Add certificate profile

library/certificate_request.py

@@ -167,6 +167,10 @@
       - as rendered by the template module
     type: str
     required: true
+  profile:
+    description:
+      - The certificate profile. Only used with certmonger.
+    required: false
 
 author:
   - Sergio Oliveira Campos (@seocam)
@@ -367,6 +371,8 @@ def _get_argument_spec():
             run_before=dict(type="str"),
             run_after=dict(type="str"),
             __header=dict(type="str"),
+            ansible_managed_new=dict(type="str"),
+            profile=dict(type="str"),
         )
 
     @property

module_utils/certificate_lsr/providers/certmonger.py

@@ -239,6 +239,11 @@ def request_certificate(self):
         if self.module.params["wait"]:
             command += ["-w"]
 
+        # Set profile
+        profile = self.module.params["profile"]
+        if profile:
+            command += ["-T", profile]
+
         # Set certificate locations
         if not self.exists_in_certmonger:
             command += ["-k", self.certificate_key_path]

tasks/main.yml

@@ -141,6 +141,8 @@
     run_after: "{{ item.run_after | default(omit) }}"
     ca: "{{ item.ca | default(omit) }}"
     __header: "{{ __lsr_ansible_managed }}"
+    ansible_managed_new: "{{ __certificate_new_header }}"
+    profile: "{{ item.profile | default(omit) }}"
   loop: "{{ certificate_requests }}"
   vars:
     __lsr_ansible_managed: "{{

tests/tasks/assert_certificate_parameters.yml

@@ -154,3 +154,25 @@
     fail_msg: >-
       {{ cert['auto_renew'] | default('yes') | bool }} !=
       {{ result.stdout | bool }}
+
+# On RHEL/CentOS 7, the output of 'getcert list' doesn't include the profile
+- when:
+    - cert['profile'] is defined
+    - not (ansible_os_family == 'RedHat' and
+        ansible_distribution_major_version is version('7', '<='))
+  block:
+    - name: Retrieve profile
+      shell: >-
+        set -euo pipefail;
+        getcert list -f {{ cert['path'] }} |
+        grep 'profile:' |
+        sed 's/^\s\+profile: //g'
+      register: result
+      changed_when: false
+
+    - name: Verify certificate profile
+      assert:
+        that:
+          - cert['profile']  == result.stdout
+        fail_msg: >-
+          {{ cert['profile'] }} != {{ result.stdout }}

tests/tests_basic_ipa.yml

@@ -21,6 +21,12 @@
         principal: HTTP/[email protected]
         ca: ipa
         group: ftp
+
+      - name: cert_with_profile
+        dns: ipaserver.test.local
+        principal: HTTP/[email protected]
+        ca: ipa
+        profile: caIPAserviceCert
   roles:
     - linux-system-roles.certificate
 
@@ -80,6 +86,32 @@
           - content_commitment
           - key_encipherment
           - data_encipherment
+
+      - path: /etc/pki/tls/certs/cert_with_profile.crt
+        key_path: /etc/pki/tls/private/cert_with_profile.key
+        owner: root
+        subject:
+          - name: commonName
+            oid: 2.5.4.3
+            value: ipaserver.test.local
+          - name: organizationName
+            oid: 2.5.4.10
+            value: TEST.LOCAL
+        subject_alt_name:
+          - name: DNS
+            value: ipaserver.test.local
+          - name: Universal Principal Name (UPN)
+            oid: 1.3.6.1.4.1.311.20.2.3
+            value: HTTP/[email protected]
+          - name: Kerberos principalname
+            oid: 1.3.6.1.5.2.2
+            value: HTTP/[email protected]
+        key_usage:
+          - digital_signature
+          - content_commitment
+          - key_encipherment
+          - data_encipherment
+        profile: caIPAserviceCert
   tasks:
     - name: Verify each certificate
       include_tasks: tasks/assert_certificate_parameters.yml