From ad7b76852bc5d1900681d1f8fc5e524d9f0e99d9 Mon Sep 17 00:00:00 2001 From: Markus Pesch Date: Mon, 7 Sep 2026 15:23:51 +0200 Subject: [PATCH] feat: assert that the signing certificate authority is available Issuing an intermediate certificate authority or a client certificate always signs against the private key of the parent authority, regardless of whether that authority is managed in the same run. With `certificate_authority_root_ca_skip` or `certificate_authority_intermediate_ca_skip` enabled and no previously provisioned key at the configured path, this surfaced as a generic module error deep inside the signing task. Stat the parent private key upfront and assert its presence, so the failure names the missing path and the variables that control it. Skipping the parent remains valid when its key already exists, because the check inspects the file instead of the skip variable. Co-authored-by: Copilot --- tasks/client_certificate.yaml | 17 +++++++++++++++++ tasks/intermediate_certificate_authority.yaml | 17 +++++++++++++++++ 2 files changed, 34 insertions(+) diff --git a/tasks/client_certificate.yaml b/tasks/client_certificate.yaml index e2607af..bd50a48 100644 --- a/tasks/client_certificate.yaml +++ b/tasks/client_certificate.yaml @@ -8,6 +8,23 @@ mode: "0700" state: directory +- name: Verify that the signing intermediate Certificate Authority (CA) is available + when: certificate_authority_client_create is defined and + certificate_authority_client_create + block: + - name: Check private key of the intermediate Certificate Authority (CA) + ansible.builtin.stat: + path: "{{ certificate_authority_intermediate_ca_path }}/privkey.pem" + register: _intermediate_ca_privkey + - name: Assert that the private key of the intermediate Certificate Authority (CA) exists + ansible.builtin.assert: + that: _intermediate_ca_privkey.stat.exists + fail_msg: >- + Signing the client certificate requires + {{ certificate_authority_intermediate_ca_path }}/privkey.pem. Either unset + certificate_authority_intermediate_ca_skip so the intermediate certificate authority is + created or imported, or point certificate_authority_intermediate_ca_path to an existing one. + - name: Create unprotected client certificate ansible.builtin.include_tasks: client_certificate_unprotected.yaml when: certificate_authority_client_create is defined and diff --git a/tasks/intermediate_certificate_authority.yaml b/tasks/intermediate_certificate_authority.yaml index 4d840c0..bca0699 100644 --- a/tasks/intermediate_certificate_authority.yaml +++ b/tasks/intermediate_certificate_authority.yaml @@ -8,6 +8,23 @@ mode: "0700" state: "directory" +- name: Verify that the signing root Certificate Authority (CA) is available + when: certificate_authority_intermediate_ca_create is defined and + certificate_authority_intermediate_ca_create + block: + - name: Check private key of the root Certificate Authority (CA) + ansible.builtin.stat: + path: "{{ certificate_authority_root_ca_path }}/privkey.pem" + register: _root_ca_privkey + - name: Assert that the private key of the root Certificate Authority (CA) exists + ansible.builtin.assert: + that: _root_ca_privkey.stat.exists + fail_msg: >- + Signing the intermediate certificate authority requires + {{ certificate_authority_root_ca_path }}/privkey.pem. Either unset + certificate_authority_root_ca_skip so the root certificate authority is created or + imported, or point certificate_authority_root_ca_path to an existing one. + - name: Create unprotected intermediate Certificate Authority (CA) ansible.builtin.include_tasks: intermediate_certificate_authority_unprotected.yaml when: certificate_authority_intermediate_ca_create is defined and