#
# Task: Generate Certificates
#
#

- include_tasks: mkdir.yml

#
# 
#
- name: Generating CA
  shell: |
    openssl genrsa 4096 > /etc/mysql/ssl/ca-key.pem
    openssl req -new -x509 -nodes -days 365000 -key /etc/mysql/ssl/ca-key.pem -out /etc/mysql/ssl/ca-cert.pem -subj "/CN={{ hostvars[inventory_hostname]['ansible_host'] }}-mysql-ca" 

#
#
#
- name: Generating Client Certificate
  shell: |
    openssl req -newkey rsa:4096 -days 365000 -nodes -keyout /etc/mysql/ssl/client-key.pem -out /etc/mysql/ssl/client-req.pem -subj "/CN={{ hostvars[inventory_hostname]['ansible_host'] }}-mysql-server"
    openssl rsa -in /etc/mysql/ssl/client-key.pem -out /etc/mysql/ssl/client-key.pem
    openssl x509 -req -in /etc/mysql/ssl/client-req.pem -days 365000 -CA /etc/mysql/ssl/ca-cert.pem -CAkey /etc/mysql/ssl/ca-key.pem -set_serial 01 -out /etc/mysql/ssl/client-cert.pem

#
#
#
- name: Generating Server Certificate
  shell: |
    openssl req -newkey rsa:4096 -days 365000 -nodes -keyout /etc/mysql/ssl/server-key.pem -out /etc/mysql/ssl/server-req.pem -subj "/CN={{ hostvars[inventory_hostname]['ansible_host'] }}-mysql-server"
    openssl rsa -in /etc/mysql/ssl/server-key.pem -out /etc/mysql/ssl/server-key.pem
    openssl x509 -req -in /etc/mysql/ssl/server-req.pem -days 365000 -CA /etc/mysql/ssl/ca-cert.pem -CAkey /etc/mysql/ssl/ca-key.pem -set_serial 01 -out /etc/mysql/ssl/server-cert.pem

#
# 
#
- name: Validate Certificates
  shell: openssl verify -CAfile /etc/mysql/ssl/ca-cert.pem /etc/mysql/ssl/server-cert.pem /etc/mysql/ssl/client-cert.pem