Role to create and install with custom certificates

playbooks/custom_certificates.yml

@@ -0,0 +1,4 @@
+---
+- hosts: all
+  roles:
+    - custom_certificates

playbooks/roles/custom_certificates/defaults/main.yml

@@ -0,0 +1,6 @@
+---
+custom_certificates_ca_directory: /root/custom_certificates
+custom_certificates_ca_directory_keys: "{{ custom_certificates_ca_directory }}/private"
+custom_certificates_ca_directory_certs: "{{ custom_certificates_ca_directory }}/certs"
+custom_certificates_ca_directory_requests: "{{ custom_certificates_ca_directory }}/requests"
+custom_certificates_server: "{{ ansible_fqdn }}"

playbooks/roles/custom_certificates/tasks/main.yml

@@ -0,0 +1,98 @@
+---
+- name: 'Install openssl'
+  yum:
+    name: openssl
+    state: present
+
+- name: 'Create certs directory'
+  file:
+    path: "{{ custom_certificates_ca_directory_certs }}"
+    state: directory
+    mode: 0755
+
+- name: 'Create keys directory'
+  file:
+    path: "{{ custom_certificates_ca_directory_keys }}"
+    state: directory
+    mode: 0755
+
+- name: 'Create requests directory'
+  file:
+    path: "{{ custom_certificates_ca_directory_requests }}"
+    state: directory
+    mode: 0755
+
+- name: 'Deploy configuration file'
+  template:
+    src: openssl.cnf.j2
+    dest: "{{ custom_certificates_ca_directory }}/openssl.cnf"
+    owner: root
+    group: root
+    mode: 0644
+
+- name: 'Create index file'
+  file:
+    path: "{{ custom_certificates_ca_directory }}/index.txt"
+    state: touch
+    owner: root
+    group: root
+    mode: 0644
+
+- name: 'Ensure serial starting number'
+  template:
+    src: serial.j2
+    dest: "{{ custom_certificates_ca_directory }}/serial"
+    force: no
+    owner: root
+    group: root
+    mode: 0644
+
+- name: 'Creating CA certificate and key'
+  command: >
+    openssl req -new
+      -x509
+      -nodes
+      -extensions v3_ca
+      -config "{{ custom_certificates_ca_directory }}/openssl.cnf"
+      -keyout "{{ custom_certificates_ca_directory_keys }}/custom_ca.key"
+      -out "{{ custom_certificates_ca_directory_certs }}/custom_ca.crt"
+  args:
+    creates: "{{ custom_certificates_ca_directory_certs }}/custom_ca.crt"
+
+- name: 'Create server key'
+  command: >
+    openssl genrsa
+      -out "{{ custom_certificates_ca_directory_keys }}/{{ custom_certificates_server }}.key"
+  args:
+    creates: "{{ custom_certificates_ca_directory_keys }}/{{ custom_certificates_server }}.key"
+
+- name: 'Create server signing request'
+  command: >
+    openssl req
+      -new
+      -config "{{ custom_certificates_ca_directory }}/openssl.cnf"
+      -key "{{ custom_certificates_ca_directory_keys }}/{{ custom_certificates_server }}.key"
+      -out "{{ custom_certificates_ca_directory_requests }}/{{ custom_certificates_server }}.csr"
+  args:
+    creates: "{{ custom_certificates_ca_directory_requests }}/{{ custom_certificates_server }}.csr"
+
+- name: 'Create server certificate'
+  command: >
+    openssl ca
+      -create_serial
+      -batch
+      -extensions ssl_server
+      -config "{{ custom_certificates_ca_directory }}/openssl.cnf"
+      -in "{{ custom_certificates_ca_directory_requests }}/{{ custom_certificates_server }}.csr"
+      -out "{{ custom_certificates_ca_directory_certs }}/{{ custom_certificates_server }}.crt"
+  args:
+    creates: "{{ custom_certificates_ca_directory_certs }}/{{ custom_certificates_server }}.crt"
+
+- name: 'Run installer with custom certificates'
+  command: >
+    foreman-installer
+    --scenario katello
+    --certs-server-cert "{{ custom_certificates_ca_directory_certs }}/{{ custom_certificates_server }}.crt"
+    --certs-server-cert-req "{{ custom_certificates_ca_directory_requests }}/{{ custom_certificates_server }}.csr"
+    --certs-server-key "{{ custom_certificates_ca_directory_keys }}/{{ custom_certificates_server }}.key"
+    --certs-server-ca-cert "{{ custom_certificates_ca_directory_certs }}/custom_ca.crt"

playbooks/roles/custom_certificates/templates/openssl.cnf.j2

@@ -0,0 +1,77 @@
+# {{ ansible_managed }}
+#
+#---------------------------------------------------------------------------
+# OpenSSL configuration file.
+
+dir = {{ custom_certificates_ca_directory }}
+
+[ ca ]
+default_ca = CA_default
+x509_extensions	= v3_ca
+
+[ CA_default ]
+serial         = $dir/serial
+database       = $dir/index.txt
+new_certs_dir  = $dir/certs
+private_key    = $dir/private/custom_ca.key
+certificate    = $dir/certs/custom_ca.crt
+default_md     = sha256
+default_days   = 7300
+
+preserve    = no
+email_in_dn = no
+policy      = policy_match
+nameopt     = default_ca
+certopt     = default_ca
+
+unique_subject  = no
+copy_extensions = none
+
+[ policy_match ]
+countryName            = match
+stateOrProvinceName    = match
+organizationName       = match
+organizationalUnitName = optional
+commonName             = supplied
+emailAddress           = optional
+
+[ req ]
+default_bits        = 2048
+default_keyfile     = privkey.pem
+distinguished_name  = req_distinguished_name
+req_extensions      = v3_req
+prompt              = no
+
+[ req_distinguished_name ]
+countryName            = US
+stateOrProvinceName    = NC
+localityName           = Raleigh
+organizationName       = Foreman
+commonName             = {{ ansible_fqdn }}
+
+[ v3_ca ]
+basicConstraints        = CA:TRUE
+subjectKeyIdentifier    = hash
+authorityKeyIdentifier  = keyid:always,issuer:always
+nsCertType              = sslCA
+keyUsage                = cRLSign, keyCertSign
+extendedKeyUsage        = serverAuth, clientAuth
+
+[ v3_req ]
+basicConstraints     = CA:FALSE
+subjectKeyIdentifier = hash
+extendedKeyUsage     = serverAuth, clientAuth
+
+[ ssl_server ]
+basicConstraints        = CA:FALSE
+nsCertType              = server
+keyUsage                = digitalSignature, keyEncipherment
+extendedKeyUsage        = serverAuth, nsSGC, msSGC
+nsComment               = "OpenSSL Certificate for SSL Web Server"
+
+[ ssl_client ]
+basicConstraints        = CA:FALSE
+nsCertType              = client
+keyUsage                = digitalSignature, keyEncipherment
+extendedKeyUsage        = clientAuth
+nsComment               = "OpenSSL Certificate for SSL Client"

playbooks/roles/custom_certificates/templates/serial.j2

@@ -0,0 +1 @@
+1000