Skip to content
This repository was archived by the owner on Jan 5, 2025. It is now read-only.

Commit 35275ed

Browse files
ababraababra
committed
Split tasks
1 parent 1550628 commit 35275ed

File tree

5 files changed

+97
-80
lines changed

5 files changed

+97
-80
lines changed

‎defaults/main.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
---
22
# defaults file for generate-tls-certs
3-
3+
generate_tls_certs: true
44
# Do not put trailing slash "/"
55
cert_dir: ./certs
66
generate_ca_cert: false

‎tasks/generate-ca-cert.yaml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
---
2+
- name: Generate CA private key
3+
local_action:
4+
module: openssl_privatekey
5+
path: "{{cert_dir}}/{{tls_ca_key}}"
6+
size: "{{tls_ca_key_size}}"
7+
run_once: true
8+
9+
- name: Generate self-signed cert for CA
10+
local_action:
11+
module: >
12+
shell openssl req -x509 -new -days {{tls_ca_valid_days}} -sha256 -nodes -key {{cert_dir}}/{{tls_ca_key}} -out {{cert_dir}}/{{tls_ca_cert}}
13+
-subj "{% if tls_ca_country is defined%}/C={{tls_ca_country}}{% endif %}{% if tls_ca_state is defined%}/ST={{tls_ca_state}}{% endif %}{% if tls_ca_locality is defined %}/L={{tls_ca_locality}}{% endif %}{% if tls_ca_organization is defined %}/O={{tls_ca_organization}}{% endif %}{% if tls_ca_organizationalunit is defined %}/OU={{tls_ca_organizationalunit}}{% endif %}/CN={{tls_ca_commonname}}{% if tls_ca_email is defined %}/emailAddress={{tls_ca_email}}{% endif %}"
14+
ignore_errors: true
15+
run_once: true

‎tasks/generate-client-cert.yaml‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
---
2+
3+
- name: Generate client private key
4+
local_action:
5+
module: openssl_privatekey
6+
path: "{{cert_dir}}/{{tls_client_key}}"
7+
size: "{{tls_client_key_size}}"
8+
run_once: true
9+
when: generate_client_cert
10+
11+
- name: Generate CSR and key for client cert
12+
local_action:
13+
module: >
14+
shell openssl req -newkey rsa:{{tls_client_key_size}} -nodes -subj "/CN={{tls_client_commonname}}"
15+
-keyout "{{cert_dir}}/{{tls_client_key}}" -out "{{cert_dir}}/{{tls_client_csr}}"
16+
ignore_errors: true
17+
run_once: true
18+
when: generate_client_cert
19+
20+
- name: Add required extension for client authentication
21+
local_action:
22+
module: >
23+
shell echo extendedKeyUsage = clientAuth >> {{cert_dir}}/{{tls_client_extfile}}
24+
ignore_errors: true
25+
run_once: true
26+
when: generate_client_cert
27+
28+
# @AB TODO: using OpenSSL CA serial file does not always generate unique serial when running playbook against multiple hosts
29+
- name: Sign client cert request with CA
30+
local_action:
31+
module: >
32+
shell openssl x509 -req -sha256 -days {{tls_client_valid_days}} -CA {{cert_dir}}/{{tls_ca_cert}} -CAkey {{cert_dir}}/{{tls_ca_key}}
33+
-set_serial {{ 999999999 | random }} -in {{cert_dir}}/{{tls_client_csr}} -out {{cert_dir}}/{{tls_client_cert}} -extfile {{cert_dir}}/{{tls_client_extfile}}
34+
ignore_errors: true
35+
run_once: true
36+
when: generate_client_cert

‎tasks/generate-server-cert.yaml‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
---
2+
# Generate server cert
3+
- name: Create CSR for server cert
4+
local_action:
5+
module: >
6+
shell openssl req -newkey rsa:{{tls_server_key_size}} -nodes -subj "/CN={{inventory_hostname}}"
7+
-keyout "{{cert_dir}}/{{inventory_hostname_short}}.key" -out "{{cert_dir}}/{{inventory_hostname_short}}.csr"
8+
ignore_errors: true
9+
when: generate_server_cert
10+
11+
- name: Generate certificate extensions file
12+
local_action:
13+
module: template
14+
src: templates/server-cert-extfile.cnf.j2
15+
dest: "{{cert_dir}}/{{inventory_hostname_short}}-extfile.cnf"
16+
when:
17+
- generate_server_cert
18+
- tls_server_enable_san
19+
20+
- name: Sign server cert request by CA
21+
local_action:
22+
module: >
23+
shell openssl x509 -req -sha256 -days {{tls_server_valid_days}}
24+
-CA "{{cert_dir}}/{{tls_ca_cert}}" -CAkey "{{cert_dir}}/{{tls_ca_key}}" -set_serial {{ 999999999 | random }}
25+
-in "{{cert_dir}}/{{inventory_hostname_short}}.csr" -out "{{cert_dir}}/{{inventory_hostname_short}}.pem"
26+
{% if tls_server_enable_san %}-extfile "{{cert_dir}}/{{inventory_hostname_short}}-extfile.cnf"{% endif %}
27+
ignore_errors: true
28+
when: generate_server_cert

‎tasks/main.yml‎

Lines changed: 17 additions & 79 deletions
Original file line numberDiff line numberDiff line change
@@ -1,82 +1,20 @@
11
---
22
# tasks file for generate-tls-certs
33

4-
- name: Generate CA private key
5-
local_action:
6-
module: openssl_privatekey
7-
path: "{{cert_dir}}/{{tls_ca_key}}"
8-
size: "{{tls_ca_key_size}}"
9-
run_once: true
10-
when: generate_ca_cert
11-
12-
- name: Generate self-signed cert for CA
13-
local_action:
14-
module: >
15-
shell openssl req -x509 -new -days {{tls_ca_valid_days}} -sha256 -nodes -key {{cert_dir}}/{{tls_ca_key}} -out {{cert_dir}}/{{tls_ca_cert}}
16-
-subj "{% if tls_ca_country is defined%}/C={{tls_ca_country}}{% endif %}{% if tls_ca_state is defined%}/ST={{tls_ca_state}}{% endif %}{% if tls_ca_locality is defined %}/L={{tls_ca_locality}}{% endif %}{% if tls_ca_organization is defined %}/O={{tls_ca_organization}}{% endif %}{% if tls_ca_organizationalunit is defined %}/OU={{tls_ca_organizationalunit}}{% endif %}/CN={{tls_ca_commonname}}{% if tls_ca_email is defined %}/emailAddress={{tls_ca_email}}{% endif %}"
17-
ignore_errors: true
18-
run_once: true
19-
when: generate_ca_cert
20-
21-
- name: Generate client private key
22-
local_action:
23-
module: openssl_privatekey
24-
path: "{{cert_dir}}/{{tls_client_key}}"
25-
size: "{{tls_client_key_size}}"
26-
run_once: true
27-
when: generate_client_cert
28-
29-
- name: Generate CSR and key for client cert
30-
local_action:
31-
module: >
32-
shell openssl req -newkey rsa:{{tls_client_key_size}} -nodes -subj "/CN={{tls_client_commonname}}"
33-
-keyout "{{cert_dir}}/{{tls_client_key}}" -out "{{cert_dir}}/{{tls_client_csr}}"
34-
ignore_errors: true
35-
run_once: true
36-
when: generate_client_cert
37-
38-
- name: Add required extension for client authentication
39-
local_action:
40-
module: >
41-
shell echo extendedKeyUsage = clientAuth >> {{cert_dir}}/{{tls_client_extfile}}
42-
ignore_errors: true
43-
run_once: true
44-
when: generate_client_cert
45-
46-
# @AB TODO: using OpenSSL CA serial file does not always generate unique serial when running playbook against multiple hosts
47-
- name: Sign client cert request with CA
48-
local_action:
49-
module: >
50-
shell openssl x509 -req -sha256 -days {{tls_client_valid_days}} -CA {{cert_dir}}/{{tls_ca_cert}} -CAkey {{cert_dir}}/{{tls_ca_key}}
51-
-set_serial {{ 999999999 | random }} -in {{cert_dir}}/{{tls_client_csr}} -out {{cert_dir}}/{{tls_client_cert}} -extfile {{cert_dir}}/{{tls_client_extfile}}
52-
ignore_errors: true
53-
run_once: true
54-
when: generate_client_cert
55-
56-
# Generate server cert
57-
- name: Create CSR for server cert
58-
local_action:
59-
module: >
60-
shell openssl req -newkey rsa:{{tls_server_key_size}} -nodes -subj "/CN={{inventory_hostname}}"
61-
-keyout "{{cert_dir}}/{{inventory_hostname_short}}.key" -out "{{cert_dir}}/{{inventory_hostname_short}}.csr"
62-
ignore_errors: true
63-
when: generate_server_cert
64-
65-
- name: Generate certificate extensions file
66-
local_action:
67-
module: template
68-
src: templates/server-cert-extfile.cnf.j2
69-
dest: "{{cert_dir}}/{{inventory_hostname_short}}-extfile.cnf"
70-
when:
71-
- generate_server_cert
72-
- tls_server_enable_san
73-
74-
- name: Sign server cert request by CA
75-
local_action:
76-
module: >
77-
shell openssl x509 -req -sha256 -days {{tls_server_valid_days}}
78-
-CA "{{cert_dir}}/{{tls_ca_cert}}" -CAkey "{{cert_dir}}/{{tls_ca_key}}" -set_serial {{ 999999999 | random }}
79-
-in "{{cert_dir}}/{{inventory_hostname_short}}.csr" -out "{{cert_dir}}/{{inventory_hostname_short}}.pem"
80-
{% if tls_server_enable_san %}-extfile "{{cert_dir}}/{{inventory_hostname_short}}-extfile.cnf"{% endif %}
81-
ignore_errors: true
82-
when: generate_server_cert
4+
- name: Generate CA cert
5+
import_tasks: generate-ca-cert.yaml
6+
when:
7+
- generate_tls_certs
8+
- generate_ca_cert|bool
9+
10+
- name: Generate client cert
11+
import_tasks: generate-client-cert.yaml
12+
when:
13+
- generate_tls_certs
14+
- generate_client_cert|bool
15+
16+
- name: Generate server cert
17+
import_tasks: generate-server-cert.yaml
18+
when:
19+
- generate_tls_certs
20+
- generate_server_cert|bool

0 commit comments

Comments
 (0)