rclayton-the-terrible / ansible-openssl Goto Github PK

I'm using this role to create certs for Bacula. It seems it needs certain cert features to be present, which I don't seem to be able to provide.

I create the CA like this:

- name: Create a CA
  ca: certdir="/etc/certs" subj="/DC=com/DC=mycompany/CN={{ ansible_fqdn }}"

And I create the cert like this:

- name: Create a self-signed, self-CA server cert for general use
  certificate: cadir="/etc/certs" hostname="{{ inventory_hostname }}" subj="/DC=com/DC=mycompany/CN={{ ansible_fqdn }}/" p12password="{{ server_cert_password }}"
  delegate_to: localhost

(I then copy the cert files created on my ansible server to the backups server)

However, following some info on http://list.resiprocate.org/archive/resiprocate-devel/msg08059.html, if I ask what the cert is usable for, I get this:

# openssl x509 -text -noout -in server/backups.cert.pem | egrep 'Extend|TLS'
            X509v3 Extended Key Usage:
                TLS Web Server Authentication

It appears I need something more like this:

            X509v3 Extended Key Usage:
                TLS Web Client Authentication, TLS Web Server
Authentication, Netscape Server Gated Crypto, Microsoft Server Gated Crypto

Is there a way to specify cert options, or to change the defaults that a 'server' cert is built with?

I'm very interested in some of the work you've done here, but I don't see a license within the repo or in any of the source files. Have you considered an open source license, like Apache 2 or MIT, for your code?