diff options
Diffstat (limited to 'roles/x509/ownca/cert/prepare/tasks/main.yml')
| -rw-r--r-- | roles/x509/ownca/cert/prepare/tasks/main.yml | 14 |
1 files changed, 14 insertions, 0 deletions
diff --git a/roles/x509/ownca/cert/prepare/tasks/main.yml b/roles/x509/ownca/cert/prepare/tasks/main.yml index 6eb3525f..dc8b68a6 100644 --- a/roles/x509/ownca/cert/prepare/tasks/main.yml +++ b/roles/x509/ownca/cert/prepare/tasks/main.yml @@ -47,6 +47,19 @@ extended_key_usage: "{{ ownca_cert_config.cert.extended_key_usage | default(omit) }}" extended_key_usage_critical: "{{ ownca_cert_config.cert.extended_key_usage_critical | default(omit) }}" +- name: check if ownca certificate already exists + stat: + path: "{{ ownca_cert_path }}/{{ ownca_cert_name }}-crt.pem" + register: _ownca_cert_file_ + +- name: check validity of existing ownca certificate + when: _ownca_cert_file_.stat.exists + openssl_certificate_info: + path: "{{ ownca_cert_path }}/{{ ownca_cert_name }}-crt.pem" + valid_at: + renew_margin: "{{ ownca_cert_config.cert.renew_margin | default(ownca_cert_default_renew_margin) }}" + register: _ownca_cert_info_ + - name: generate ownca certificate community.crypto.x509_certificate: path: "{{ ownca_cert_path }}/{{ ownca_cert_name }}-crt.pem" @@ -60,6 +73,7 @@ ownca_digest: "{{ ownca_cert_config.cert.digest | default(omit) }}" ownca_not_before: "{{ ownca_cert_config.cert.not_before | default(omit) }}" ownca_not_after: "{{ ownca_cert_config.cert.not_after | default(omit) }}" + force: "{{ _ownca_cert_file_.stat.exists and (not _ownca_cert_info_.valid_at.renew_margin) }}" notify: reload services for x509 certificates - name: export paths to certificate files |