Last active
August 11, 2021 13:07
-
-
Save h3po/8c82e9ee86ba8c12cb71d717b29a9d56 to your computer and use it in GitHub Desktop.
Ansible Playbook using the community.ciscosmb module to import externally generated ssl certificates to cisco small business series (SG300/SG500/SG550) switches. Standard PKCS#8 PEM files are converted to PKCS#1 format cisco wants.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #run with -e certdir=/some/path to point at the dir with your {{ inventory_hostname }}.pem and .key files | |
| - name: import wildcard certificate to the switches | |
| hosts: cisco_switch | |
| gather_facts: false | |
| become: false | |
| vars: | |
| certpath: "{{ certdir }}/{{ inventory_hostname }}.pem" | |
| keypath: "{{ certdir }}/{{ inventory_hostname }}.key" | |
| ansible_connection: network_cli | |
| ansible_network_os: community.ciscosmb.ciscosmb | |
| ansible_python_interpreter: auto_silent | |
| tasks: | |
| - name: prepare the certificate and key in cisco format | |
| delegate_to: localhost | |
| block: | |
| - name: check the certificate files | |
| stat: | |
| path: "{{ item }}" | |
| loop: | |
| - "{{ certpath }}" | |
| - "{{ keypath }}" | |
| register: tmp | |
| - name: fail if file does not exist | |
| fail: | |
| msg: "{{ item.item }} does not exist" | |
| when: not item.stat.exists | |
| loop: "{{ tmp.results }}" | |
| - name: read certificate into variable | |
| set_fact: | |
| cert: "{{ lookup('file', certpath) }}" | |
| - name: convert private key to pkcs#1 format | |
| command: "openssl rsa -in {{ keypath }} -outform pem" | |
| register: tmp1 | |
| - name: convert public key to pkcs#1 format | |
| command: "openssl rsa -in {{ keypath }} -outform pem -RSAPublicKey_out" | |
| register: tmp2 | |
| - name: read keys into variable | |
| set_fact: | |
| privkey: "{{ tmp1.stdout }}" | |
| pubkey: "{{ tmp2.stdout }}" | |
| #- debug: | |
| # msg: "{{ privkey }}\n{{ pubkey }}\n{{ cert }}\n" | |
| - name: upload the certificate and keys | |
| community.ciscosmb.command: | |
| commands: | |
| - config | |
| - "crypto certificate 2 import\n{{ privkey }}\n{{ pubkey }}\n{{ cert }}\n." | |
| register: tmp | |
| failed_when: "'Certificate imported successfully' not in tmp.stdout[1]" | |
| - name: enable the certificate | |
| community.ciscosmb.command: | |
| commands: | |
| - ip https certificate 2 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment