|
@@ -1,14 +1,17 @@
|
1
|
1
|
- name: Copy SSL private key into place
|
2
|
2
|
copy: src=wildcard_private.key dest=/etc/ssl/private/wildcard_private.key group=ssl-cert owner=root mode=640
|
3
|
3
|
register: private_key
|
|
4
|
+ notify: restart apache
|
4
|
5
|
|
5
|
6
|
- name: Copy SSL public certificate into place
|
6
|
7
|
copy: src=wildcard_public_cert.crt dest=/etc/ssl/certs/wildcard_public_cert.crt group=root owner=root mode=644
|
7
|
8
|
register: certificate
|
|
9
|
+ notify: restart apache
|
8
|
10
|
|
9
|
11
|
- name: Copy CA combined certificate into place
|
10
|
12
|
copy: src=wildcard_ca.pem dest=/etc/ssl/certs/wildcard_ca.pem group=root owner=root mode=644
|
11
|
13
|
register: ca_certificate
|
|
14
|
+ notify: restart apache
|
12
|
15
|
|
13
|
16
|
- name: Create a combined version of the public cert with intermediate and root CAs
|
14
|
17
|
shell: cat /etc/ssl/certs/wildcard_public_cert.crt /etc/ssl/certs/wildcard_ca.pem >
|
|
@@ -17,6 +20,7 @@
|
17
|
20
|
|
18
|
21
|
- name: Set permissions on combined public cert
|
19
|
22
|
file: name=/etc/ssl/certs/wildcard_combined.pem mode=644
|
|
23
|
+ notify: restart apache
|
20
|
24
|
|
21
|
25
|
- name: Create strong Diffie-Hellman group
|
22
|
26
|
command: openssl dhparam -out /etc/ssl/private/dhparam2048.pem 2048
|
|
@@ -24,12 +28,14 @@
|
24
|
28
|
|
25
|
29
|
- name: Enable Apache SSL module
|
26
|
30
|
command: a2enmod ssl creates=/etc/apache2/mods-enabled/ssl.load
|
|
31
|
+ notify: restart apache
|
27
|
32
|
|
28
|
33
|
- name: Enable NameVirtualHost for HTTPS
|
29
|
34
|
lineinfile:
|
30
|
35
|
dest=/etc/apache2/ports.conf regexp='^ NameVirtualHost \*:443'
|
31
|
36
|
insertafter='^<IfModule mod_ssl.c>'
|
32
|
37
|
line=' NameVirtualHost *:443'
|
|
38
|
+ notify: restart apache
|
33
|
39
|
|
34
|
40
|
- name: Enable Apache SOCACHE_SHMCB module for the SSL stapling cache
|
35
|
41
|
command: a2enmod socache_shmcb
|
|
@@ -58,3 +64,4 @@
|
58
|
64
|
dest=/etc/apache2/ssl.conf
|
59
|
65
|
owner=root
|
60
|
66
|
group=root
|
|
67
|
+ notify: restart apache
|