority_client_subject_alternative_names` | Subject Alternative Names (SAN) of the client certificate. Each entry must be prefixed by its type, for example `DNS:example.local` or `IP:10.11.12.13`. | `[]` |
| `certificate_authority_client_not_after` | Time in the future from now when the TLS certificate should expire | `+397d` |
| `certificate_authority_client_not_before` | Time in the past from now when the TLS certificate should be valid. | `+0s` |
| `certificate_authority_client_tls_key_passphrase` | Passphrase for the private key of the generated or imported client certificate. | `""` |