uib_ssl.yml

# single domain
- name: "set fact for folder for digicert"
  set_fact:
    apache_digicert_uib_home: "/etc/digicert-uib"
    
- name: "create digicert-uib-folder"
  file:
    path: "{{ item }}"
    state: "directory"
    owner: root
    group: "root"
    mode: "0550"
  loop:
  - "{{ apache_digicert_uib_home }}"
  - "{{ apache_digicert_uib_home }}/archive"
  - "{{ apache_digicert_uib_home }}/csr"
 
- name: "create directory for vhosts"
  file:
    path: "{{ apache_digicert_uib_home }}/archive/{{ item.servername }}"
    state: "directory"
    owner: "root"
    group: "root"
    mode: "0550"
    setype: "cert_t"
  loop: "{{ apache_vhosts }}"
  when: "item.ssl_type == 'uib'"

- name: "stat archive"
  stat:
    path: "{{ apache_digicert_uib_home }}/archive"
  register: apace_digicert_archive

- name: "prompt for renew"
  pause:
    prompt: "Confirm that you want to renew your digicert certificate (y/n)"
  register: "apache_digicert_confirm_renew"
  when: "apache_digicert_renew | default(false) | bool"

- name: "generate ssl private key"
  openssl_privatekey:
    path: "{{ apache_digicert_uib_home }}/archive/{{ item.servername }}/priv_key.pem"
    backup: "yes"
    size: "2048"
    setype: "cert_t"
    cipher: "aes256"
  loop: "{{ apache_vhosts }}"
  when: "item.ssl_type  | default('certbot')== 'uib'"

- name: "generate an OpenSSL Certificate Signin request"
  openssl_csr:
    backup: "yes"
    path: "{{ apache_digicert_uib_home }}/csr/{{ item.servername }}.csr"
    privatekey_path: "{{ apache_digicert_uib_home }}/archive/{{ item.servername }}/priv_key.pem"
    country_name: "NO"
    organization_name: "Universitetet_i_Bergen"
    common_name: "{{ item.servername }}"
  loop: "{{ apache_vhosts }}"
  when: "item.ssl_type  | default('certbot')== 'uib'"
  register: "apache_csr_result"

- name: "send csr file by mail"
  mail:
    subject: "csr certificate request for {{ item.servername }}"
    to: "{{ item.serveradmin }}"
    attach:
      - "{{ apache_digicert_uib_home }}/csr/{{ item.servername }}.csr"
  loop: "{{ apache_vhosts }}"
  when: "item.ssl_type  | default('certbot')== 'uib' and apache_csr_result.changed | bool"

- name: "set selinux label"

- name: "create symlinks for private keys"
  file:
    state: "link"
    src: ""{ apache_digicert_uib_home }}/archive/{{ item.servername }}/priv_key.pem"
    dest: "/etc/pki/tls/private/{{item.servername }}.pem"
  loop: "{{ apache_vhosts }}"
  when: "item.ssl_type  | default('certbot')== 'uib'"

  
#- name: "get certificate url from ITA"
#  prompt_vars: 
  #  get_url:

#SSLCertificateFile /etc/pki/tls/certs/domene.uib.no.crt
#SSLCertificateKeyFile /etc/pki/tls/private/domene.uib.no.key
# SSLCertificateChainFile /etc/pki/tls/certs/digicertca2.uib.no.crt

# @todo multiple domains