From 438f3c23b695baf149a7458c75bf0ab2bd0d9aca Mon Sep 17 00:00:00 2001 From: Christian Pointner Date: Tue, 12 Sep 2023 16:12:56 +0200 Subject: x509/(selfsinged|ownca): add renew handling --- roles/x509/ownca/cert/prepare/defaults/main.yml | 2 ++ roles/x509/ownca/cert/prepare/tasks/main.yml | 14 ++++++++++++++ 2 files changed, 16 insertions(+) (limited to 'roles/x509/ownca') diff --git a/roles/x509/ownca/cert/prepare/defaults/main.yml b/roles/x509/ownca/cert/prepare/defaults/main.yml index 89dced63..30241273 100644 --- a/roles/x509/ownca/cert/prepare/defaults/main.yml +++ b/roles/x509/ownca/cert/prepare/defaults/main.yml @@ -4,6 +4,7 @@ ownca_cert_name: "{{ x509_certificate_name | default(ownca_cert_hostnames[0]) }} ownca_cert_base_dir: "/etc/ssl" +ownca_cert_default_renew_margin: "+30d" ownca_cert_config: "{{ x509_certificate_config }}" # ownca_cert_config: # path: "{{ ownca_cert_base_dir }}/{{ ownca_cert_name }}" @@ -52,3 +53,4 @@ ownca_cert_config: "{{ x509_certificate_config }}" # digest: SHA256 # not_before: +0h # not_after: +520w +# renew_margin: +42d diff --git a/roles/x509/ownca/cert/prepare/tasks/main.yml b/roles/x509/ownca/cert/prepare/tasks/main.yml index 6eb3525f..dc8b68a6 100644 --- a/roles/x509/ownca/cert/prepare/tasks/main.yml +++ b/roles/x509/ownca/cert/prepare/tasks/main.yml @@ -47,6 +47,19 @@ extended_key_usage: "{{ ownca_cert_config.cert.extended_key_usage | default(omit) }}" extended_key_usage_critical: "{{ ownca_cert_config.cert.extended_key_usage_critical | default(omit) }}" +- name: check if ownca certificate already exists + stat: + path: "{{ ownca_cert_path }}/{{ ownca_cert_name }}-crt.pem" + register: _ownca_cert_file_ + +- name: check validity of existing ownca certificate + when: _ownca_cert_file_.stat.exists + openssl_certificate_info: + path: "{{ ownca_cert_path }}/{{ ownca_cert_name }}-crt.pem" + valid_at: + renew_margin: "{{ ownca_cert_config.cert.renew_margin | default(ownca_cert_default_renew_margin) }}" + register: _ownca_cert_info_ + - name: generate ownca certificate community.crypto.x509_certificate: path: "{{ ownca_cert_path }}/{{ ownca_cert_name }}-crt.pem" @@ -60,6 +73,7 @@ ownca_digest: "{{ ownca_cert_config.cert.digest | default(omit) }}" ownca_not_before: "{{ ownca_cert_config.cert.not_before | default(omit) }}" ownca_not_after: "{{ ownca_cert_config.cert.not_after | default(omit) }}" + force: "{{ _ownca_cert_file_.stat.exists and (not _ownca_cert_info_.valid_at.renew_margin) }}" notify: reload services for x509 certificates - name: export paths to certificate files -- cgit v1.2.3