Merge "Increase validity period of Octavia CA and certificates"

This commit is contained in:
Zuul 2020-07-29 04:11:13 +00:00 committed by Gerrit Code Review
commit cf36c38299
4 changed files with 62 additions and 5 deletions

View File

@ -30,6 +30,19 @@
- name: Store CA data
set_fact:
ca_cert: "{{ ca_file_data.content | b64decode }}"
- name: Get remaining validity period of the CA
shell: |
now=$(date +%s)
enddate=$(date +%s -d "$(openssl x509 -enddate -noout -in {{ octavia_confd_prefix }}/{{ ca_cert_path }} | cut -d= -f2)")
echo $((enddate - now))
register: validity_period
- name: Force CA update if remaining validity is less than 1 year
set_fact:
force_certs_update: true
when:
- (validity_period.stdout| int) < 31622400 # 31622400 seconds == 366 days
when:
- ca_file_stat.stat.exists | bool
@ -46,9 +59,20 @@
slurp:
src: "{{ octavia_confd_prefix }}/{{ ca_private_key_path }}"
register: key_file_data
- name: Store CA data
- name: Store CA private key
set_fact:
ca_private_key: "{{ key_file_data.content | b64decode }}"
- name: Detect if key is encrypted with AES256
shell: grep -q 'AES-256-CBC' {{ octavia_confd_prefix }}/{{ ca_private_key_path }}
failed_when: false
register: ca_private_key_aes_256
- name: Store flag if a private key update is required
set_fact:
force_private_key_update: true
force_certs_update: true
when:
- ca_private_key_aes_256.rc != 0
when:
- ca_key_file_stat.stat.exists | bool

View File

@ -35,7 +35,39 @@
- name: Generating certificate authority private key
become: true
shell: |
openssl genrsa -passout pass:{{ ca_passphrase }} -des3 -out {{ openssl_temp_dir }}/private/cakey.pem 2048
openssl genrsa -passout pass:{{ ca_passphrase }} -aes256 -out {{ openssl_temp_dir }}/private/cakey.pem 2048
when:
- not (force_certs_update | default(false) | bool)
- name: Reuse previous CA private key
block:
- name: Write previous CA private key
copy:
content: "{{ private_key_content }}"
dest: "{{ openssl_temp_dir }}/private/cakey.pem"
no_log: true
when:
- force_certs_update | default(false) | bool
- not (force_private_key_update | default(false) | bool)
- name: Reuse and update previous CA private key
block:
- name: Write previous CA private key
copy:
content: "{{ private_key_content }}"
dest: "{{ openssl_temp_dir }}/private/cakey.old.pem"
no_log: true
- name: Update CA private key
shell: |
openssl rsa -aes256 \
-passin pass:{{ ca_passphrase }} \
-passout pass:{{ ca_passphrase }} \
-in {{ openssl_temp_dir }}/private/cakey.old.pem \
-out {{ openssl_temp_dir }}/private/cakey.pem
when:
- force_certs_update | default(false) | bool
- force_private_key_update | default(false) | bool
- name: Reading private key
become: true
@ -51,7 +83,7 @@
shell: |
openssl req -x509 -passin pass:{{ ca_passphrase }} -new -nodes -key {{ openssl_temp_dir }}/private/cakey.pem \
-subj "/C=US/ST=Denial/L=Springfield/O=Dis/CN=www.example.com" \
-days 365 -config {{ openssl_temp_dir }}/openssl.cnf \
-days 18250 -config {{ openssl_temp_dir }}/openssl.cnf \
-out {{ openssl_temp_dir }}/ca_01.pem
- name: Reading CA certificate
@ -74,7 +106,7 @@
become: true
shell: |
openssl ca -config {{ openssl_temp_dir }}/openssl.cnf -passin pass:{{ ca_passphrase }} -in {{ openssl_temp_dir }}/client.csr \
-days 365 -out {{ openssl_temp_dir }}/client-.pem -batch
-days 3650 -out {{ openssl_temp_dir }}/client-.pem -batch
- name: Read service private key and public certifcate
become: true

View File

@ -65,5 +65,6 @@
update_certs: false
when:
- (octavia_node_count | int) == (ca_certs | length)
- not (force_certs_update | default(false))
when:
- (ca_certs | length) > 0

View File

@ -13,4 +13,4 @@
- include_tasks: certs_gen.yml
when:
- generate_certs | bool
- (generate_ca | default(true)) | bool
- (generate_ca | default(true)) | bool or (force_certs_update | default(false) | bool)