fix(root_ca): set passphrase correctly

.gitea/workflows/ansible-linters.yaml

@@ -14,7 +14,7 @@ jobs:
     steps:
     - uses: actions/checkout@v4
     - name: Run ansible-lint
-      uses: ansible/ansible-lint@v25.7.0
+      uses: ansible/ansible-lint@v25.6.1
       with:
         args: "--config-file .ansible-lint"
         setup_python: "true"

tasks/client_certificate_protected.yaml

@@ -5,6 +5,7 @@
     path: "{{ certificate_authority_client_path }}/privkey.pem"
     type: "{{ certificate_authority_client_tls_key_type }}"
     passphrase: "{{ certificate_authority_client_tls_key_passphrase }}"
+    cipher: auto
 
 - name: Create a certificate signing request (CSR) for client certificate without subject alternative names (SANs)
   community.crypto.openssl_csr:

tasks/intermediate_certificate_authority.yaml

@@ -16,7 +16,7 @@
         certificate_authority_intermediate_ca_tls_key_passphrase | length <= 0
 
 - name: Create passphrase protected intermediate Certificate Authority (CA)
-  ansible.builtin.include_tasks: intermediate_certificate_authority_unprotected.yaml
+  ansible.builtin.include_tasks: intermediate_certificate_authority_protected.yaml
   when: certificate_authority_intermediate_ca_create is defined and
         certificate_authority_intermediate_ca_create and
         certificate_authority_intermediate_ca_tls_key_passphrase is defined and

tasks/intermediate_certificate_authority_protected.yaml

@@ -5,6 +5,7 @@
     passphrase: "{{ certificate_authority_intermediate_ca_tls_key_passphrase }}"
     path: "{{ certificate_authority_intermediate_ca_path }}/privkey.pem"
     type: "{{ certificate_authority_intermediate_ca_tls_key_type }}"
+    cipher: auto
 
 - name: Create a certificate signing request (CSR) for intermediate CA
   community.crypto.openssl_csr:

tasks/root_certificate_authority.yaml

@@ -16,7 +16,7 @@
         certificate_authority_root_ca_tls_key_passphrase | length <= 0
 
 - name: Create passphrase protected root Certificate Authority (CA)
-  ansible.builtin.include_tasks: root_certificate_authority_unprotected.yaml
+  ansible.builtin.include_tasks: root_certificate_authority_protected.yaml
   when: certificate_authority_root_ca_create is defined and
         certificate_authority_root_ca_create and
         certificate_authority_root_ca_tls_key_passphrase is defined and

tasks/root_certificate_authority_protected.yaml

@@ -5,6 +5,7 @@
     passphrase: "{{ certificate_authority_root_ca_tls_key_passphrase }}"
     path: "{{ certificate_authority_root_ca_path }}/privkey.pem"
     type: "{{ certificate_authority_root_ca_tls_key_type }}"
+    cipher: auto
 
 - name: Create a certificate signing request (CSR) for root CA
   community.crypto.openssl_csr:
@@ -13,6 +14,7 @@
     common_name: "{{ certificate_authority_root_ca_common_name }}"
     path: "{{ certificate_authority_root_ca_path }}/cert-req.pem"
     privatekey_path: "{{ certificate_authority_root_ca_path }}/privkey.pem"
+    privatekey_passphrase: "{{ certificate_authority_root_ca_tls_key_passphrase }}"
     use_common_name_for_san: false
 
 - name: Create self-signed certificate for root CA