Ansible: Create a Self-Signed SSL Certificate and Key

Question

I want to create a self signed certificate to use it with stunnel, in order to securely tunnel my redis traffic between the redis server and client. I'm using this command to generate the certificate and it works fine.

openssl req -x509 -nodes -days 3650 -newkey rsa:2048 -keyout /etc/stunnel/redis-server.key -out /etc/stunnel/redis-server.crt

Since I'm using Ansible for provisioning, I would like to know how I can convert this into a more Ansible way of doing, using a module. There actually is a module called the openssl_certificate Ansible module and it states "This module allows one to (re)generate OpenSSL certificates.". I tried to use the module to generate the certificate, but I couldn't get it to work.

- name: Generate a Self Signed OpenSSL certificate
  openssl_certificate:
    path: /etc/stunnel/redis-server.crt
    privatekey_path: /etc/stunnel/redis-server.key
    csr_path: /etc/stunnel/redis-server.csr
    provider: selfsigned

From a look at the documentation, I can't specify the following arguments -x509 -nodes -days 3650 -newkey rsa:2048. Of course, I could also split the key and cert generation, but that still wouldn't allow me to use the Ansible module, correct?

Example given:

openssl genrsa -out /etc/stunnel/key.pem 4096

openssl req -new -x509 -key /etc/stunnel/key.pem -out /etc/stunnel/cert.pem -days 1826

I would like to know the following things:

• a) How can I get the same result from the original command, but using an Ansible module?
• b) Is there a better way to manage self signed certificates using Ansible?

Answer 1

- openssl_privatekey:
    path: /etc/stunnel/redis-server.key
    size: 2048 

- openssl_csr:
    path: /etc/stunnel/redis-server.csr
    privatekey_path: /etc/stunnel/redis-server.key

- openssl_certificate:
    provider: selfsigned
    path: /etc/stunnel/redis-server.crt
    privatekey_path: /etc/stunnel/redis-server.key
    csr_path:/etc/stunnel/redis-server.csr

• "-newkey rsa:2048" is dealt with "size" on privatekey
• "-x509" is defaulted
• "-nodes" and "-days 3650" I couldn't find