foremanctl/src/roles/certificates/tasks/issue.yml at 4dc837c154b1eeac0f535b3f5463244f8664d979 · theforeman/foremanctl · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
---
- name: Issue server certificate
  when:
    - (certificates_source != 'custom_server') or (certificates_hostname == 'localhost')
  block:
    - name: 'Create server private key'
      community.crypto.openssl_privatekey:
        path: "{{ certificates_output_directory_keys }}/{{ certificates_hostname }}.key"
        type: "{{ certificates_algorithm_type }}"
        size: "{{ certificates_algorithm_size }}"
        mode: '0600'

    - name: 'Create server CSR'
      community.crypto.openssl_csr:
        path: "{{ certificates_output_directory_requests }}/{{ certificates_hostname }}.csr"
        privatekey_path: "{{ certificates_output_directory_keys }}/{{ certificates_hostname }}.key"
        common_name: "{{ certificates_hostname }}"
        subject_alt_name: "{{ _certificates_desired_server_sans }}"
        key_usage:
          - digitalSignature
          - keyEncipherment
        extended_key_usage:
          - serverAuth
      vars:
        _certificates_extra_sans: "{{ certificates_cnames if certificates_hostname != 'localhost' else [] }}"
        _certificates_desired_server_sans: "{{ ([certificates_hostname] + _certificates_extra_sans) | map('regex_replace', '^', 'DNS:') | list }}"

    - name: 'Sign server certificate'
      community.crypto.x509_certificate:
        path: "{{ certificates_output_directory_certs }}/{{ certificates_hostname }}.crt"
        csr_path: "{{ certificates_output_directory_requests }}/{{ certificates_hostname }}.csr"
        provider: ownca
        ownca_path: "{{ certificates_ca_directory_certs }}/ca.crt"
        ownca_privatekey_path: "{{ certificates_ca_directory_keys }}/ca.key"
        ownca_not_after: "+{{ certificates_validity_days }}d"
        force: "{{ certificates_renew | bool }}"

- name: 'Create client private key'
  community.crypto.openssl_privatekey:
    path: "{{ certificates_output_directory_keys }}/{{ certificates_hostname }}-client.key"
    type: "{{ certificates_algorithm_type }}"
    size: "{{ certificates_algorithm_size }}"
    mode: '0600'

- name: 'Create client CSR'
  community.crypto.openssl_csr:
    path: "{{ certificates_output_directory_requests }}/{{ certificates_hostname }}-client.csr"
    privatekey_path: "{{ certificates_output_directory_keys }}/{{ certificates_hostname }}-client.key"
    common_name: "{{ certificates_hostname }}"
    subject_alt_name:
      - "DNS:{{ certificates_hostname }}"
    key_usage:
      - digitalSignature
      - keyEncipherment
    extended_key_usage:
      - clientAuth

- name: 'Sign client certificate'
  community.crypto.x509_certificate:
    path: "{{ certificates_output_directory_certs }}/{{ certificates_hostname }}-client.crt"
    csr_path: "{{ certificates_output_directory_requests }}/{{ certificates_hostname }}-client.csr"
    provider: ownca
    ownca_path: "{{ certificates_ca_directory }}/certs/ca.crt"
    ownca_privatekey_path: "{{ certificates_ca_directory }}/private/ca.key"
    ownca_not_after: "+{{ certificates_validity_days }}d"
    force: "{{ certificates_renew | bool }}"