volker.raschekandCopilot
41d06e4e6d
The variables `certificate_authority_root_ca_subject_alternative_names` and
`certificate_authority_intermediate_ca_subject_alternative_names` were
documented but never referenced by any task, so both CA certificates were always
issued without SANs. Wire them into the corresponding CSR tasks and fall back to
`omit` when the list is empty.
SAN entries are now passed to `openssl_csr` unchanged instead of being prefixed
with `DNS:` by the role. This allows other types such as `IP:` or `email:`,
which the previous rewrite would have corrupted into values like `DNS:IP:...`.
The client tasks additionally dropped `join(',') | quote`, because `quote`
performs shell escaping and `openssl_csr` expects a list.
Since both client CSR tasks only differed in `subject_alt_name`, they collapse
into a single task per file.
BREAKING CHANGE: Entries of all `*_subject_alternative_names` variables must now
carry their type prefix, for example `DNS:example.local` instead of
`example.local`.
Co-authored-by: Copilot <copilot@github.com>
31 lines
1.6 KiB
YAML
31 lines
1.6 KiB
YAML
---
|
|
|
|
- name: Create private key for root CA
|
|
community.crypto.openssl_privatekey:
|
|
path: "{{ certificate_authority_root_ca_path }}/privkey.pem"
|
|
type: "{{ certificate_authority_root_ca_tls_key_type }}"
|
|
|
|
- name: Create a certificate signing request (CSR) for root CA
|
|
community.crypto.openssl_csr:
|
|
basic_constraints:
|
|
- "CA:TRUE"
|
|
common_name: "{{ certificate_authority_root_ca_common_name }}"
|
|
countryName: "{{ certificate_authority_root_ca_country_name }}"
|
|
email_address: "{{ certificate_authority_root_ca_email_address }}"
|
|
organization_name: "{{ certificate_authority_root_ca_organization_name }}"
|
|
organizational_unit_name: "{{ certificate_authority_root_ca_organizational_unit_name }}"
|
|
path: "{{ certificate_authority_root_ca_path }}/cert-req.pem"
|
|
privatekey_path: "{{ certificate_authority_root_ca_path }}/privkey.pem"
|
|
state_or_province_name: "{{ certificate_authority_root_ca_state_or_province_name }}"
|
|
subject_alt_name: "{{ certificate_authority_root_ca_subject_alternative_names if certificate_authority_root_ca_subject_alternative_names | length > 0 else omit }}"
|
|
use_common_name_for_san: false
|
|
|
|
- name: Create self-signed certificate for root CA
|
|
community.crypto.x509_certificate:
|
|
csr_path: "{{ certificate_authority_root_ca_path }}/cert-req.pem"
|
|
path: "{{ certificate_authority_root_ca_path }}/cert.pem"
|
|
privatekey_path: "{{ certificate_authority_root_ca_path }}/privkey.pem"
|
|
provider: selfsigned
|
|
selfsigned_not_after: "{{ certificate_authority_root_ca_not_after }}"
|
|
selfsigned_not_before: "{{ certificate_authority_root_ca_not_before }}"
|