The trust store import hardcoded the RHEL anchor directory and
`update-ca-trust`, although `meta/main.yaml` also declares ArchLinux and Ubuntu
as supported platforms. On those distributions the task created a dangling
symlink outside any trust source and then failed on the missing binary.
Resolve both the anchor path and the update command from a map keyed by
`ansible_facts['os_family']`. Debian based systems additionally require the file
extension `crt`, because `update-ca-certificates` ignores anchors named
otherwise.
Note that the role now depends on gathered facts.
Co-authored-by: Copilot <copilot@github.com>
The variables `certificate_authority_root_ca_subject_alternative_names` and
`certificate_authority_intermediate_ca_subject_alternative_names` were
documented but never referenced by any task, so both CA certificates were always
issued without SANs. Wire them into the corresponding CSR tasks and fall back to
`omit` when the list is empty.
SAN entries are now passed to `openssl_csr` unchanged instead of being prefixed
with `DNS:` by the role. This allows other types such as `IP:` or `email:`,
which the previous rewrite would have corrupted into values like `DNS:IP:...`.
The client tasks additionally dropped `join(',') | quote`, because `quote`
performs shell escaping and `openssl_csr` expects a list.
Since both client CSR tasks only differed in `subject_alt_name`, they collapse
into a single task per file.
BREAKING CHANGE: Entries of all `*_subject_alternative_names` variables must now
carry their type prefix, for example `DNS:example.local` instead of
`example.local`.
Co-authored-by: Copilot <copilot@github.com>
This task file is only included when
`certificate_authority_client_tls_key_passphrase` is empty, so the private key
is created without encryption. Passing the empty passphrase to `openssl_csr`
made the module attempt to decrypt an unencrypted key instead of treating it as
absent. The sibling CSR task for certificates with SANs already omitted the
attribute, so this also aligns both code paths.
Co-authored-by: Copilot <copilot@github.com>
The task importing the client certificate passed
`certificate_authority_client_tls_crt_content` to `dest`, so the PEM payload
itself was interpreted as a directory path. The certificate was written to a
bogus location derived from its own content instead of the configured client
directory. Use `certificate_authority_client_path` as destination, consistent
with the private key import above.
Co-authored-by: Copilot <copilot@github.com>
The task importing the client private key referenced
`certificate_authority_client_ca_path`, a variable that is declared neither in
`defaults/main.yaml` nor in `meta/argument_specs.yaml`. Every run with
`certificate_authority_client_create: false` therefore aborted with an undefined
variable error before the key was written. Use the actual role variable
`certificate_authority_client_path` instead.
Co-authored-by: Copilot <copilot@github.com>
volker.raschekandCopilot