---
- name: Ensure openssl exists
  package:
    name:
      - openssl
    state: present

- name: Ensure /etc/pki/CA exists
  file:
    path: /etc/pki/CA
    state: directory
    mode: 0755

- name: Ensure /etc/pki/CA exists
  file:
    path: /etc/pki/CA/certs
    state: directory
    mode: 0755

- name: Ensure /etc/pki/CA exists
  file:
    path: /etc/pki/CA/private
    state: directory
    mode: 0755

- name: Generate a self signed CA cert and the CA key
  command: >-
    openssl req -x509 -newkey rsa:2048 -nodes
    -keyout "{{ __test_ca_key }}" -out "{{ __test_ca_cert }}"
    -subj "/CN=test-ca/OU=system-roles/DC=fedora/DC=org"
  changed_when: false

- name: Verify CA cert
  command: >-
    openssl x509 -text -in "{{ __test_ca_cert }}" -noout
  changed_when: false

- name: Generate a server/client key
  command: openssl genrsa -out "{{ __test_key }}"
  changed_when: false

- name: Generate a server Certificate Signing Request
  command: >-
    openssl req -new -key "{{ __test_key }}"
    -out "{{ __test_cert_csr }}"
    -subj "/C=US/O=Fedora/DC=fedora/CN=logging.fedora.org"
  changed_when: false

- name: "Generate a server/client cert using the key, and signed by the self signed CA"
  command: >-
    openssl x509 -req -in "{{ __test_cert_csr }}"
    -CA "{{ __test_ca_cert }}" -CAkey "{{ __test_ca_key }}"
    -CAcreateserial -out "{{ __test_cert }}"
  changed_when: false

- name: Verify the server/client cert
  command: >-
    openssl x509 -text -in "{{ __test_cert }}" -noout
  changed_when: false
