Skip to content
Snippets Groups Projects
Commit 5b18bcc0 authored by Jupiter Hu's avatar Jupiter Hu
Browse files

Don't recreate certificates if they exist

parent 9fad0c0f
No related branches found
No related tags found
No related merge requests found
......@@ -2,12 +2,15 @@
-
copy: "src=/tmp/{{ inventory_hostname }}/ca.crt dest=/etc/openvpn/ca.crt mode=644 owner=root group=root"
name: "Copying CA certificate"
when: "client_rsa.stat.exists == false"
-
copy: "src=/tmp/{{ inventory_hostname }}/{{ inventory_hostname }}.crt dest=/etc/openvpn/{{ inventory_hostname }}.crt mode=644 owner=root group=root"
name: "Copying Client certificate"
when: "client_rsa.stat.exists == false"
-
copy: "src=/tmp/{{ inventory_hostname }}/{{ inventory_hostname }}.key dest=/etc/openvpn/{{ inventory_hostname }}.key mode=600 owner=root group=root"
name: "Copying Client key"
when: "client_rsa.stat.exists == false"
- name: "Copying client.conf to the OpenVPN client"
template: src={{ item }} dest=/etc/openvpn/client.conf
......@@ -20,7 +23,9 @@
- ../templates/
- ../files/
notify: restart openvpn
when: "client_rsa.stat.exists == false"
- name: "Removing Cert Directory"
local_action: "command rm -rf /tmp/{{ inventory_hostname }}"
when: "client_rsa.stat.exists == false"
---
-
failed_when: "CAcert.stat.exists == false"
name: "Checking if CA certificate exist"
register: CAcert
stat: path="/etc/easy-rsa/2.0/keys/ca.crt"
-
name: "Copying CA certificate"
shell: "cp -rpvf /etc/easy-rsa/2.0/keys/ca.crt /etc/openvpn/"
when: "CAcert.stat.exists == true"
-
failed_when: "ServerCert.stat.exists == false"
name: "Check if Server certificate exist"
register: ServerCert
stat: "path=/etc/easy-rsa/2.0/keys/{{ inventory_hostname }}.crt"
-
name: "Copying Server certificate"
shell: "cp -rpvf /etc/easy-rsa/2.0/keys/{{ inventory_hostname }}.crt /etc/openvpn/"
when: "ServerCert.stat.exists == true"
-
failed_when: "ServerKey.stat.exists == false"
name: "Check if Server key exist"
register: ServerKey
stat: "path=/etc/easy-rsa/2.0/keys/{{ inventory_hostname }}.key"
-
name: "Copying Server key"
shell: "cp -rpvf /etc/easy-rsa/2.0/keys/{{ inventory_hostname }}.key /etc/openvpn/"
when: "ServerKey.stat.exists == true"
-
- name: "Copying CA and server certificate"
shell: "cp -pvf /etc/easy-rsa/2.0/keys/ca.crt /etc/openvpn/; cp -pvf /etc/easy-rsa/2.0/keys/{{ inventory_hostname }}.crt /etc/openvpn/; cp -pvf /etc/easy-rsa/2.0/keys/{{ inventory_hostname }}.key /etc/openvpn/"
args:
creates: /etc/openvpn/ca.crt
- name: "Create symlink for Diffie Hellman"
file: "src=/etc/easy-rsa/2.0/keys/dh512.pem dest=/etc/openvpn/dh512.pem state=link"
name: "Create symlink for Diffie Hellman"
- name: "Copying server.conf to the OpenVPN server"
template: src={{ item }} dest=/etc/openvpn/server.conf
with_first_found:
......
# easy-rsa parameter settings
# NOTE: If you installed from an RPM,
# don't edit this file in place in
# /usr/share/openvpn/easy-rsa --
# instead, you should copy the whole
# easy-rsa directory to another location
# (such as /etc/openvpn) so that your
# edits will not be wiped out by a future
# OpenVPN package upgrade.
# This variable should point to
# the top level of the easy-rsa
# tree.
export EASY_RSA="/etc/easy-rsa/2.0"
#
# This variable should point to
# the requested executables
#
export OPENSSL="openssl"
export PKCS11TOOL="pkcs11-tool"
export GREP="grep"
# This variable should point to
# the openssl.cnf file included
# with easy-rsa.
export KEY_CONFIG=`$EASY_RSA/whichopensslcnf $EASY_RSA`
# Edit this variable to point to
# your soon-to-be-created key
# directory.
#
# WARNING: clean-all will do
# a rm -rf on this directory
# so make sure you define
# it correctly!
export KEY_DIR="$EASY_RSA/keys"
# Issue rm -rf warning
echo NOTE: If you run ./clean-all, I will be doing a rm -rf on $KEY_DIR
# PKCS11 fixes
export PKCS11_MODULE_PATH="dummy"
export PKCS11_PIN="dummy"
# Increase this to 2048 if you
# are paranoid. This will slow
# down TLS negotiation performance
# as well as the one-time DH parms
# generation process.
export KEY_SIZE=512
# In how many days should the root CA key expire?
export CA_EXPIRE=3650
# In how many days should certificates expire?
export KEY_EXPIRE=3650
# These are the default values for fields
# which will be placed in the certificate.
# Don't leave any of these fields blank.
export KEY_COUNTRY="AU"
export KEY_PROVINCE="Victoria"
export KEY_CITY="Melbourne"
export KEY_ORG="Monash University"
export KEY_EMAIL="shahaan.ayyub@monash.edu"
export KEY_OU="MCC-R@CMON"
# X509 Subject Field
export KEY_NAME="EasyRSA"
# PKCS11 Smart Card
# export PKCS11_MODULE_PATH="/usr/lib/changeme.so"
# export PKCS11_PIN=1234
# If you'd like to sign all keys with the same Common Name, uncomment the KEY_CN export below
# You will also need to make sure your OpenVPN server config has the duplicate-cn option set
# export KEY_CN="CommonName"
---
-
delegate_to: "{{ server }}"
name: "Check if certificate exist"
register: cert
stat: "path=/etc/easy-rsa/2.0/keys/{{ inventory_hostname }}.crt"
-
- name: "Check if the easy-rsa is installed"
register: client_rsa
stat: "path=/etc/openvpn/ca.crt"
- name: "Creating Client certificate"
delegate_to: "{{ server }}"
name: "Creating Client certificate"
shell: " cd /etc/easy-rsa/2.0; source ./vars; export EASY_RSA=\"${EASY_RSA:-.}\"; \"$EASY_RSA\"/pkitool --csr {{ inventory_hostname }} ;\"$EASY_RSA\"/pkitool --sign {{ inventory_hostname }}"
when: "cert.stat.exists == false"
-
when: "client_rsa.stat.exists == false"
- name: "Copy the Client Certificate to the master node"
delegate_to: "{{ server }}"
fetch: "src=/etc/easy-rsa/2.0/keys/{{ inventory_hostname }}.crt dest=/tmp/{{ inventory_hostname }}/ fail_on_missing=yes validate_md5=yes flat=yes"
name: "Copy the Client Certificate to the master node"
-
when: "client_rsa.stat.exists == false"
- name: "Copy the Client Certificate to the master node"
delegate_to: "{{ server }}"
fetch: "src=/etc/easy-rsa/2.0/keys/{{ inventory_hostname }}.key dest=/tmp/{{ inventory_hostname }}/ fail_on_missing=yes validate_md5=yes flat=yes"
name: "Copy the Client Certificate to the master node"
-
when: "client_rsa.stat.exists == false"
- name: "Copy the Client Certificate to the master node"
delegate_to: "{{ server }}"
fetch: "src=/etc/easy-rsa/2.0/keys/ca.crt dest=/tmp/{{ inventory_hostname }}/ fail_on_missing=yes validate_md5=yes flat=yes"
name: "Copy the Client Certificate to the master node"
when: "client_rsa.stat.exists == false"
......@@ -5,3 +5,6 @@
-
name: "Moving easy-rsa to /etc"
shell: "cp -rf /usr/share/easy-rsa /etc/"
args:
creates: /etc/easy-rsa/2.0
---
-
name: "Check if certificate exist"
register: cert
stat: "path=/etc/easy-rsa/2.0/keys/{{ server }}.crt"
-
name: "Creating Server certificate"
shell: " cd /etc/easy-rsa/2.0; source ./vars; export EASY_RSA=\"${EASY_RSA:-.}\"; \"$EASY_RSA/pkitool\" --server {{ server }}"
when: "cert.stat.exists == false"
-
name: "Check if Diffie Hellman parameters file exist"
register: dh
stat: path=/etc/easy-rsa/2.0/keys/dh512.pem
-
name: "Generating Diffie-Hellman Parameters"
- name: "Creating Server certificate"
shell: " cd /etc/easy-rsa/2.0; source ./vars; export EASY_RSA=\"${EASY_RSA:-.}\"; \"$EASY_RSA/pkitool\" --server {{ server }}; cp /etc/easy-rsa/2.0/keys/{{ server }}.crt /etc/easy-rsa/2.0/keys/dummy_server.crt"
args:
chdir: /etc/easy-rsa/2.0/keys/
creates: dummy_server.crt ## Todo: {{ server }}.crt does not work
- name: "Generating Diffie-Hellman Parameters"
shell: "cd /etc/easy-rsa/2.0; source ./vars; ./build-dh"
when: "dh.stat.exists == false"
args:
chdir: /etc/easy-rsa/2.0/keys/
creates: dh512.pem
......@@ -5,3 +5,6 @@
-
name: "Moving easy-rsa to /etc"
shell: "cp -rf /usr/share/easy-rsa /etc/"
args:
chdir: /etc/easy-rsa/2.0/
creates: build-ca
......@@ -2,3 +2,5 @@
-
name: "Building the CA Certificate"
shell: ' cd /etc/easy-rsa/2.0; source ./vars; ./clean-all; export EASY_RSA="${EASY_RSA:-.}"; "$EASY_RSA/pkitool" --initca $*'
args:
creates: /etc/easy-rsa/2.0/keys
---
-
- name: "Creating Client certificate"
delegate_to: "127.0.0.1"
name: "Check if certificate exist"
register: cert
stat: "path=/etc/easy-rsa/2.0/keys/{{ client }}.crt"
-
delegate_to: "127.0.0.1"
name: "Creating Client certificate"
shell: " cd /etc/easy-rsa/2.0; source ./vars; export EASY_RSA=\\\"${EASY_RSA:-.}\\\"; \"$EASY_RSA/pkitool\" --csr {{ client }} ;\"$E ASY_RSA/pkitool\" --sign {{ client }}"
args:
chdir: /etc/easy-rsa/2.0/keys/
creates: client.crt
---
-
name: "Check if certificate exist"
register: cert
stat: "path=/etc/easy-rsa/2.0/keys/{{ server }}.crt"
-
name: "Creating Server certificate"
- name: "Creating Server certificate"
shell: " cd /etc/easy-rsa/2.0; source ./vars; export EASY_RSA=\"${EASY_RSA:-.}\"; \"$EASY_RSA/pkitool\" --server {{ server }}"
when: "cert.stat.exists == false"
-
name: "Check if Diffie Hellman parameters file exist"
register: dh
stat: path=/etc/easy-rsa/2.0/keys/dh512.pem
-
name: "Generating Diffie-Hellman Parameters"
args:
chdir: /etc/easy-rsa/2.0/keys/
creates: server.crt
- name: "Generating Diffie-Hellman Parameters"
shell: "cd /etc/easy-rsa/2.0; source ./vars; ./build-dh"
when: "dh.stat.exists == false"
args:
chdir: /etc/easy-rsa/2.0/keys/
creates: dh512.pem
......@@ -5,3 +5,5 @@
-
name: "Moving easy-rsa to /etc"
shell: "cp -rf /usr/share/easy-rsa /etc/"
args:
creates: /etc/easy-rsa
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment