33 lines
1 KiB
YAML
33 lines
1 KiB
YAML
- set_fact:
|
|
basepath: "/etc/ssl"
|
|
- set_fact:
|
|
cert_paths:
|
|
csrpath: "{{ basepath + '/' + certname + '.csr' }}"
|
|
keypath: "{{ basepath + '/private/' + certname + '.key' }}"
|
|
certpath: "{{ basepath + '/' + certname + '.crt' }}"
|
|
chainpath: "{{ basepath + '/' + certname + '.chain.crt' }}"
|
|
fullpath: "{{ basepath + '/private/' + certname + '.complete.pem' }}"
|
|
- set_fact:
|
|
cert: "{{ certificates.defaults|combine(cert_paths, certificates.certs[certname]|d({}), {'name': certname} ) }}"
|
|
|
|
- debug:
|
|
verbosity: 1
|
|
var: cert
|
|
|
|
- name: "generate key for {{ certname }}"
|
|
openssl_privatekey:
|
|
path: "{{ cert.keypath }}"
|
|
size: 4096
|
|
type: RSA
|
|
mode: 0640
|
|
owner: root
|
|
group: ssl-cert
|
|
|
|
- name: "generate csr for {{ certname }}"
|
|
openssl_csr:
|
|
path: "{{ cert.csrpath }}"
|
|
privatekey_path: "{{ cert.keypath }}"
|
|
common_name: "{% if cert.cn %}{{ cert.cn }}{% else %}{{ cert.san[0] }}{% endif %}"
|
|
subject_alt_name: "{{ cert.san | map('regex_replace', '^', 'DNS:') | list }}"
|
|
register: task_generate_csr
|
|
|