---
- name: Ensure openssl configs directory are present
  file:
    path: "{{ nginx_ssl_path }}/self-signed-openssl-configs/"
    state: directory
    mode: "0755"

- name: Template openssl configs
  template:
    src: self-signed-openssl-config.j2
    dest: "{{ nginx_ssl_path }}/self-signed-openssl-configs/{{ item.key }}.cnf"
  with_dict: "{{ wordpress_sites | combine(ssl_default_site) }}"
  when:
    - sites_use_ssl
    - ssl_enabled
    - item.value.ssl.provider | default('manual') == 'self-signed'

- name: Generate self-signed certificates
  shell: "openssl req -new -newkey rsa:2048 \
    -days 3650 -nodes -x509 -sha256 \
    -extensions req_ext -config {{ nginx_ssl_path }}/self-signed-openssl-configs/{{ item.key }}.cnf \
    -keyout {{ item.key | quote }}.key -out {{ item.key | quote }}.cert"
  args:
    executable: "/bin/bash"
    chdir: "{{ nginx_ssl_path }}"
    creates: "{{ item.key }}.*"
  with_dict: "{{ wordpress_sites | combine(ssl_default_site) }}"
  when:
    - sites_use_ssl
    - ssl_enabled
    - item.value.ssl.provider | default('manual') == 'self-signed'
  notify: reload nginx

- name: Clean up openssl configs directory
  file:
    path: "{{ nginx_ssl_path }}/self-signed-openssl-configs/"
    state: absent

---
- name: Ensure openssl configs directory are present
  file:
    path: "{{ nginx_ssl_path }}/self-signed-openssl-configs/"
    state: directory
    mode: "0755"

- name: Template openssl configs
  template:
    src: self-signed-openssl-config.j2
    dest: "{{ nginx_ssl_path }}/self-signed-openssl-configs/{{ item.key }}.cnf"
  with_dict: "{{ wordpress_sites | combine(ssl_default_site) }}"
  when:
    - sites_use_ssl
    - ssl_enabled
    - item.value.ssl.provider | default('manual') == 'self-signed'

- name: Generate self-signed certificates
  shell: "openssl req -new -newkey rsa:2048 \
    -days 825 -nodes -x509 -sha256 \
    -extensions req_ext -config {{ nginx_ssl_path }}/self-signed-openssl-configs/{{ item.key }}.cnf \
    -keyout {{ item.key | quote }}.key -out {{ item.key | quote }}.cert"
  args:
    executable: "/bin/bash"
    chdir: "{{ nginx_ssl_path }}"
    creates: "{{ item.key }}.*"
  with_dict: "{{ wordpress_sites | combine(ssl_default_site) }}"
  when:
    - sites_use_ssl
    - ssl_enabled
    - item.value.ssl.provider | default('manual') == 'self-signed'
  notify: reload nginx

- name: Clean up openssl configs directory
  file:
    path: "{{ nginx_ssl_path }}/self-signed-openssl-configs/"
    state: absent

Change self-signed certificate expiry time from 3650 days to 825, the new maximum time allowed under macOS Catalina
Change self-signed certificate expiry time
from 3650 days to 825, the new maximum time allowed under macOS Catalina
