issue-host-certificate.yml

---
- name: Issue a certificate for multiple DNS names
  hosts: localhost
  connection: local
  become: true

  # The high-level process for creating a self-hosted certificate authority is:
  # 1. Create a strong private key.
  # 2. Create a signing request using the private key.
  # 3. Self-sign the request to create the certificate authority (CA) root.
  # 4. Create an intermediate certificate signed by the CA root.
  # 5. Use the intermediate certificate to sign everything else.
  #
  # This playbook covers step 5.

  tasks:
  - name: Loading subject info
    include_vars:
      file: subject-info.yml

  - name: Generating a private key
    openssl_privatekey:
      path: "/etc/ssl/private/{{ ansible_hostname }}.{{ ansible_domain }}.key"
      type: RSA
      size: 2048

  - name: Creating directory to store signing request
    file:
      path: /etc/ssl/csrs
      state: directory

  - name: Generating a CSR
    openssl_csr:
      path: "/etc/ssl/csrs/{{ ansible_hostname }}.{{ ansible_domain }}.csr"
      privatekey_path: "/etc/ssl/private/{{ ansible_hostname }}.{{ ansible_domain }}.key"
      country_name: "{{ country }}"
      state_or_province_name: "{{ state_or_province }}"
      locality_name: "{{ locality }}"
      organization_name: "{{ organization }}"
      email_address: "root@{{ ansible_hostname }}.{{ ansible_domain }}"
      common_name: "{{ ansible_hostname }}.{{ ansible_domain }}"
      subject_alt_name:
      - "DNS:{{ ansible_hostname }}.{{ ansible_domain }}"
      - "DNS:{{ ansible_hostname }}"
      - "IP:{{ ansible_default_ipv4.address }}"
      - "DNS:cockpit.{{ ansible_hostname }}.{{ ansible_domain }}"
      - "DNS:esphome.{{ ansible_hostname }}.{{ ansible_domain }}"
      - "DNS:gitea.{{ ansible_hostname }}.{{ ansible_domain }}"
      - "DNS:homeassistant.{{ ansible_hostname }}.{{ ansible_domain }}"
      - "DNS:nextcloud.{{ ansible_hostname }}.{{ ansible_domain }}"
      - "DNS:nodered.{{ ansible_hostname }}.{{ ansible_domain }}"
      - "DNS:portainer.{{ ansible_hostname }}.{{ ansible_domain }}"
      - "DNS:www.{{ ansible_hostname }}.{{ ansible_domain }}"

  - name: Signing the certificate
    openssl_certificate:
      path: "/etc/ssl/certs/{{ ansible_hostname }}.{{ ansible_domain }}.crt"
      csr_path: "/etc/ssl/csrs/{{ ansible_hostname }}.{{ ansible_domain }}.csr"
      ownca_path: "/etc/ssl/certs/{{ organization }}_Root_CA.crt"
      ownca_privatekey_path: "/etc/ssl/private/{{ organization }}_Root_CA.key"
      provider: ownca