5 Commits

Include renames

Author	SHA1	Message	Date
volker.raschekandCopilot	41d06e4e6d	feat!: apply subject alternative names to root and intermediate CA ... The variables `certificate_authority_root_ca_subject_alternative_names` and `certificate_authority_intermediate_ca_subject_alternative_names` were documented but never referenced by any task, so both CA certificates were always issued without SANs. Wire them into the corresponding CSR tasks and fall back to `omit` when the list is empty. SAN entries are now passed to `openssl_csr` unchanged instead of being prefixed with `DNS:` by the role. This allows other types such as `IP:` or `email:`, which the previous rewrite would have corrupted into values like `DNS:IP:...`. The client tasks additionally dropped `join(',') | quote`, because `quote` performs shell escaping and `openssl_csr` expects a list. Since both client CSR tasks only differed in `subject_alt_name`, they collapse into a single task per file. BREAKING CHANGE: Entries of all `*_subject_alternative_names` variables must now carry their type prefix, for example `DNS:example.local` instead of `example.local`. Co-authored-by: Copilot <copilot@github.com>	2026-09-07 22:28:52 +02:00
volker.raschekandCopilot	38ab2f55bb	fix: drop passphrase from CSR task for unencrypted client key ... This task file is only included when `certificate_authority_client_tls_key_passphrase` is empty, so the private key is created without encryption. Passing the empty passphrase to `openssl_csr` made the module attempt to decrypt an unencrypted key instead of treating it as absent. The sibling CSR task for certificates with SANs already omitted the attribute, so this also aligns both code paths. Co-authored-by: Copilot <copilot@github.com>	2026-09-07 22:28:52 +02:00
volker.raschek	ef2c31e64e	fix: remove state	2025-07-31 19:08:10 +02:00
volker.raschek	1c40b1d59b	feat: support further TLS certification properties	2025-07-31 18:46:19 +02:00
volker.raschek	a0ea59c528	Initial Commit	2025-07-30 22:09:38 +02:00