primer commit

roles/common/tasks/generate_single_cert.yaml

@@ -0,0 +1,75 @@
+---
+- name: "Generate private key for {{ cert.name }}"
+  community.crypto.openssl_privatekey:
+    path: "{{ koji_pki_dir }}/{{ cert.name }}.key"
+    size: "{{ koji_cert_key_size }}"
+    mode: "{{ koji_pki_private_key_mode }}"
+
+- name: "Generate CSR for {{ cert.name }}"
+  community.crypto.openssl_csr:
+    path: "{{ koji_pki_dir }}/{{ cert.name }}.csr"
+    privatekey_path: "{{ koji_pki_dir }}/{{ cert.name }}.key"
+    common_name: "{{ cert.cn }}"
+    country_name: "{{ koji_cert_country }}"
+    state_or_province_name: "{{ koji_cert_state }}"
+    locality_name: "{{ koji_cert_locality }}"
+    organization_name: "{{ koji_cert_organization }}"
+
+- name: Create temporary OpenSSL config for signing
+  ansible.builtin.copy:
+    dest: "{{ koji_pki_dir }}/openssl-{{ cert.name }}.cnf"
+    content: |
+      [v3_ca]
+      basicConstraints = CA:FALSE
+      keyUsage = nonRepudiation, digitalSignature, keyEncipherment
+      {% if cert.is_server is defined and cert.is_server %}
+      extendedKeyUsage = serverAuth, clientAuth
+      {% else %}
+      extendedKeyUsage = clientAuth
+      {% endif %}
+      subjectAltName = @alt_names
+      [alt_names]
+      DNS.1 = {{ cert.cn }}
+      {% for san in cert.sans|default([]) %}
+      DNS.{{ loop.index + 1 }} = {{ san }}
+      {% endfor %}
+
+- name: "Sign certificate for {{ cert.name }} with our CA"
+  ansible.builtin.shell:
+    cmd: >
+      openssl x509 -req
+      -in {{ koji_pki_dir }}/{{ cert.name }}.csr
+      -CA {{ koji_pki_dir }}/{{ koji_ca_name }}_cert.crt
+      -CAkey {{ koji_pki_dir }}/{{ koji_ca_name }}_cert.key
+      -CAserial {{ koji_pki_dir }}/ca.srl
+      -CAcreateserial
+      -out {{ koji_pki_dir }}/{{ cert.name }}.crt
+      -days {{ koji_cert_expiration_days }}
+      -sha256
+      -extfile {{ koji_pki_dir }}/openssl-{{ cert.name }}.cnf
+      -extensions v3_ca
+    creates: "{{ koji_pki_dir }}/{{ cert.name }}.crt"
+
+- name: "Remove temporary openssl.cnf for {{ cert.name }}"
+  ansible.builtin.file:
+    path: "{{ koji_pki_dir }}/openssl-{{ cert.name }}.cnf"
+    state: absent
+
+
+
+- name: "Generate PKCS12 bundle for user {{ cert.name }}"
+  community.crypto.openssl_pkcs12:
+    action: export
+    path: "{{ koji_pki_dir }}/{{ cert.name }}_browser_cert.p12"
+    privatekey_path: "{{ koji_pki_dir }}/{{ cert.name }}.key"
+    certificate_path: "{{ koji_pki_dir }}/{{ cert.name }}.crt"
+    ca_certificates:
+      - "{{ koji_pki_dir }}/{{ koji_ca_name }}_cert.crt"
+    friendly_name: "{{ cert.name }}"
+    mode: "{{ koji_pki_file_mode }}"
+  when: cert.is_user
+
+- name: "Create PEM file for {{ cert.name }}"
+  ansible.builtin.shell:
+    cmd: "cat {{ koji_pki_dir }}/{{ cert.name }}.crt {{ koji_pki_dir }}/{{ cert.name }}.key > {{ koji_pki_dir }}/{{ cert.name }}.pem"
+    creates: "{{ koji_pki_dir }}/{{ cert.name }}.pem"