From a4be99b28b2c456abd134cccea63b454fb629b86 Mon Sep 17 00:00:00 2001 From: Markus Pesch Date: Mon, 7 Sep 2026 22:06:37 +0200 Subject: [PATCH] fix: update the systems trust store from a handler The update command ran on every play with changed_when tied to its return code, so the role never reported a converged state. It is a handler now, notified by the anchor symlink and by the three tasks which write cert.pem of the root certificate authority. Notifying from the certificate tasks as well keeps the trust store correct on renewal, where the symlink itself stays untouched. The anchor path and the update command moved into the per os_family vars, because a handler cannot read the block vars they lived in before. Debian and RedHat need dedicated files again, they agree on the package name but differ in anchor path, file extension and update command. Co-authored-by: Copilot --- handlers/main.yaml | 8 +++++ tasks/root_certificate_authority.yaml | 31 +++++-------------- tasks/root_certificate_authority_import.yaml | 1 + .../root_certificate_authority_protected.yaml | 1 + ...oot_certificate_authority_unprotected.yaml | 1 + vars/Archlinux.yaml | 3 ++ vars/Debian.yaml | 8 +++++ vars/RedHat.yaml | 7 +++++ 8 files changed, 36 insertions(+), 24 deletions(-) create mode 100644 handlers/main.yaml create mode 100644 vars/Debian.yaml create mode 100644 vars/RedHat.yaml diff --git a/handlers/main.yaml b/handlers/main.yaml new file mode 100644 index 0000000..764bae3 --- /dev/null +++ b/handlers/main.yaml @@ -0,0 +1,8 @@ +--- + +- name: Update systems SSL/TLS trust store + ansible.builtin.command: + cmd: "{{ certificate_authority_trust_store_update_command }}" + changed_when: true + when: certificate_authority_root_ca_import is defined and + certificate_authority_root_ca_import diff --git a/tasks/root_certificate_authority.yaml b/tasks/root_certificate_authority.yaml index 06834ba..dcc276a 100644 --- a/tasks/root_certificate_authority.yaml +++ b/tasks/root_certificate_authority.yaml @@ -47,29 +47,12 @@ _concat_mode: "0600" - name: Import certificate of root Certificate Authority (CA) into systems trust store - vars: - # Debian based distributions only consider anchors with the file extension crt. - _trust_store_anchor: - Archlinux: "/etc/ca-certificates/trust-source/anchors/{{ certificate_authority_root_ca_common_name | replace(' ', '_') }}.pem" - Debian: "/usr/local/share/ca-certificates/{{ certificate_authority_root_ca_common_name | replace(' ', '_') }}.crt" - RedHat: "/etc/pki/ca-trust/source/anchors/{{ certificate_authority_root_ca_common_name | replace(' ', '_') }}.pem" - _trust_store_update_command: - Archlinux: "/usr/bin/update-ca-trust" - Debian: "/usr/sbin/update-ca-certificates" - RedHat: "/usr/bin/update-ca-trust" + ansible.builtin.file: + src: "{{ certificate_authority_root_ca_path }}/cert.pem" + dest: "{{ certificate_authority_trust_store_anchor }}" + owner: root + group: root + state: link + notify: Update systems SSL/TLS trust store when: certificate_authority_root_ca_import is defined and certificate_authority_root_ca_import - block: - - name: Create symolic link - ansible.builtin.file: - src: "{{ certificate_authority_root_ca_path }}/cert.pem" - dest: "{{ _trust_store_anchor[ansible_facts['os_family']] }}" - owner: root - group: root - state: link - - name: Update systems SSL/TLS trust store - ansible.builtin.command: - cmd: "{{ _trust_store_update_command[ansible_facts['os_family']] }}" - register: _update_ca_trust - changed_when: _update_ca_trust.rc == 0 - failed_when: _update_ca_trust.rc > 0 diff --git a/tasks/root_certificate_authority_import.yaml b/tasks/root_certificate_authority_import.yaml index 5b64b50..dbfb929 100644 --- a/tasks/root_certificate_authority_import.yaml +++ b/tasks/root_certificate_authority_import.yaml @@ -16,4 +16,5 @@ owner: "root" group: "root" mode: "0644" + notify: Update systems SSL/TLS trust store when: certificate_authority_root_ca_tls_crt_content | length > 0 diff --git a/tasks/root_certificate_authority_protected.yaml b/tasks/root_certificate_authority_protected.yaml index 3406577..52b3082 100644 --- a/tasks/root_certificate_authority_protected.yaml +++ b/tasks/root_certificate_authority_protected.yaml @@ -33,3 +33,4 @@ provider: selfsigned selfsigned_not_after: "{{ certificate_authority_root_ca_not_after }}" selfsigned_not_before: "{{ certificate_authority_root_ca_not_before }}" + notify: Update systems SSL/TLS trust store diff --git a/tasks/root_certificate_authority_unprotected.yaml b/tasks/root_certificate_authority_unprotected.yaml index db73f44..a6a7f56 100644 --- a/tasks/root_certificate_authority_unprotected.yaml +++ b/tasks/root_certificate_authority_unprotected.yaml @@ -29,3 +29,4 @@ provider: selfsigned selfsigned_not_after: "{{ certificate_authority_root_ca_not_after }}" selfsigned_not_before: "{{ certificate_authority_root_ca_not_before }}" + notify: Update systems SSL/TLS trust store diff --git a/vars/Archlinux.yaml b/vars/Archlinux.yaml index 6e52599..b154edf 100644 --- a/vars/Archlinux.yaml +++ b/vars/Archlinux.yaml @@ -2,3 +2,6 @@ certificate_authority_python_packages: - python-cryptography + +certificate_authority_trust_store_anchor: "/etc/ca-certificates/trust-source/anchors/{{ certificate_authority_root_ca_common_name | replace(' ', '_') }}.pem" +certificate_authority_trust_store_update_command: "/usr/bin/update-ca-trust" diff --git a/vars/Debian.yaml b/vars/Debian.yaml new file mode 100644 index 0000000..925bdee --- /dev/null +++ b/vars/Debian.yaml @@ -0,0 +1,8 @@ +--- + +certificate_authority_python_packages: +- python3-cryptography + +# Debian based distributions only consider anchors with the file extension crt. +certificate_authority_trust_store_anchor: "/usr/local/share/ca-certificates/{{ certificate_authority_root_ca_common_name | replace(' ', '_') }}.crt" +certificate_authority_trust_store_update_command: "/usr/sbin/update-ca-certificates" diff --git a/vars/RedHat.yaml b/vars/RedHat.yaml new file mode 100644 index 0000000..dafb044 --- /dev/null +++ b/vars/RedHat.yaml @@ -0,0 +1,7 @@ +--- + +certificate_authority_python_packages: +- python3-cryptography + +certificate_authority_trust_store_anchor: "/etc/pki/ca-trust/source/anchors/{{ certificate_authority_root_ca_common_name | replace(' ', '_') }}.pem" +certificate_authority_trust_store_update_command: "/usr/bin/update-ca-trust"