pfsensible · opoplawski · Aug 18, 2025 · Aug 17, 2025
diff --git a/changelogs/fragments/135_pfsense_ca_create_internal.yml b/changelogs/fragments/135_pfsense_ca_create_internal.yml
@@ -0,0 +1,2 @@
+minor_changes:
+ - pfsense_ca - Add ability to create internal CAs. (https://github.com/pfsensible/core/issues/135)
diff --git a/plugins/modules/pfsense_ca.py b/plugins/modules/pfsense_ca.py
diff --git a/tests/plays/openvpn.yml b/tests/plays/openvpn.yml
@@ -1,7 +1,6 @@
 ---
 - hosts: pfsense
   tasks:
-    # TODO - This needs to get impletmented
     - name: OpenVPN CA
       pfsensible.core.pfsense_ca:
         name: OpenVPN CA
@@ -11,9 +10,7 @@
       tags:
         - openvpn
         - openvpn_ca
-      when: false
 
-    # TODO - need an internal CA first - generate by hand in WebUI for now
     - name: Generate new internal certificate
       pfsensible.core.pfsense_cert:
         method: internal
@@ -22,7 +19,7 @@
         keytype: RSA
         keylen: 2048
         lifetime: 3650
-        dn_country: "US"
+        dn_country: US
         certtype: server
         state: present
       tags: openvpn_cert

diff --git a/tests/sanity/ignore-2.14.txt b/tests/sanity/ignore-2.14.txt
@@ -1,5 +1,6 @@
 misc/pfsensible-generate-module shebang # This is not a module
 misc/pfsense_module.py.j2 shebang # This is not a module
+plugins/modules/pfsense_ca.py validate-modules:no-log-needed # Argument 'keylen' is not sensitive
 plugins/modules/pfsense_cert.py validate-modules:no-log-needed # Argument 'keylen' is not sensitive
 plugins/modules/pfsense_dhcp_static.py validate-modules:no-log-needed # Arguments 'ddnsdomainkeyname' and 'ddnsdomainkeyalgorithm' are not sensitive
 plugins/modules/pfsense_ipsec.py validate-modules:no-log-needed # Argument 'rekey_time' is not sensitive

diff --git a/tests/sanity/ignore-2.15.txt b/tests/sanity/ignore-2.15.txt
@@ -1,5 +1,6 @@
 misc/pfsensible-generate-module shebang # This is not a module
 misc/pfsense_module.py.j2 shebang # This is not a module
+plugins/modules/pfsense_ca.py validate-modules:no-log-needed # Argument 'keylen' is not sensitive
 plugins/modules/pfsense_cert.py validate-modules:no-log-needed # Argument 'keylen' is not sensitive
 plugins/modules/pfsense_dhcp_static.py validate-modules:no-log-needed # Arguments 'ddnsdomainkeyname' and 'ddnsdomainkeyalgorithm' are not sensitive
 plugins/modules/pfsense_ipsec.py validate-modules:no-log-needed # Argument 'rekey_time' is not sensitive

diff --git a/tests/sanity/ignore-2.16.txt b/tests/sanity/ignore-2.16.txt
@@ -1,5 +1,6 @@
 misc/pfsensible-generate-module shebang # This is not a module
 misc/pfsense_module.py.j2 shebang # This is not a module
+plugins/modules/pfsense_ca.py validate-modules:no-log-needed # Argument 'keylen' is not sensitive
 plugins/modules/pfsense_cert.py validate-modules:no-log-needed # Argument 'keylen' is not sensitive
 plugins/modules/pfsense_dhcp_static.py validate-modules:no-log-needed # Arguments 'ddnsdomainkeyname' and 'ddnsdomainkeyalgorithm' are not sensitive
 plugins/modules/pfsense_ipsec.py validate-modules:no-log-needed # Argument 'rekey_time' is not sensitive

diff --git a/tests/sanity/ignore-2.17.txt b/tests/sanity/ignore-2.17.txt
@@ -1,5 +1,6 @@
 misc/pfsensible-generate-module shebang # This is not a module
 misc/pfsense_module.py.j2 shebang # This is not a module
+plugins/modules/pfsense_ca.py validate-modules:no-log-needed # Argument 'keylen' is not sensitive
 plugins/modules/pfsense_cert.py validate-modules:no-log-needed # Argument 'keylen' is not sensitive
 plugins/modules/pfsense_dhcp_static.py validate-modules:no-log-needed # Arguments 'ddnsdomainkeyname' and 'ddnsdomainkeyalgorithm' are not sensitive
 plugins/modules/pfsense_ipsec.py validate-modules:no-log-needed # Argument 'rekey_time' is not sensitive
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,2 @@
		minor_changes:
		- pfsense_ca - Add ability to create internal CAs. (https://github.com/pfsensible/core/issues/135)