74 lines
2 KiB
YAML
74 lines
2 KiB
YAML
|
---
|
||
|
|
- set_fact:
|
||
|
|
certificates:
|
||
|
|
- name: ca
|
||
|
|
subject:
|
||
|
|
commonName: Ansible
|
||
|
|
is_ca: yes
|
||
|
|
- name: ca-2
|
||
|
|
subject:
|
||
|
|
commonName: Ansible Other CA
|
||
|
|
is_ca: yes
|
||
|
|
- name: cert-1
|
||
|
|
subject_alt_name:
|
||
|
|
- DNS:ansible.com
|
||
|
|
- name: cert-2
|
||
|
|
subject_alt_name:
|
||
|
|
- DNS:example.com
|
||
|
|
- name: cert-3
|
||
|
|
subject_alt_name:
|
||
|
|
- DNS:example.org
|
||
|
|
- IP:1.2.3.4
|
||
|
|
- name: cert-4
|
||
|
|
subject_alt_name:
|
||
|
|
- DNS:test.ansible.com
|
||
|
|
- DNS:b64.ansible.com
|
||
|
|
|
||
|
|
- name: Generate private keys
|
||
|
|
openssl_privatekey:
|
||
|
|
path: '{{ output_dir }}/{{ item.name }}.key'
|
||
|
|
type: ECC
|
||
|
|
curve: secp256r1
|
||
|
|
loop: "{{ certificates }}"
|
||
|
|
|
||
|
|
- name: Generate CSRs
|
||
|
|
openssl_csr:
|
||
|
|
path: '{{ output_dir }}/{{ item.name }}.csr'
|
||
|
|
privatekey_path: '{{ output_dir }}/{{ item.name }}.key'
|
||
|
|
subject: "{{ item.subject | default(omit) }}"
|
||
|
|
subject_alt_name: "{{ item.subject_alt_name | default(omit) }}"
|
||
|
|
basic_constraints: "{{ 'CA:TRUE' if item.is_ca | default(false) else omit }}"
|
||
|
|
use_common_name_for_san: no
|
||
|
|
loop: "{{ certificates }}"
|
||
|
|
|
||
|
|
- name: Generate CA certificates
|
||
|
|
openssl_certificate:
|
||
|
|
path: '{{ output_dir }}/{{ item.name }}.pem'
|
||
|
|
csr_path: '{{ output_dir }}/{{ item.name }}.csr'
|
||
|
|
privatekey_path: '{{ output_dir }}/{{ item.name }}.key'
|
||
|
|
provider: selfsigned
|
||
|
|
loop: "{{ certificates }}"
|
||
|
|
when: item.is_ca | default(false)
|
||
|
|
|
||
|
|
- name: Generate other certificates
|
||
|
|
openssl_certificate:
|
||
|
|
path: '{{ output_dir }}/{{ item.name }}.pem'
|
||
|
|
csr_path: '{{ output_dir }}/{{ item.name }}.csr'
|
||
|
|
provider: ownca
|
||
|
|
ownca_path: '{{ output_dir }}/ca.pem'
|
||
|
|
ownca_privatekey_path: '{{ output_dir }}/ca.key'
|
||
|
|
loop: "{{ certificates }}"
|
||
|
|
when: not (item.is_ca | default(false))
|
||
|
|
|
||
|
|
- block:
|
||
|
|
- name: Running tests with cryptography backend
|
||
|
|
include_tasks: impl.yml
|
||
|
|
vars:
|
||
|
|
select_crypto_backend: cryptography
|
||
|
|
|
||
|
|
- import_tasks: ../tests/validate.yml
|
||
|
|
vars:
|
||
|
|
select_crypto_backend: cryptography
|
||
|
|
|
||
|
|
when: cryptography_version.stdout is version('1.2', '>=')
|