ca.yml

---
- name: 'Check if CA certificate exists'
  ansible.builtin.stat:
    path: "{{ certificates_ca_directory_certs }}/ca.crt"
  register: _certificates_ca_cert

- name: 'Check for an existing CA key'
  ansible.builtin.stat:
    path: "{{ certificates_ca_directory_keys }}/ca.key"
  register: _certificates_existing_ca_key

- name: 'Detect whether the existing CA key is password-encrypted'
  ansible.builtin.command:
    cmd: "grep -q ENCRYPTED {{ certificates_ca_directory_keys }}/ca.key"
  register: _certificates_ca_key_encrypted
  changed_when: false
  failed_when: false
  when: _certificates_existing_ca_key.stat.exists

- name: 'Decrypt a legacy password-encrypted CA key in place'
  community.crypto.openssl_privatekey_convert:
    src_path: "{{ certificates_ca_directory_keys }}/ca.key"
    src_passphrase: "{{ certificates_ca_password }}"
    dest_path: "{{ certificates_ca_directory_keys }}/ca.key"
    format: pkcs8
    mode: '0600'
  when:
    - _certificates_existing_ca_key.stat.exists
    - (_certificates_ca_key_encrypted.rc | default(1)) == 0
  no_log: true

- name: 'Remove the obsolete CA key password file'
  ansible.builtin.file:
    path: "{{ certificates_ca_directory_keys }}/ca.pwd"
    state: absent

- name: 'Generate CA'
  when:
    - (not _certificates_ca_cert.stat.exists or certificates_renew_ca)
  block:
    - name: 'Create CA private key'
      community.crypto.openssl_privatekey:
        path: "{{ certificates_ca_directory_keys }}/ca.key"
        type: "{{ certificates_algorithm_type }}"
        size: "{{ certificates_algorithm_size }}"
        owner: root
        group: root
        mode: '0600'

    - name: 'Create CA certificate signing request'
      community.crypto.openssl_csr:
        path: "{{ certificates_ca_directory_requests }}/ca.csr"
        privatekey_path: "{{ certificates_ca_directory_keys }}/ca.key"
        common_name: "{{ certificates_ca_subject }}"
        use_common_name_for_san: false
        basic_constraints:
          - 'CA:TRUE'
        basic_constraints_critical: true
        key_usage:
          - keyCertSign
          - cRLSign
          - digitalSignature
        key_usage_critical: true
        create_subject_key_identifier: true

    - name: 'Create self-signed CA certificate'
      community.crypto.x509_certificate:
        path: "{{ certificates_ca_directory_certs }}/ca.crt"
        csr_path: "{{ certificates_ca_directory_requests }}/ca.csr"
        privatekey_path: "{{ certificates_ca_directory_keys }}/ca.key"
        provider: selfsigned
        selfsigned_not_after: "+{{ certificates_ca_validity_days }}d"
        force: "{{ certificates_renew_ca | bool }}"

    - name: 'Copy CA as server CA certificate'
      ansible.builtin.copy:
        src: "{{ certificates_ca_directory_certs }}/ca.crt"
        dest: "{{ certificates_ca_directory_certs }}/server-ca.crt"
        remote_src: true
        force: "{{ certificates_renew_ca | bool }}"
        mode: '0444'

    - name: 'Create CA bundle'
      ansible.builtin.copy:
        src: "{{ certificates_ca_directory_certs }}/ca.crt"
        dest: "{{ certificates_ca_directory_certs }}/ca-bundle.crt"
        remote_src: true
        force: "{{ certificates_renew_ca | bool }}"
        mode: '0444'