volker.raschek/ansible-role-certificate-authority
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

fix: resolve trust store location per distribution family

Browse Source 
The trust store import hardcoded the RHEL anchor directory and
`update-ca-trust`, although `meta/main.yaml` also declares ArchLinux and Ubuntu
as supported platforms. On those distributions the task created a dangling
symlink outside any trust source and then failed on the missing binary.

Resolve both the anchor path and the update command from a map keyed by
`ansible_facts['os_family']`. Debian based systems additionally require the file
extension `crt`, because `update-ca-certificates` ignores anchors named
otherwise.

Note that the role now depends on gathered facts.

Co-authored-by: Copilot <copilot@github.com>
This commit is contained in:
volker.raschek
2026-09-07 22:30:23 +02:00
co-authored by Copilot
parent 2733f3929a
commit 9ea26dc23f
1 changed files with 12 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tasks/root_certificate_authority.yaml
+12 -2
View File
@@ -66,19 +66,29 @@
_stat_result.stat.exists
- name: Import certificate of root Certificate Authority (CA) into systems trust store
vars:
# Debian based distributions only consider anchors with the file extension crt.
_trust_store_anchor:
Archlinux: "/etc/ca-certificates/trust-source/anchors/{{ certificate_authority_root_ca_common_name | replace(' ', '_') }}.pem"
Debian: "/usr/local/share/ca-certificates/{{ certificate_authority_root_ca_common_name | replace(' ', '_') }}.crt"
RedHat: "/etc/pki/ca-trust/source/anchors/{{ certificate_authority_root_ca_common_name | replace(' ', '_') }}.pem"
_trust_store_update_command:
Archlinux: "/usr/bin/update-ca-trust"
Debian: "/usr/sbin/update-ca-certificates"
RedHat: "/usr/bin/update-ca-trust"
when: certificate_authority_root_ca_import is defined and
certificate_authority_root_ca_import
block:
- name: Create symolic link
ansible.builtin.file:
src: "{{ certificate_authority_root_ca_path }}/cert.pem"
dest: "/etc/pki/ca-trust/source/anchors/{{ certificate_authority_root_ca_common_name | replace(' ', '_') }}.pem"
dest: "{{ _trust_store_anchor[ansible_facts['os_family']] }}"
owner: root
group: root
state: link
- name: Update systems SSL/TLS trust store
ansible.builtin.command:
cmd: /usr/bin/update-ca-trust
cmd: "{{ _trust_store_update_command[ansible_facts['os_family']] }}"
register: _update_ca_trust
changed_when: _update_ca_trust.rc == 0
failed_when: _update_ca_trust.rc > 0