Add verify_cert roles for TLS certificate verification for IAG5

[Amunagala-itential]

Summary

Adds a playbook and three Ansible roles that verify TLS certificate configuration across all IAG5 node types after deployment. Runs against live nodes, reads actual gateway.conf files, and performs live TLS handshakes.

Role	Runs on	Condition
verify_cert_cluster_server_to_runner	Server + Runner	gateway_server_use_tls: true
verify_cert_cluster_client_to_server	Client + Server	gateway_client_use_tls: true
verify_cert_connect_server_to_gwm	Server only	gateway_server_use_tls: true

playbooks/verify_cert.yml is imported automatically at the end of site.yml and can be skipped with --skip-tags verify_cert.

What is verified

• CA bundle validity (CA:TRUE, self-signed root, cert count)
• Certificate and key present, matched pair, not expired
• Subject Alternative Names contain private_ip and ansible_host
• Extended Key Usage has serverAuth + clientAuth (mTLS) or clientAuth (connect)
• Certificate signed by CA
• Live TLS handshake with IP verification
• no_proxy correctly excludes gRPC/GWM endpoints
• Service running with correct environment

All checks use ignore_errors: true — every check always runs and results are collected into a single summary per play.

.ansible-lint changes

Rule	Reason
command-instead-of-module	systemctl and curl tasks use pipes which require ansible.builtin.shell — cannot use systemd/uri modules. The qualifier-specific form [systemctl] did not suppress violations; bare rule ID required.
jinja[spacing]	Multi-line Jinja2 dict blocks used for check_results triggered the rule inconsistently across role files with identical syntax. Suppressed to avoid restructuring a core pattern.

[steven-schattenberg-itential]

Can you define what EKU is? I know that it is ExtendedKeyUsage but that might not be well known by others.

[steven-schattenberg-itential]

In the certify functionality for IAP I have template that produces a markdown file on the control node. This can make it easier for a customer to share the results with us for either troubleshooting or for our own records. In addition to this screen output, which is useful, I would like a md file to be produced.

[Amunagala-itential]

Superseded by a new commit with consolidated architecture — verify_cert colocated in gateway_server/gateway_client roles, cluster_id check removed, check numbering cleaned up.