From 438f3c23b695baf149a7458c75bf0ab2bd0d9aca Mon Sep 17 00:00:00 2001 From: Christian Pointner Date: Tue, 12 Sep 2023 16:12:56 +0200 Subject: x509/(selfsinged|ownca): add renew handling --- roles/x509/selfsigned/cert/prepare/defaults/main.yml | 2 ++ roles/x509/selfsigned/cert/prepare/tasks/main.yml | 14 ++++++++++++++ 2 files changed, 16 insertions(+) (limited to 'roles/x509/selfsigned/cert/prepare') diff --git a/roles/x509/selfsigned/cert/prepare/defaults/main.yml b/roles/x509/selfsigned/cert/prepare/defaults/main.yml index e45343e5..e970684f 100644 --- a/roles/x509/selfsigned/cert/prepare/defaults/main.yml +++ b/roles/x509/selfsigned/cert/prepare/defaults/main.yml @@ -4,6 +4,7 @@ selfsigned_cert_name: "{{ x509_certificate_name | default(selfsigned_cert_hostna selfsigned_cert_base_dir: "/etc/ssl" +selfsigned_cert_default_renew_margin: "+30d" selfsigned_cert_config: "{{ x509_certificate_config }}" # selfsigned_cert_config: # path: "{{ selfsigned_cert_base_dir }}/{{ selfsigned_cert_name }}" @@ -43,3 +44,4 @@ selfsigned_cert_config: "{{ x509_certificate_config }}" # digest: SHA256 # not_before: +0h # not_after: +520w +# renew_margin: +42d diff --git a/roles/x509/selfsigned/cert/prepare/tasks/main.yml b/roles/x509/selfsigned/cert/prepare/tasks/main.yml index 72999807..dead5dd5 100644 --- a/roles/x509/selfsigned/cert/prepare/tasks/main.yml +++ b/roles/x509/selfsigned/cert/prepare/tasks/main.yml @@ -47,6 +47,19 @@ extended_key_usage: "{{ selfsigned_cert_config.cert.extended_key_usage | default(omit) }}" extended_key_usage_critical: "{{ selfsigned_cert_config.cert.extended_key_usage_critical | default(omit) }}" +- name: check if selfsigned certificate already exists + stat: + path: "{{ selfsigned_cert_path }}/{{ selfsigned_cert_name }}-crt.pem" + register: _selfsigned_cert_file_ + +- name: check validity of existing selfsigned certificate + when: _selfsigned_cert_file_.stat.exists + openssl_certificate_info: + path: "{{ selfsigned_cert_path }}/{{ selfsigned_cert_name }}-crt.pem" + valid_at: + renew_margin: "{{ selfsigned_cert_config.cert.renew_margin | default(selfsigned_cert_default_renew_margin) }}" + register: _selfsigned_cert_info_ + - name: generate selfsigned certificate community.crypto.x509_certificate: path: "{{ selfsigned_cert_path }}/{{ selfsigned_cert_name }}-crt.pem" @@ -59,6 +72,7 @@ selfsigned_digest: "{{ selfsigned_cert_config.cert.digest | default(omit) }}" selfsigned_not_before: "{{ selfsigned_cert_config.cert.not_before | default(omit) }}" selfsigned_not_after: "{{ selfsigned_cert_config.cert.not_after | default(omit) }}" + force: "{{ _selfsigned_cert_file_.stat.exists and (not _selfsigned_cert_info_.valid_at.renew_margin) }}" notify: reload services for x509 certificates - name: export paths to certificate files -- cgit v1.2.3