From 05f000140fe2e32cb147262f93ffc9965139f329 Mon Sep 17 00:00:00 2001
From: acien101 <f.acien@upm.es>
Date: Mon, 9 Sep 2019 11:58:19 +0200
Subject: [PATCH 1/2] Creating a self CA for SSL connections when testing

---
 tasks/main.yml                | 51 ++++++++++++++++++++++++++++++++---
 templates/san_template.ext.j2 |  7 +++++
 2 files changed, 55 insertions(+), 3 deletions(-)
 create mode 100644 templates/san_template.ext.j2

diff --git a/tasks/main.yml b/tasks/main.yml
index 3a5aaa8..578da40 100644
--- a/tasks/main.yml
+++ b/tasks/main.yml
@@ -64,6 +64,17 @@
     - testing is defined
     - letsencrypt_cert.stat.exists == False
 
+- name: Create live directory for testing CA
+  file:
+    dest: /etc/letsencrypt/live/CA
+    state: directory
+    owner: root
+    group: root
+    mode: 0755
+  when:
+    - testing is defined
+    - letsencrypt_cert.stat.exists == False
+
 - name: Install openssl
   apt:
     pkg: openssl
@@ -72,11 +83,45 @@
     - testing is defined
     - letsencrypt_cert.stat.exists == False
 
+- name: Create self-signed root certificate (CA), if testing.
+  command: >
+    openssl req -x509 -new -nodes -subj '/CN=lili' -days 30
+    -newkey rsa:4096 -sha256 -keyout /etc/letsencrypt/live/CA/rootCA.key
+    -out /etc/letsencrypt/live/CA/rootCA.pem
+  args:
+    creates: /etc/letsencrypt/live/CA/rootCA.pem
+  ignore_errors: yes
+  when:
+    - testing is defined
+    - letsencrypt_cert.stat.exists == False
+
+- name: Create self-signed certificate, if testing.
+  command: >
+    openssl req -new -nodes -subj '/CN=lili' -days 30 \
+    -newkey rsa:4096 -sha256 -keyout /etc/letsencrypt/live/{{ domain }}/privkey.pem \
+    -out /etc/letsencrypt/live/{{ domain }}/cert.csr
+  args:
+    creates: /etc/letsencrypt/live/{{ domain }}/cert.csr
+  ignore_errors: yes
+  when:
+    - testing is defined
+    - letsencrypt_cert.stat.exists == False
+
+- name: Create X.509 v3 configuration file
+  template:
+    src: san_template.ext.j2
+    dest: "/etc/letsencrypt/live/{{ domain }}/{{ domain }}.ext"
+  ignore_errors: yes
+  when:
+    - testing is defined
+
 - name: Create self-signed certificate, if testing.
   command: >
-    openssl req -x509 -nodes -subj '/CN={{ domain }}' -days 30
-    -newkey rsa:4096 -sha256 -keyout /etc/letsencrypt/live/{{ domain }}/privkey.pem
-    -out /etc/letsencrypt/live/{{ domain }}/cert.pem
+    openssl x509 -req -in /etc/letsencrypt/live/{{ domain }}/cert.csr
+    -CA /etc/letsencrypt/live/CA/rootCA.pem
+    -CAkey /etc/letsencrypt/live/CA/rootCA.key
+    -CAcreateserial -out /etc/letsencrypt/live/{{ domain }}/cert.pem
+    -days 30 -sha256 -extfile /etc/letsencrypt/live/{{ domain }}/{{ domain }}.ext
   args:
     creates: /etc/letsencrypt/live/{{ domain }}/cert.pem
   ignore_errors: yes
diff --git a/templates/san_template.ext.j2 b/templates/san_template.ext.j2
new file mode 100644
index 0000000..f2b5eae
--- /dev/null
+++ b/templates/san_template.ext.j2
@@ -0,0 +1,7 @@
+authorityKeyIdentifier=keyid,issuer
+basicConstraints=CA:FALSE
+keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
+subjectAltName = @alt_names
+
+[alt_names]
+DNS.1 = {{ domain }}

From 469b3722fb467bc7eb074002746e96aaecc8067d Mon Sep 17 00:00:00 2001
From: acien101 <f.acien@upm.es>
Date: Wed, 25 Sep 2019 11:12:34 +0200
Subject: [PATCH 2/2] adding CA to system certificates if testing

---
 tasks/main.yml | 34 ++++++++++++++++++++++++++++++++++
 1 file changed, 34 insertions(+)

diff --git a/tasks/main.yml b/tasks/main.yml
index 578da40..a28dcf3 100644
--- a/tasks/main.yml
+++ b/tasks/main.yml
@@ -129,6 +129,40 @@
     - testing is defined
     - letsencrypt_cert.stat.exists == False
 
+- name: Check if the certificate is on the system
+  stat:
+    path: "/usr/share/ca-certificates/extra/{{ base_domain }}.crt"
+  register: system_cert
+
+- name: Create custom CA directory on system certificates
+  file:
+    dest: /usr/share/ca-certificates/extra
+    state: directory
+    owner: root
+    group: root
+    mode: 0755
+  when:
+    - testing is defined
+    - system_cert.stat.exists == False
+
+- name: Add CA to system
+  copy:
+    src: /etc/letsencrypt/live/CA/rootCA.pem
+    dest: /usr/share/ca-certificates/extra/{{ base_domain }}.crt
+    remote_src: yes
+  ignore_errors: yes
+  when:
+    - testing is defined
+    - system_cert.stat.exists == False
+
+- name: Update CA certificates on remote host.
+  command: >
+    update-ca-certificates
+  ignore_errors: yes
+  when:
+    - testing is defined
+    - system_cert.stat.exists == False
+
 - name: Create a combined SSL cert for testing
   shell: cat /etc/letsencrypt/live/{{ domain }}/cert.pem >
     /etc/letsencrypt/live/{{ domain }}/fullchain.pem