From 438f3c23b695baf149a7458c75bf0ab2bd0d9aca Mon Sep 17 00:00:00 2001 From: Christian Pointner Date: Tue, 12 Sep 2023 16:12:56 +0200 Subject: x509/(selfsinged|ownca): add renew handling --- roles/x509/selfsigned/cert/prepare/tasks/main.yml | 14 ++++++++++++++ 1 file changed, 14 insertions(+) (limited to 'roles/x509/selfsigned/cert/prepare/tasks') diff --git a/roles/x509/selfsigned/cert/prepare/tasks/main.yml b/roles/x509/selfsigned/cert/prepare/tasks/main.yml index 72999807..dead5dd5 100644 --- a/roles/x509/selfsigned/cert/prepare/tasks/main.yml +++ b/roles/x509/selfsigned/cert/prepare/tasks/main.yml @@ -47,6 +47,19 @@ extended_key_usage: "{{ selfsigned_cert_config.cert.extended_key_usage | default(omit) }}" extended_key_usage_critical: "{{ selfsigned_cert_config.cert.extended_key_usage_critical | default(omit) }}" +- name: check if selfsigned certificate already exists + stat: + path: "{{ selfsigned_cert_path }}/{{ selfsigned_cert_name }}-crt.pem" + register: _selfsigned_cert_file_ + +- name: check validity of existing selfsigned certificate + when: _selfsigned_cert_file_.stat.exists + openssl_certificate_info: + path: "{{ selfsigned_cert_path }}/{{ selfsigned_cert_name }}-crt.pem" + valid_at: + renew_margin: "{{ selfsigned_cert_config.cert.renew_margin | default(selfsigned_cert_default_renew_margin) }}" + register: _selfsigned_cert_info_ + - name: generate selfsigned certificate community.crypto.x509_certificate: path: "{{ selfsigned_cert_path }}/{{ selfsigned_cert_name }}-crt.pem" @@ -59,6 +72,7 @@ selfsigned_digest: "{{ selfsigned_cert_config.cert.digest | default(omit) }}" selfsigned_not_before: "{{ selfsigned_cert_config.cert.not_before | default(omit) }}" selfsigned_not_after: "{{ selfsigned_cert_config.cert.not_after | default(omit) }}" + force: "{{ _selfsigned_cert_file_.stat.exists and (not _selfsigned_cert_info_.valid_at.renew_margin) }}" notify: reload services for x509 certificates - name: export paths to certificate files -- cgit v1.2.3