diff options
author | Christian Pointner <equinox@spreadspace.org> | 2021-11-16 21:16:00 +0100 |
---|---|---|
committer | Christian Pointner <equinox@spreadspace.org> | 2021-11-16 21:16:00 +0100 |
commit | 42220a14f9fb4a6e16a0c00a5839c0a0e831be4d (patch) | |
tree | 4b8f6d98115ce34d4afa3d04f8e9c624cfd7e26a /roles/network/openvpn/ca/tasks | |
parent | fix virt-manager spice support (diff) |
openvpn roles - bas scaffolding and certs
Diffstat (limited to 'roles/network/openvpn/ca/tasks')
-rw-r--r-- | roles/network/openvpn/ca/tasks/main.yml | 52 |
1 files changed, 52 insertions, 0 deletions
diff --git a/roles/network/openvpn/ca/tasks/main.yml b/roles/network/openvpn/ca/tasks/main.yml new file mode 100644 index 00000000..90b021fc --- /dev/null +++ b/roles/network/openvpn/ca/tasks/main.yml @@ -0,0 +1,52 @@ +--- +- name: install python-cryptoraphy + apt: + name: "{{ python_basename }}-cryptography" + state: present + +- name: create base directory + file: + path: "/etc/ssl/openvpn/{{ openvpn_zone.name }}" + state: directory + +- name: create CA directory + file: + path: "/etc/ssl/openvpn/{{ openvpn_zone.name }}/ca" + state: directory + owner: root + group: root + mode: 0700 + +- name: create CA private key + openssl_privatekey: + path: "/etc/ssl/openvpn/{{ openvpn_zone.name }}/ca/key.pem" + type: RSA + size: 4096 + owner: root + group: root + mode: 0600 + +- name: create signing request for CA certificate + openssl_csr: + path: "/etc/ssl/openvpn/{{ openvpn_zone.name }}/ca/csr.pem" + privatekey_path: "/etc/ssl/openvpn/{{ openvpn_zone.name }}/ca/key.pem" + CN: "CA for OpenVPN zone {{ openvpn_zone.name }}" + useCommonNameForSAN: no + key_usage: + - cRLSign + - keyCertSign + key_usage_critical: yes + basic_constraints: + - 'CA:TRUE' + - 'pathlen:0' + basic_constraints_critical: yes + +- name: create self-signed CA certificate + openssl_certificate: + path: "/etc/ssl/openvpn/{{ openvpn_zone.name }}/ca-crt.pem" + csr_path: "/etc/ssl/openvpn/{{ openvpn_zone.name }}/ca/csr.pem" + privatekey_path: "/etc/ssl/openvpn/{{ openvpn_zone.name }}/ca/key.pem" + provider: selfsigned + selfsigned_digest: sha256 + selfsigned_not_after: "+18250d" ## 50 years + selfsigned_create_subject_key_identifier: always_create |