volker.raschekandCopilot
95ea71394e
The pki directories were created with mode 0700, so cert.pem, chain.pem and fullchain.pem stayed unreachable for every non root process although they are declared as 0644. That defeats the main purpose of the role, which is handing a certificate to a service such as nginx or postgres. The directories are opened up to 0755. To keep that safe, the mode of the private keys is now pinned explicitly to 0600 instead of relying on the default of community.crypto.openssl_privatekey. Co-authored-by: Copilot <copilot@github.com>
53 lines
3.2 KiB
YAML
53 lines
3.2 KiB
YAML
---
|
|
|
|
- name: Create private key for intermediate CA
|
|
community.crypto.openssl_privatekey:
|
|
passphrase: "{{ certificate_authority_intermediate_ca_tls_key_passphrase }}"
|
|
path: "{{ certificate_authority_intermediate_ca_path }}/privkey.pem"
|
|
mode: "0600"
|
|
type: "{{ certificate_authority_intermediate_ca_tls_key_type }}"
|
|
cipher: auto
|
|
|
|
- name: Create a certificate signing request (CSR) for intermediate CA
|
|
community.crypto.openssl_csr:
|
|
basic_constraints:
|
|
- "CA:TRUE"
|
|
common_name: "{{ certificate_authority_intermediate_ca_common_name }}"
|
|
countryName: "{{ certificate_authority_intermediate_ca_country_name }}"
|
|
email_address: "{{ certificate_authority_intermediate_ca_email_address }}"
|
|
organization_name: "{{ certificate_authority_intermediate_ca_organization_name }}"
|
|
organizational_unit_name: "{{ certificate_authority_intermediate_ca_organizational_unit_name }}"
|
|
path: "{{ certificate_authority_intermediate_ca_path }}/cert-req.pem"
|
|
privatekey_passphrase: "{{ certificate_authority_intermediate_ca_tls_key_passphrase }}"
|
|
privatekey_path: "{{ certificate_authority_intermediate_ca_path }}/privkey.pem"
|
|
state_or_province_name: "{{ certificate_authority_intermediate_ca_state_or_province_name }}"
|
|
subject_alt_name: "{{ certificate_authority_intermediate_ca_subject_alternative_names if certificate_authority_intermediate_ca_subject_alternative_names | length > 0 else omit }}"
|
|
use_common_name_for_san: false
|
|
|
|
- name: Create signed client certificate - unprotected root Certificate Authority (CA)
|
|
community.crypto.x509_certificate:
|
|
csr_path: "{{ certificate_authority_intermediate_ca_path }}/cert-req.pem"
|
|
ownca_not_after: "{{ certificate_authority_intermediate_ca_not_after }}"
|
|
ownca_not_before: "{{ certificate_authority_intermediate_ca_not_before }}"
|
|
ownca_path: "{{ certificate_authority_root_ca_path }}/cert.pem"
|
|
ownca_privatekey_path: "{{ certificate_authority_root_ca_path }}/privkey.pem"
|
|
path: "{{ certificate_authority_intermediate_ca_path }}/cert.pem"
|
|
privatekey_passphrase: "{{ certificate_authority_intermediate_ca_tls_key_passphrase }}"
|
|
provider: ownca
|
|
when: certificate_authority_root_ca_tls_key_passphrase is defined and
|
|
certificate_authority_root_ca_tls_key_passphrase | length <= 0
|
|
|
|
- name: Create signed client certificate - passphrase protected root Certificate Authority (CA)
|
|
community.crypto.x509_certificate:
|
|
csr_path: "{{ certificate_authority_intermediate_ca_path }}/cert-req.pem"
|
|
ownca_not_after: "{{ certificate_authority_intermediate_ca_not_after }}"
|
|
ownca_not_before: "{{ certificate_authority_intermediate_ca_not_before }}"
|
|
ownca_path: "{{ certificate_authority_root_ca_path }}/cert.pem"
|
|
ownca_privatekey_passphrase: "{{ certificate_authority_root_ca_tls_key_passphrase }}"
|
|
ownca_privatekey_path: "{{ certificate_authority_root_ca_path }}/privkey.pem"
|
|
path: "{{ certificate_authority_intermediate_ca_path }}/cert.pem"
|
|
privatekey_passphrase: "{{ certificate_authority_intermediate_ca_tls_key_passphrase }}"
|
|
provider: ownca
|
|
when: certificate_authority_root_ca_tls_key_passphrase is defined and
|
|
certificate_authority_root_ca_tls_key_passphrase | length > 0
|