@ -1,239 +1,239 @@
--- ---
- block:
- block:
- debug : var=subjectAltName - debug : var=subjectAltName
- name : Ensure the pki directory does not exist - name : Ensure the pki directory does not exist
file: file:
dest : "{{ ipsec_pki_path }}" dest : "{{ ipsec_pki_path }}"
state : absent state : absent
when : keys_clean_all|bool when : keys_clean_all|bool
- name : Ensure the pki directories exist - name : Ensure the pki directories exist
file: file:
dest : "{{ ipsec_pki_path }}/{{ item }}" dest : "{{ ipsec_pki_path }}/{{ item }}"
state : directory state : directory
recurse : yes recurse : true
mode : '0700' mode : "0700"
with_items: with_items:
- ecparams - ecparams
- certs - certs
- crl - crl
- newcerts - newcerts
- private - private
- public - public
- reqs - reqs
- name : Ensure the config directories exist - name : Ensure the config directories exist
file: file:
dest : "{{ ipsec_config_path }}/{{ item }}" dest : "{{ ipsec_config_path }}/{{ item }}"
state : directory state : directory
recurse : yes recurse : true
mode : '0700' mode : "0700"
with_items: with_items:
- apple - apple
- manual - manual
- name : Ensure the files exist - name : Ensure the files exist
file: file:
dest : "{{ ipsec_pki_path }}/{{ item }}" dest : "{{ ipsec_pki_path }}/{{ item }}"
state : touch state : touch
with_items: with_items:
- ".rnd" - .rnd
- "private/.rnd" - private/.rnd
- "index.txt" - index.txt
- "index.txt.attr" - index.txt.attr
- "serial" - serial
- name : Generate the openssl server configs - name : Generate the openssl server configs
template: template:
src : openssl.cnf.j2 src : openssl.cnf.j2
dest : "{{ ipsec_pki_path }}/openssl.cnf" dest : "{{ ipsec_pki_path }}/openssl.cnf"
- name : Build the CA pair - name : Build the CA pair
shell : > shell : >
umask 077; umask 077;
{{ openssl_bin }} ecparam -name secp384r1 -out ecparams/secp384r1.pem && {{ openssl_bin }} ecparam -name secp384r1 -out ecparams/secp384r1.pem &&
{{ openssl_bin }} req -utf8 -new {{ openssl_bin }} req -utf8 -new
-newkey ec:ecparams/secp384r1.pem -newkey ec:ecparams/secp384r1.pem
-config <(cat openssl.cnf <(printf "[basic_exts]\nsubjectAltName={{ subjectAltName }}")) -config <(cat openssl.cnf <(printf "[basic_exts]\nsubjectAltName={{ subjectAltName }}"))
-keyout private/cakey.pem -keyout private/cakey.pem
-out cacert.pem -x509 -days 3650 -out cacert.pem -x509 -days 3650
-batch -batch
-passout pass:"{{ CA_password }}" && -passout pass:"{{ CA_password }}" &&
touch {{ IP_subject_alt_name }}_ca_generated touch {{ IP_subject_alt_name }}_ca_generated
args: args:
chdir : "{{ ipsec_pki_path }}" chdir : "{{ ipsec_pki_path }}"
creates : "{{ IP_subject_alt_name }}_ca_generated" creates : "{{ IP_subject_alt_name }}_ca_generated"
executable : bash executable : bash
- name : Copy the CA certificate - name : Copy the CA certificate
copy: copy:
src : "{{ ipsec_pki_path }}/cacert.pem" src : "{{ ipsec_pki_path }}/cacert.pem"
dest : "{{ ipsec_config_path }}/manual/cacert.pem" dest : "{{ ipsec_config_path }}/manual/cacert.pem"
- name : Generate the serial number - name : Generate the serial number
shell : echo 01 > serial && touch serial_generated shell : echo 01 > serial && touch serial_generated
args: args:
chdir : "{{ ipsec_pki_path }}" chdir : "{{ ipsec_pki_path }}"
creates : serial_generated creates : serial_generated
- name : Build the server pair - name : Build the server pair
shell : > shell : >
umask 077; umask 077;
{{ openssl_bin }} req -utf8 -new {{ openssl_bin }} req -utf8 -new
-newkey ec:ecparams/secp384r1.pem -newkey ec:ecparams/secp384r1.pem
-config <(cat openssl.cnf <(printf "[basic_exts]\nsubjectAltName={{ subjectAltName }}")) -config <(cat openssl.cnf <(printf "[basic_exts]\nsubjectAltName={{ subjectAltName }}"))
-keyout private/{{ IP_subject_alt_name }}.key -keyout private/{{ IP_subject_alt_name }}.key
-out reqs/{{ IP_subject_alt_name }}.req -nodes -out reqs/{{ IP_subject_alt_name }}.req -nodes
-passin pass:"{{ CA_password }}" -passin pass:"{{ CA_password }}"
-subj "/CN={{ IP_subject_alt_name }}" -batch && -subj "/CN={{ IP_subject_alt_name }}" -batch &&
{{ openssl_bin }} ca -utf8 {{ openssl_bin }} ca -utf8
-in reqs/{{ IP_subject_alt_name }}.req -in reqs/{{ IP_subject_alt_name }}.req
-out certs/{{ IP_subject_alt_name }}.crt -out certs/{{ IP_subject_alt_name }}.crt
-config <(cat openssl.cnf <(printf "[basic_exts]\nsubjectAltName={{ subjectAltName }}")) -config <(cat openssl.cnf <(printf "[basic_exts]\nsubjectAltName={{ subjectAltName }}"))
-days 3650 -batch -days 3650 -batch
-passin pass:"{{ CA_password }}" -passin pass:"{{ CA_password }}"
-subj "/CN={{ IP_subject_alt_name }}" && -subj "/CN={{ IP_subject_alt_name }}" &&
touch certs/{{ IP_subject_alt_name }}_crt_generated touch certs/{{ IP_subject_alt_name }}_crt_generated
args: args:
chdir : "{{ ipsec_pki_path }}" chdir : "{{ ipsec_pki_path }}"
creates : certs/{{ IP_subject_alt_name }}_crt_generated creates : certs/{{ IP_subject_alt_name }}_crt_generated
executable : bash executable : bash
- name : Build the client's pair - name : Build the client's pair
shell : > shell : >
umask 077; umask 077;
{{ openssl_bin }} req -utf8 -new {{ openssl_bin }} req -utf8 -new
-newkey ec:ecparams/secp384r1.pem -newkey ec:ecparams/secp384r1.pem
-config <(cat openssl.cnf <(printf "[basic_exts]\nsubjectAltName={{ subjectAltName_USER }}")) -config <(cat openssl.cnf <(printf "[basic_exts]\nsubjectAltName={{ subjectAltName_USER }}"))
-keyout private/{{ item }}.key -keyout private/{{ item }}.key
-out reqs/{{ item }}.req -nodes -out reqs/{{ item }}.req -nodes
-passin pass:"{{ CA_password }}" -passin pass:"{{ CA_password }}"
-subj "/CN={{ item }}" -batch && -subj "/CN={{ item }}" -batch &&
{{ openssl_bin }} ca -utf8 {{ openssl_bin }} ca -utf8
-in reqs/{{ item }}.req -in reqs/{{ item }}.req
-out certs/{{ item }}.crt -out certs/{{ item }}.crt
-config <(cat openssl.cnf <(printf "[basic_exts]\nsubjectAltName={{ subjectAltName_USER }}")) -config <(cat openssl.cnf <(printf "[basic_exts]\nsubjectAltName={{ subjectAltName_USER }}"))
-days 3650 -batch -days 3650 -batch
-passin pass:"{{ CA_password }}" -passin pass:"{{ CA_password }}"
-subj "/CN={{ item }}" && -subj "/CN={{ item }}" &&
touch certs/{{ item }}_crt_generated touch certs/{{ item }}_crt_generated
args: args:
chdir : "{{ ipsec_pki_path }}" chdir : "{{ ipsec_pki_path }}"
creates : certs/{{ item }}_crt_generated creates : certs/{{ item }}_crt_generated
executable : bash executable : bash
with_items : "{{ users }}" with_items : "{{ users }}"
- name : Build the tests pair - name : Build the tests pair
shell : > shell : >
umask 077; umask 077;
{{ openssl_bin }} req -utf8 -new {{ openssl_bin }} req -utf8 -new
-newkey ec:ecparams/secp384r1.pem -newkey ec:ecparams/secp384r1.pem
-config <(cat openssl.cnf <(printf "[basic_exts]\nsubjectAltName=DNS:google-algo-test-pair.com")) -config <(cat openssl.cnf <(printf "[basic_exts]\nsubjectAltName=DNS:google-algo-test-pair.com"))
-keyout private/google-algo-test-pair.com.key -keyout private/google-algo-test-pair.com.key
-out reqs/google-algo-test-pair.com.req -nodes -out reqs/google-algo-test-pair.com.req -nodes
-passin pass:"{{ CA_password }}" -passin pass:"{{ CA_password }}"
-subj "/CN=google-algo-test-pair.com" -batch && -subj "/CN=google-algo-test-pair.com" -batch &&
{{ openssl_bin }} ca -utf8 {{ openssl_bin }} ca -utf8
-in reqs/google-algo-test-pair.com.req -in reqs/google-algo-test-pair.com.req
-out certs/google-algo-test-pair.com.crt -out certs/google-algo-test-pair.com.crt
-config <(cat openssl.cnf <(printf "[basic_exts]\nsubjectAltName=DNS:google-algo-test-pair.com")) -config <(cat openssl.cnf <(printf "[basic_exts]\nsubjectAltName=DNS:google-algo-test-pair.com"))
-days 3650 -batch -days 3650 -batch
-passin pass:"{{ CA_password }}" -passin pass:"{{ CA_password }}"
-subj "/CN=google-algo-test-pair.com" && -subj "/CN=google-algo-test-pair.com" &&
touch certs/google-algo-test-pair.com_crt_generated touch certs/google-algo-test-pair.com_crt_generated
args: args:
chdir : "{{ ipsec_pki_path }}" chdir : "{{ ipsec_pki_path }}"
creates : certs/google-algo-test-pair.com_crt_generated creates : certs/google-algo-test-pair.com_crt_generated
executable : bash executable : bash
when : tests|default(false)|bool when : tests|default(false)|bool
- name : Build openssh public keys - name : Build openssh public keys
openssl_publickey: openssl_publickey:
path : "{{ ipsec_pki_path }}/public/{{ item }}.pub" path : "{{ ipsec_pki_path }}/public/{{ item }}.pub"
privatekey_path : "{{ ipsec_pki_path }}/private/{{ item }}.key" privatekey_path : "{{ ipsec_pki_path }}/private/{{ item }}.key"
format : OpenSSH format : OpenSSH
with_items : "{{ users }}" with_items : "{{ users }}"
- name : Build the client's p12 - name : Build the client's p12
shell : > shell : >
umask 077; umask 077;
{{ openssl_bin }} pkcs12 {{ openssl_bin }} pkcs12
-in certs/{{ item }}.crt -in certs/{{ item }}.crt
-inkey private/{{ item }}.key -inkey private/{{ item }}.key
-export -export
-name {{ item }} -name {{ item }}
-out private/{{ item }}.p12 -out private/{{ item }}.p12
-passout pass:"{{ p12_export_password }}" -passout pass:"{{ p12_export_password }}"
args: args:
chdir : "{{ ipsec_pki_path }}" chdir : "{{ ipsec_pki_path }}"
executable : bash executable : bash
with_items : "{{ users }}" with_items : "{{ users }}"
register : p12 register : p12
- name : Build the client's p12 with the CA cert included - name : Build the client's p12 with the CA cert included
shell : > shell : >
umask 077; umask 077;
{{ openssl_bin }} pkcs12 {{ openssl_bin }} pkcs12
-in certs/{{ item }}.crt -in certs/{{ item }}.crt
-inkey private/{{ item }}.key -inkey private/{{ item }}.key
-export -export
-name {{ item }} -name {{ item }}
-out private/{{ item }}_ca.p12 -out private/{{ item }}_ca.p12
-certfile cacert.pem -certfile cacert.pem
-passout pass:"{{ p12_export_password }}" -passout pass:"{{ p12_export_password }}"
args: args:
chdir : "{{ ipsec_pki_path }}" chdir : "{{ ipsec_pki_path }}"
executable : bash executable : bash
with_items : "{{ users }}" with_items : "{{ users }}"
register : p12 register : p12
- name : Copy the p12 certificates - name : Copy the p12 certificates
copy: copy:
src : "{{ ipsec_pki_path }}/private/{{ item }}.p12" src : "{{ ipsec_pki_path }}/private/{{ item }}.p12"
dest : "{{ ipsec_config_path }}/manual/{{ item }}.p12" dest : "{{ ipsec_config_path }}/manual/{{ item }}.p12"
with_items: with_items:
- "{{ users }}" - "{{ users }}"
- name : Get active users - name : Get active users
shell : > shell : >
grep ^V index.txt | grep ^V index.txt |
grep -v "{{ IP_subject_alt_name }}" | grep -v "{{ IP_subject_alt_name }}" |
awk '{print $5}' | awk '{print $5}' |
sed 's/\/CN=//g' sed 's/\/CN=//g'
args: args:
chdir : "{{ ipsec_pki_path }}" chdir : "{{ ipsec_pki_path }}"
register : valid_certs register : valid_certs
- name : Revoke non-existing users - name : Revoke non-existing users
shell : > shell : >
{{ openssl_bin }} ca -gencrl {{ openssl_bin }} ca -gencrl
-config <(cat openssl.cnf <(printf "[basic_exts]\nsubjectAltName={{ subjectAltName_USER }}")) -config <(cat openssl.cnf <(printf "[basic_exts]\nsubjectAltName={{ subjectAltName_USER }}"))
-passin pass:"{{ CA_password }}" -passin pass:"{{ CA_password }}"
-revoke certs/{{ item }}.crt -revoke certs/{{ item }}.crt
-out crl/{{ item }}.crt -out crl/{{ item }}.crt
register : gencrl register : gencrl
args: args:
chdir : "{{ ipsec_pki_path }}" chdir : "{{ ipsec_pki_path }}"
creates : crl/{{ item }}.crt creates : crl/{{ item }}.crt
executable : bash executable : bash
when : item.split('@')[0] not in users when : item.split('@')[0] not in users
with_items : "{{ valid_certs.stdout_lines }}" with_items : "{{ valid_certs.stdout_lines }}"
- name : Generate new CRL file - name : Generate new CRL file
shell : > shell : >
{{ openssl_bin }} ca -gencrl {{ openssl_bin }} ca -gencrl
-config <(cat openssl.cnf <(printf "[basic_exts]\nsubjectAltName=DNS:{{ IP_subject_alt_name }}")) -config <(cat openssl.cnf <(printf "[basic_exts]\nsubjectAltName=DNS:{{ IP_subject_alt_name }}"))
-passin pass:"{{ CA_password }}" -passin pass:"{{ CA_password }}"
-out crl/algo.root.pem -out crl/algo.root.pem
when: when:
- gencrl is defined - gencrl is defined
- gencrl.changed - gencrl.changed
args: args:
chdir : "{{ ipsec_pki_path }}" chdir : "{{ ipsec_pki_path }}"
executable : bash executable : bash
delegate_to : localhost delegate_to : localhost
become : no become : false
vars: vars:
ansible_python_interpreter : "{{ ansible_playbook_python }}" ansible_python_interpreter : "{{ ansible_playbook_python }}"
Jack Ivanov
2 years ago
committed by
GitHub