From 95ea71394eb80b9aefaf072b301a02323340541f Mon Sep 17 00:00:00 2001 From: Markus Pesch Date: Mon, 7 Sep 2026 17:24:35 +0200 Subject: [PATCH] fix: make issued certificates readable for unprivileged consumers The pki directories were created with mode 0700, so cert.pem, chain.pem and fullchain.pem stayed unreachable for every non root process although they are declared as 0644. That defeats the main purpose of the role, which is handing a certificate to a service such as nginx or postgres. The directories are opened up to 0755. To keep that safe, the mode of the private keys is now pinned explicitly to 0600 instead of relying on the default of community.crypto.openssl_privatekey. Co-authored-by: Copilot --- tasks/client_certificate.yaml | 2 +- tasks/client_certificate_protected.yaml | 1 + tasks/client_certificate_unprotected.yaml | 1 + tasks/intermediate_certificate_authority.yaml | 2 +- tasks/intermediate_certificate_authority_protected.yaml | 1 + tasks/intermediate_certificate_authority_unprotected.yaml | 1 + tasks/root_certificate_authority.yaml | 2 +- tasks/root_certificate_authority_protected.yaml | 1 + tasks/root_certificate_authority_unprotected.yaml | 1 + 9 files changed, 9 insertions(+), 3 deletions(-) diff --git a/tasks/client_certificate.yaml b/tasks/client_certificate.yaml index f222847..54d9d9a 100644 --- a/tasks/client_certificate.yaml +++ b/tasks/client_certificate.yaml @@ -5,7 +5,7 @@ path: "{{ certificate_authority_client_path }}" owner: "root" group: "root" - mode: "0700" + mode: "0755" state: directory - name: Verify that the signing intermediate Certificate Authority (CA) is available diff --git a/tasks/client_certificate_protected.yaml b/tasks/client_certificate_protected.yaml index 73d8676..12a77d4 100644 --- a/tasks/client_certificate_protected.yaml +++ b/tasks/client_certificate_protected.yaml @@ -3,6 +3,7 @@ - name: Create private key for client community.crypto.openssl_privatekey: path: "{{ certificate_authority_client_path }}/privkey.pem" + mode: "0600" type: "{{ certificate_authority_client_tls_key_type }}" passphrase: "{{ certificate_authority_client_tls_key_passphrase }}" cipher: auto diff --git a/tasks/client_certificate_unprotected.yaml b/tasks/client_certificate_unprotected.yaml index 1094bc4..87a3fac 100644 --- a/tasks/client_certificate_unprotected.yaml +++ b/tasks/client_certificate_unprotected.yaml @@ -3,6 +3,7 @@ - name: Create private key for client community.crypto.openssl_privatekey: path: "{{ certificate_authority_client_path }}/privkey.pem" + mode: "0600" type: "{{ certificate_authority_client_tls_key_type }}" - name: Create a certificate signing request (CSR) for client certificate diff --git a/tasks/intermediate_certificate_authority.yaml b/tasks/intermediate_certificate_authority.yaml index 4c7dcd1..0a4a05f 100644 --- a/tasks/intermediate_certificate_authority.yaml +++ b/tasks/intermediate_certificate_authority.yaml @@ -5,7 +5,7 @@ path: "{{ certificate_authority_intermediate_ca_path }}" owner: "root" group: "root" - mode: "0700" + mode: "0755" state: "directory" - name: Verify that the signing root Certificate Authority (CA) is available diff --git a/tasks/intermediate_certificate_authority_protected.yaml b/tasks/intermediate_certificate_authority_protected.yaml index 8ca2bfa..656aced 100644 --- a/tasks/intermediate_certificate_authority_protected.yaml +++ b/tasks/intermediate_certificate_authority_protected.yaml @@ -4,6 +4,7 @@ community.crypto.openssl_privatekey: passphrase: "{{ certificate_authority_intermediate_ca_tls_key_passphrase }}" path: "{{ certificate_authority_intermediate_ca_path }}/privkey.pem" + mode: "0600" type: "{{ certificate_authority_intermediate_ca_tls_key_type }}" cipher: auto diff --git a/tasks/intermediate_certificate_authority_unprotected.yaml b/tasks/intermediate_certificate_authority_unprotected.yaml index f919219..3e53824 100644 --- a/tasks/intermediate_certificate_authority_unprotected.yaml +++ b/tasks/intermediate_certificate_authority_unprotected.yaml @@ -3,6 +3,7 @@ - name: Create private key for intermediate CA community.crypto.openssl_privatekey: path: "{{ certificate_authority_intermediate_ca_path }}/privkey.pem" + mode: "0600" type: "{{ certificate_authority_intermediate_ca_tls_key_type }}" - name: Create a certificate signing request (CSR) for intermediate CA diff --git a/tasks/root_certificate_authority.yaml b/tasks/root_certificate_authority.yaml index 9868a06..5558fa4 100644 --- a/tasks/root_certificate_authority.yaml +++ b/tasks/root_certificate_authority.yaml @@ -5,7 +5,7 @@ path: "{{ certificate_authority_root_ca_path }}" owner: "root" group: "root" - mode: "0700" + mode: "0755" state: "directory" - name: Create unprotected root Certificate Authority (CA) diff --git a/tasks/root_certificate_authority_protected.yaml b/tasks/root_certificate_authority_protected.yaml index ee73456..3406577 100644 --- a/tasks/root_certificate_authority_protected.yaml +++ b/tasks/root_certificate_authority_protected.yaml @@ -4,6 +4,7 @@ community.crypto.openssl_privatekey: passphrase: "{{ certificate_authority_root_ca_tls_key_passphrase }}" path: "{{ certificate_authority_root_ca_path }}/privkey.pem" + mode: "0600" type: "{{ certificate_authority_root_ca_tls_key_type }}" cipher: auto diff --git a/tasks/root_certificate_authority_unprotected.yaml b/tasks/root_certificate_authority_unprotected.yaml index 108c5a4..db73f44 100644 --- a/tasks/root_certificate_authority_unprotected.yaml +++ b/tasks/root_certificate_authority_unprotected.yaml @@ -3,6 +3,7 @@ - name: Create private key for root CA community.crypto.openssl_privatekey: path: "{{ certificate_authority_root_ca_path }}/privkey.pem" + mode: "0600" type: "{{ certificate_authority_root_ca_tls_key_type }}" - name: Create a certificate signing request (CSR) for root CA