---
- name: "Generate private key for {{ cert.name }}"
  community.crypto.openssl_privatekey:
    path: "{{ koji_pki_dir }}/{{ cert.name }}.key"
    size: "{{ koji_cert_key_size }}"
    mode: "{{ koji_pki_private_key_mode }}"

- name: "Generate CSR for {{ cert.name }}"
  community.crypto.openssl_csr:
    path: "{{ koji_pki_dir }}/{{ cert.name }}.csr"
    privatekey_path: "{{ koji_pki_dir }}/{{ cert.name }}.key"
    common_name: "{{ cert.cn }}"
    country_name: "{{ koji_cert_country }}"
    state_or_province_name: "{{ koji_cert_state }}"
    locality_name: "{{ koji_cert_locality }}"
    organization_name: "{{ koji_cert_organization }}"

- name: Create temporary OpenSSL config for signing
  ansible.builtin.copy:
    dest: "{{ koji_pki_dir }}/openssl-{{ cert.name }}.cnf"
    mode: "0644"
    content: |
      [v3_ca]
      basicConstraints = CA:FALSE
      keyUsage = nonRepudiation, digitalSignature, keyEncipherment
      {% if cert.is_server is defined and cert.is_server %}
      extendedKeyUsage = serverAuth, clientAuth
      {% else %}
      extendedKeyUsage = clientAuth
      {% endif %}
      subjectAltName = @alt_names
      [alt_names]
      DNS.1 = {{ cert.cn }}
      {% for san in cert.sans | default([]) %}
      DNS.{{ loop.index + 1 }} = {{ san }}
      {% endfor %}

- name: "Sign certificate with our CA"
  ansible.builtin.shell:
    cmd: >
      openssl x509 -req
      -in {{ koji_pki_dir }}/{{ cert.name }}.csr
      -CA {{ koji_pki_dir }}/{{ koji_ca_name }}_cert.crt
      -CAkey {{ koji_pki_dir }}/{{ koji_ca_name }}_cert.key
      -CAserial {{ koji_pki_dir }}/ca.srl
      -CAcreateserial
      -out {{ koji_pki_dir }}/{{ cert.name }}.crt
      -days {{ koji_cert_expiration_days }}
      -sha256
      -extfile {{ koji_pki_dir }}/openssl-{{ cert.name }}.cnf
      -extensions v3_ca
    creates: "{{ koji_pki_dir }}/{{ cert.name }}.crt"

- name: "Remove temporary openssl.cnf for {{ cert.name }}"
  ansible.builtin.file:
    path: "{{ koji_pki_dir }}/openssl-{{ cert.name }}.cnf"
    state: absent

- name: "Generate PKCS12 bundle for user {{ cert.name }}"
  community.crypto.openssl_pkcs12:
    action: export
    path: "{{ koji_pki_dir }}/{{ cert.name }}_browser_cert.p12"
    privatekey_path: "{{ koji_pki_dir }}/{{ cert.name }}.key"
    certificate_path: "{{ koji_pki_dir }}/{{ cert.name }}.crt"
    ca_certificates:
      - "{{ koji_pki_dir }}/{{ koji_ca_name }}_cert.crt"
    friendly_name: "{{ cert.name }}"
    mode: "{{ koji_pki_file_mode }}"
  when: cert.is_user

- name: "Create PEM file for {{ cert.name }}"
  ansible.builtin.shell:
    cmd: "cat {{ koji_pki_dir }}/{{ cert.name }}.crt {{ koji_pki_dir }}/{{ cert.name }}.key > {{ koji_pki_dir }}/{{ cert.name }}.pem"
    creates: "{{ koji_pki_dir }}/{{ cert.name }}.pem"