---
- name: Issue simple self-signed certificate
  hosts: all

  vars:
    certificate_requests:
      - name: mycert_key_usage_and_extended_key_usage
        dns: www.example.com
        key_usage:
          - digitalSignature
          - nonRepudiation
          - keyEncipherment
        extended_key_usage:
          - id-kp-clientAuth
          - id-kp-serverAuth
          - id-kp-ipsecTunnel
          - 1.3.6.1.5.2.3.5
        ca: self-sign
  roles:
    - linux-system-roles.certificate

- name: Verify certificate
  hosts: all
  vars:
    certificates:
      - path: /etc/pki/tls/certs/mycert_key_usage_and_extended_key_usage.crt
        key_path: >-
          /etc/pki/tls/private/mycert_key_usage_and_extended_key_usage.key
        subject:
          - name: commonName
            oid: 2.5.4.3
            value: www.example.com
        subject_alt_name:
          - name: DNS
            value: www.example.com
        key_usage:
          - digital_signature
          - content_commitment
          - key_encipherment
        extended_key_usage:
          - name: id-kp-clientAuth
            oid: 1.3.6.1.5.5.7.3.2
          - name: id-kp-serverAuth
            oid: 1.3.6.1.5.5.7.3.1
          - name: id-kp-ipsecTunnel
            oid: 1.3.6.1.5.5.7.3.6
          - name:
            oid: 1.3.6.1.5.2.3.5
  tasks:
    - name: Verify each certificate
      include_tasks: tasks/assert_certificate_parameters.yml
      loop: "{{ certificates }}"
      loop_control:
        loop_var: cert
