You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
39 lines
1.5 KiB
39 lines
1.5 KiB
#
|
|
# Task: Generate Certificates
|
|
#
|
|
#
|
|
|
|
- include_tasks: mkdir.yml
|
|
|
|
#
|
|
#
|
|
#
|
|
- name: Generating CA
|
|
shell: |
|
|
openssl genrsa 4096 > /etc/mysql/ssl/ca-key.pem
|
|
openssl req -new -x509 -nodes -days 365000 -key /etc/mysql/ssl/ca-key.pem -out /etc/mysql/ssl/ca-cert.pem -subj "/CN={{ hostvars[inventory_hostname]['ansible_host'] }}-mysql-ca"
|
|
|
|
#
|
|
#
|
|
#
|
|
- name: Generating Client Certificate
|
|
shell: |
|
|
openssl req -newkey rsa:4096 -days 365000 -nodes -keyout /etc/mysql/ssl/client-key.pem -out /etc/mysql/ssl/client-req.pem -subj "/CN={{ hostvars[inventory_hostname]['ansible_host'] }}-mysql-server"
|
|
openssl rsa -in /etc/mysql/ssl/client-key.pem -out /etc/mysql/ssl/client-key.pem
|
|
openssl x509 -req -in /etc/mysql/ssl/client-req.pem -days 365000 -CA /etc/mysql/ssl/ca-cert.pem -CAkey /etc/mysql/ssl/ca-key.pem -set_serial 01 -out /etc/mysql/ssl/client-cert.pem
|
|
|
|
#
|
|
#
|
|
#
|
|
- name: Generating Server Certificate
|
|
shell: |
|
|
openssl req -newkey rsa:4096 -days 365000 -nodes -keyout /etc/mysql/ssl/server-key.pem -out /etc/mysql/ssl/server-req.pem -subj "/CN={{ hostvars[inventory_hostname]['ansible_host'] }}-mysql-server"
|
|
openssl rsa -in /etc/mysql/ssl/server-key.pem -out /etc/mysql/ssl/server-key.pem
|
|
openssl x509 -req -in /etc/mysql/ssl/server-req.pem -days 365000 -CA /etc/mysql/ssl/ca-cert.pem -CAkey /etc/mysql/ssl/ca-key.pem -set_serial 01 -out /etc/mysql/ssl/server-cert.pem
|
|
|
|
#
|
|
#
|
|
#
|
|
- name: Validate Certificates
|
|
shell: openssl verify -CAfile /etc/mysql/ssl/ca-cert.pem /etc/mysql/ssl/server-cert.pem /etc/mysql/ssl/client-cert.pem
|