---
- name: Issue certificate with dns, ip and email in SAN
  hosts: all
  vars:
    certificate_requests:
      - name: mycert_dns_ip_email
        common_name: My Certificate with SAN
        dns:
          - sub1.example.com
          - www.example.com
          - sub2.example.com
          - sub3.example.com
        ip:
          - 192.0.2.12
          - 198.51.100.65
          - 2001:db8::2:1
        email:
          - sysadmin@example.com
          - support@example.com
        ca: self-sign
  roles:
    - linux-system-roles.certificate

- name: Verify certificate
  hosts: all
  vars:
    certificates:
      - path: /etc/pki/tls/certs/mycert_dns_ip_email.crt
        key_path: /etc/pki/tls/private/mycert_dns_ip_email.key
        subject:
          - name: commonName
            oid: 2.5.4.3
            value: My Certificate with SAN
        subject_alt_name:
          - name: DNS
            value: sub1.example.com
          - name: DNS
            value: www.example.com
          - name: DNS
            value: sub2.example.com
          - name: DNS
            value: sub3.example.com
          - name: email
            value: sysadmin@example.com
          - name: email
            value: support@example.com
          - name: IP Address
            value: 192.0.2.12
          - name: IP Address
            value: 198.51.100.65
          - name: IP Address
            value: 2001:db8::2:1
  tasks:
    - name: Verify each certificate
      include_tasks: tasks/assert_certificate_parameters.yml
      loop: "{{ certificates }}"
      loop_control:
        loop_var: cert
