diff options
author | Christian Pointner <equinox@spreadspace.org> | 2023-12-20 13:41:28 +0100 |
---|---|---|
committer | Christian Pointner <equinox@spreadspace.org> | 2023-12-20 13:41:28 +0100 |
commit | 524527ef9da5d64c0f04f70c1f67215967d242a8 (patch) | |
tree | 0697689dda5ae56ba74ac8551eeab37f446b9c95 /roles/x509/managed-ca/cert/prepare/tasks/main.yml | |
parent | x509: add new role managed-ca (diff) |
x509: make ca-certificates accessable for role users
Diffstat (limited to 'roles/x509/managed-ca/cert/prepare/tasks/main.yml')
-rw-r--r-- | roles/x509/managed-ca/cert/prepare/tasks/main.yml | 14 |
1 files changed, 13 insertions, 1 deletions
diff --git a/roles/x509/managed-ca/cert/prepare/tasks/main.yml b/roles/x509/managed-ca/cert/prepare/tasks/main.yml index 97292b04..13dd6096 100644 --- a/roles/x509/managed-ca/cert/prepare/tasks/main.yml +++ b/roles/x509/managed-ca/cert/prepare/tasks/main.yml @@ -70,7 +70,7 @@ renew_margin: "{{ managed_ca_cert_config.cert.renew_margin | default(managed_ca_cert_default_renew_margin) }}" register: _managed_ca_cert_info_ -- name: slurp existing existing managed-ca certificate +- name: slurp existing managed-ca certificate when: _managed_ca_cert_file_.stat.exists slurp: src: "{{ managed_ca_cert_path }}/{{ managed_ca_cert_name }}-crt.pem" @@ -102,12 +102,24 @@ - reload services for x509 certificates - restart services for x509 certificates +- name: slurp managed-ca CA certificate + delegate_to: "{{ managed_ca_cert_config.ca.host }}" + slurp: + src: "/etc/ssl/managed-ca/{{ managed_ca_cert_config.ca.name }}/crt.pem" + register: _managed_ca_ca_cert_ + +- name: install CA certificate + copy: + content: "{{ _managed_ca_ca_cert_.content | b64decode }}" + dest: "{{ managed_ca_cert_path }}/{{ managed_ca_cert_name }}-ca-crt.pem" + - name: export paths to certificate files set_fact: x509_certificate_path_key: "{{ managed_ca_cert_path }}/{{ managed_ca_cert_name }}-key.pem" x509_certificate_path_cert: "{{ managed_ca_cert_path }}/{{ managed_ca_cert_name }}-crt.pem" x509_certificate_path_chain: "" x509_certificate_path_fullchain: "{{ managed_ca_cert_path }}/{{ managed_ca_cert_name }}-crt.pem" + x509_certificate_path_ca_cert: "{{ managed_ca_cert_path }}/{{ managed_ca_cert_name }}-ca-crt.pem" - name: generate custom post-renewal script when: x509_certificate_renewal is defined |