ansible-role-generate-tls-c.../tasks/generate-client-cert.yaml

88 lines
2.3 KiB
YAML
Raw Normal View History

2018-04-22 11:02:16 +02:00
---
- name: Ensure the custom directories to host certificates are present
become: yes
file:
state: directory
recurse: yes
path: "/etc/ssl/{{ item.path }}"
mode: "{{ item.mode }}"
owner: root
group: root
loop:
- {path: local/certs, mode: "0755"}
- {path: local/private, mode: "0700"}
2018-04-22 11:02:16 +02:00
- name: Check if the client private key exists
delegate_to: localhost
stat:
path: "{{ cert_dir }}/{{ tls_client_key }}"
register: client_key
- name: Generate client private key
delegate_to: localhost
community.crypto.openssl_privatekey:
path: "{{ cert_dir }}/{{ tls_client_key }}"
size: "{{ tls_client_key_size}}"
when:
- not client_key.stat.exists
- generate_client_cert
register: client_key_file
- name: Copy the key on the server
become: yes
copy:
src: "{{ cert_dir }}/{{ tls_client_key}}"
dest: /etc/ssl/local/certs/
mode: 0644
owner: root
group: root
when: client_key_file.changed
- name: Check if the client CSR exists
delegate_to: localhost
stat:
path: "{{ cert_dir }}/{{ tls_client_csr }}"
register: client_csr
- name: Generate CSR and key for client cert
delegate_to: localhost
community.crypto.openssl_csr:
path: "{{ cert_dir }}/{{ tls_client_csr }}"
privatekey_path: "{{ cert_dir }}/{{ tls_client_key }}"
common_name: "{{ tls_client_commonname }}"
extended_key_usage:
- clientAuth
when:
- not client_csr.stat.exists
- generate_client_cert
- name: Check if the client cert exists
delegate_to: localhost
stat:
path: "{{ cert_dir }}/{{ tls_client_cert }}"
register: client_crt
- name: Create and sign server cert request by CA
delegate_to: localhost
community.crypto.x509_certificate:
path: "{{ cert_dir }}/{{ tls_client_cert }}"
csr_path: "{{ cert_dir }}/{{ tls_client_csr }}"
ownca_not_after: "+{{ tls_client_valid_days }}d"
ownca_path: "{{ cert_dir }}/{{ tls_ca_cert }}"
ownca_privatekey_path: "{{ cert_dir }}/{{ tls_ca_key }}"
provider: ownca
when:
- not client_crt.stat.exists
- generate_client_cert
register: client_cert_file
- name: Copy the certificate to the remote machine
become: yes
copy:
src: "{{ cert_dir }}/{{ tls_client_cert }}"
dest: /etc/ssl/local/private
mode: 0600
owner: root
group: root
when: client_cert_file.changed