certificates: rework to use Ansible modules

Add keyCertSign and digitalSignature key_usage required by Python 3.13 [1]

[1]: https://github.com/canonical/microk8s/issues/4864

Change-Id: Ia0c55ed6137b0ccd16815f9f7a49b3b30a982154
Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>

11 files changed, 171 insertions, 294 deletions

diff --git a/ansible/roles/certificates/defaults/main.yml b/ansible/roles/certificates/defaults/main.yml
index 473bbb40d..156a5c7fd 100644
--- a/ansible/roles/certificates/defaults/main.yml
+++ b/ansible/roles/certificates/defaults/main.yml
@@ -1,9 +1,9 @@
 ---
-root_dir: "{{ kolla_certificates_dir }}/private/root"
-external_dir: "{{ kolla_certificates_dir }}/private/external"
-internal_dir: "{{ kolla_certificates_dir }}/private/internal"
-backend_dir: "{{ kolla_certificates_dir }}/private/backend"
-libvirt_dir: "{{ kolla_certificates_dir }}/private/libvirt"
+certificates_root_dir: "{{ kolla_certificates_dir }}/private/root"
+certificates_external_dir: "{{ kolla_certificates_dir }}/private/external"
+certificates_internal_dir: "{{ kolla_certificates_dir }}/private/internal"
+certificates_backend_dir: "{{ kolla_certificates_dir }}/private/backend"
+certificates_libvirt_dir: "{{ kolla_certificates_dir }}/private/libvirt"
 
 # Whether to generate certificates for libvirt TLS.
 certificates_generate_libvirt: "{{ libvirt_tls | default(false) | bool }}"
diff --git a/ansible/roles/certificates/tasks/generate-backend.yml b/ansible/roles/certificates/tasks/generate-backend.yml
index 4c33f6eb8..3265b82dd 100644
--- a/ansible/roles/certificates/tasks/generate-backend.yml
+++ b/ansible/roles/certificates/tasks/generate-backend.yml
@@ -1,67 +1,53 @@
 ---
 - name: Ensuring private backend directory exist
   file:
-    path: "{{ backend_dir }}"
-    state: "directory"
+    path: "{{ certificates_backend_dir }}"
     mode: "0770"
-
-- name: Creating backend SSL configuration file
-  template:
-    src: "{{ item }}.j2"
-    dest: "{{ kolla_certificates_dir }}/{{ item }}"
-    mode: "0660"
-  with_items:
-    - "openssl-kolla-backend.cnf"
+    state: "directory"
 
 - name: Creating backend Server Certificate key
-  command: >
-    openssl genrsa
-    -out "{{ backend_dir }}/backend.key" 2048
-  args:
-    creates: "{{ kolla_tls_backend_key }}"
+  community.crypto.openssl_privatekey:
+    path: "{{ certificates_backend_dir }}/backend.key"
+    mode: "0660"
+    size: 2048
+    type: RSA
 
 - name: Creating backend Server Certificate signing request
-  command: >
-    openssl req
-    -new
-    -key "{{ backend_dir }}/backend.key"
-    -out "{{ backend_dir }}/backend.csr"
-    -config "{{ kolla_certificates_dir }}/openssl-kolla-backend.cnf"
-    -sha256
-  args:
-    creates: "{{ backend_dir }}/backend.csr"
-
-- name: Creating backend Server Certificate
-  command: >
-    openssl x509
-    -req
-    -in "{{ backend_dir }}/backend.csr"
-    -CA "{{ root_dir }}/root.crt"
-    -CAkey "{{ root_dir }}/root.key"
-    -CAcreateserial
-    -extensions v3_req
-    -extfile "{{ kolla_certificates_dir }}/openssl-kolla-backend.cnf"
-    -out "{{ backend_dir }}/backend.crt"
-    -days 500
-    -sha256
-  args:
-    creates: "{{ backend_dir }}/backend.crt"
+  community.crypto.openssl_csr:
+    path: "{{ certificates_backend_dir }}/backend.csr"
+    digest: "sha256"
+    country_name: "US"
+    locality_name: "RTP"
+    state_or_province_name: "NC"
+    organizational_unit_name: "kolla"
+    privatekey_path: "{{ certificates_backend_dir }}/backend.key"
+    subject_alt_name: >-
+      {%- set _san = [] -%}
+      {%- for host in groups['tls-backend'] -%}
+      {{ _san.append('IP:' ~ ('api' | kolla_address(host))) }}
+      {%- endfor -%}
+      {{ _san }}
 
-- name: Setting permissions on backend key
-  file:
-    path: "{{ backend_dir }}/backend.key"
-    mode: "0660"
-    state: file
+- name: Creating backend Server Certificate from CSR
+  community.crypto.x509_certificate:
+    path: "{{ certificates_backend_dir }}/backend.crt"
+    csr_path: "{{ certificates_backend_dir }}/backend.csr"
+    ownca_digest: "sha256"
+    ownca_not_after: "+500d"
+    ownca_path: "{{ certificates_root_dir }}/root.crt"
+    ownca_privatekey_path: "{{ certificates_root_dir }}/root.key"
+    privatekey_path: "{{ certificates_backend_dir }}/backend.key"
+    provider: ownca
 
 - name: Copy backend cert to default configuration location
   copy:
-    src: "{{ backend_dir }}/backend.crt"
+    src: "{{ certificates_backend_dir }}/backend.crt"
     dest: "{{ kolla_certificates_dir }}/backend-cert.pem"
     mode: "0660"
 
 - name: Copy backend key to default configuration location
   copy:
-    src: "{{ backend_dir }}/backend.key"
+    src: "{{ certificates_backend_dir }}/backend.key"
     dest: "{{ kolla_certificates_dir }}/backend-key.pem"
     mode: "0660"
 
diff --git a/ansible/roles/certificates/tasks/generate-libvirt.yml b/ansible/roles/certificates/tasks/generate-libvirt.yml
index c65512750..fec5cb821 100644
--- a/ansible/roles/certificates/tasks/generate-libvirt.yml
+++ b/ansible/roles/certificates/tasks/generate-libvirt.yml
@@ -1,55 +1,47 @@
 ---
 - name: Ensuring private libvirt directory exist
   file:
-    path: "{{ libvirt_dir }}"
-    state: "directory"
+    path: "{{ certificates_libvirt_dir }}"
     mode: "0770"
-
-- name: Creating libvirt SSL configuration file
-  template:
-    src: "{{ item }}.j2"
-    dest: "{{ kolla_certificates_dir }}/{{ item }}"
-    mode: "0660"
-  with_items:
-    - "openssl-kolla-libvirt.cnf"
+    state: "directory"
 
 - name: Creating libvirt certificate key
-  command: >
-    openssl genrsa
-    -out "{{ libvirt_dir }}/libvirt.key" 2048
-  args:
-    creates: "{{ libvirt_dir }}/libvirt.key"
+  community.crypto.openssl_privatekey:
+    path: "{{ certificates_libvirt_dir }}/libvirt.key"
+    mode: "0660"
+    size: 2048
+    type: RSA
 
 - name: Creating libvirt certificate signing request
-  command: >
-    openssl req
-    -new
-    -key "{{ libvirt_dir }}/libvirt.key"
-    -out "{{ libvirt_dir }}/libvirt.csr"
-    -config "{{ kolla_certificates_dir }}/openssl-kolla-libvirt.cnf"
-    -sha256
-  args:
-    creates: "{{ libvirt_dir }}/libvirt.csr"
+  community.crypto.openssl_csr:
+    path: "{{ certificates_libvirt_dir }}/libvirt.csr"
+    country_name: "US"
+    digest: "sha256"
+    locality_name: "RTP"
+    organizational_unit_name: "kolla"
+    privatekey_path: "{{ certificates_libvirt_dir }}/libvirt.key"
+    state_or_province_name: "NC"
+    subject_alt_name: >-
+      {%- set _san = [] -%}
+      {%- for host in groups['compute'] -%}
+      {{ _san.append('DNS:' ~ (hostvars[host].migration_hostname | default(hostvars[host].ansible_facts.nodename))) }}
+      {%- endfor -%}
+      {{ _san }}
 
-- name: Creating libvirt certificate
-  command: >
-    openssl x509
-    -req
-    -in "{{ libvirt_dir }}/libvirt.csr"
-    -CA "{{ root_dir }}/root.crt"
-    -CAkey "{{ root_dir }}/root.key"
-    -CAcreateserial
-    -extensions v3_req
-    -extfile "{{ kolla_certificates_dir }}/openssl-kolla-libvirt.cnf"
-    -out "{{ libvirt_dir }}/libvirt.crt"
-    -days 500
-    -sha256
-  args:
-    creates: "{{ libvirt_dir }}/libvirt.crt"
+- name: Creating libvirt certificate from CSR
+  community.crypto.x509_certificate:
+    path: "{{ certificates_libvirt_dir }}/libvirt.crt"
+    csr_path: "{{ certificates_libvirt_dir }}/libvirt.csr"
+    ownca_digest: "sha256"
+    ownca_not_after: "+500d"
+    ownca_path: "{{ certificates_root_dir }}/root.crt"
+    ownca_privatekey_path: "{{ certificates_root_dir }}/root.key"
+    privatekey_path: "{{ certificates_libvirt_dir }}/libvirt.key"
+    provider: ownca
 
 - name: Setting permissions on libvirt key
   file:
-    path: "{{ libvirt_dir }}/libvirt.key"
+    path: "{{ certificates_libvirt_dir }}/libvirt.key"
     mode: "0660"
     state: file
 
@@ -61,13 +53,13 @@
 
 - name: Copy libvirt root CA to default configuration location
   copy:
-    src: "{{ root_dir }}/root.crt"
+    src: "{{ certificates_root_dir }}/root.crt"
     dest: "{{ certificates_libvirt_output_dir }}/cacert.pem"
     mode: "0660"
 
 - name: Copy libvirt cert to default configuration locations
   copy:
-    src: "{{ libvirt_dir }}/libvirt.crt"
+    src: "{{ certificates_libvirt_dir }}/libvirt.crt"
     dest: "{{ certificates_libvirt_output_dir }}/{{ item }}cert.pem"
     mode: "0660"
   loop:
@@ -76,7 +68,7 @@
 
 - name: Copy libvirt key to default configuration locations
   copy:
-    src: "{{ libvirt_dir }}/libvirt.key"
+    src: "{{ certificates_libvirt_dir }}/libvirt.key"
     dest: "{{ certificates_libvirt_output_dir }}/{{ item }}key.pem"
     mode: "0660"
   loop:
diff --git a/ansible/roles/certificates/tasks/generate-root.yml b/ansible/roles/certificates/tasks/generate-root.yml
index ac7e8d4bf..761b77148 100644
--- a/ansible/roles/certificates/tasks/generate-root.yml
+++ b/ansible/roles/certificates/tasks/generate-root.yml
@@ -7,39 +7,41 @@
 
 - name: Ensuring private root directory exist
   file:
-    path: "{{ root_dir }}"
+    path: "{{ certificates_root_dir }}"
     state: "directory"
     mode: "0770"
 
-- name: Creating root Certificate key
-  command: >
-    openssl genrsa
-    -out "{{ root_dir }}/root.key"
-    4096
-  args:
-    creates: "{{ root_dir }}/root.key"
+- name: Creating root certificate key
+  community.crypto.openssl_privatekey:
+    path: "{{ certificates_root_dir }}/root.key"
+    mode: "0660"
+    size: 4096
+    type: RSA
 
-- name: Creating and sign root Certificate
-  command: >
-    openssl req
-    -x509
-    -new -nodes
-    -key "{{ root_dir }}/root.key"
-    -sha256
-    -days 1024
-    -out "{{ root_dir }}/root.crt"
-    -subj "/CN=KollaTestCA/"
-  args:
-    creates: "{{ root_dir }}/root.crt"
+- name: Create certificate signing request (CSR) for new certificate
+  community.crypto.openssl_csr:
+    path: "{{ certificates_root_dir }}/root.csr"
+    basic_constraints:
+      - 'CA:TRUE'
+    basic_constraints_critical: true
+    common_name: "KollaTestCA"
+    key_usage:
+      - digitalSignature
+      - keyCertSign
+    key_usage_critical: true
+    privatekey_path: "{{ certificates_root_dir }}/root.key"
+    use_common_name_for_san: false
 
-- name: Setting permissions on root key
-  file:
-    path: "{{ root_dir }}/root.key"
-    mode: "0660"
-    state: file
+- name: Create self-signed CA certificate from CSR
+  community.crypto.x509_certificate:
+    path: "{{ certificates_root_dir }}/root.crt"
+    csr_path: "{{ certificates_root_dir }}/root.csr"
+    privatekey_path: "{{ certificates_root_dir }}/root.key"
+    provider: selfsigned
+    selfsigned_not_after: "+1024d"
 
-- name: Creating root Certificate file to be included in container trusted ca-certificates
+- name: Copy root certificate file to be included in container trusted ca-certificates
   copy:
-    src: "{{ root_dir }}/root.crt"
+    src: "{{ certificates_root_dir }}/root.crt"
     dest: "{{ kolla_certificates_dir }}/ca/root.crt"
     mode: "0660"
diff --git a/ansible/roles/certificates/tasks/generate.yml b/ansible/roles/certificates/tasks/generate.yml
index 68af5f9b2..009d17dae 100644
--- a/ansible/roles/certificates/tasks/generate.yml
+++ b/ansible/roles/certificates/tasks/generate.yml
@@ -1,13 +1,13 @@
 ---
 - name: Ensuring private internal directory exist
   file:
-    path: "{{ internal_dir }}"
+    path: "{{ certificates_internal_dir }}"
     state: "directory"
     mode: "0770"
 
 - name: Ensuring private external directory exist
   file:
-    path: "{{ external_dir }}"
+    path: "{{ certificates_external_dir }}"
     state: "directory"
     mode: "0770"
 
@@ -16,58 +16,43 @@
     - letsencrypt_managed_certs == 'internal' or letsencrypt_managed_certs == '' or database_enable_tls_internal | bool
     - kolla_enable_tls_external | bool or database_enable_tls_internal | bool
   block:
-    - name: Creating external SSL configuration file
-      template:
-        src: "{{ item }}.j2"
-        dest: "{{ kolla_certificates_dir }}/{{ item }}"
-        mode: "0660"
-      with_items:
-        - "openssl-kolla.cnf"
-
     - name: Creating external Server Certificate key
-      command: >
-        openssl genrsa
-        -out "{{ external_dir }}/external.key" 2048
-      args:
-        creates: "{{ external_dir }}/external.key"
+      community.crypto.openssl_privatekey:
+        path: "{{ certificates_external_dir }}/external.key"
+        mode: "0660"
+        size: 2048
+        type: RSA
 
     - name: Creating external Server Certificate signing request
-      command: >
-        openssl req
-        -new
-        -key "{{ external_dir }}/external.key"
-        -out "{{ external_dir }}/external.csr"
-        -config "{{ kolla_certificates_dir }}/openssl-kolla.cnf"
-        -sha256
-      args:
-        creates: "{{ external_dir }}/external.csr"
-
-    - name: Creating external Server Certificate
-      command: >
-        openssl x509
-        -req
-        -in "{{ external_dir }}/external.csr"
-        -CA "{{ root_dir }}/root.crt"
-        -CAkey "{{ root_dir }}/root.key"
-        -CAcreateserial
-        -extensions v3_req
-        -extfile "{{ kolla_certificates_dir }}/openssl-kolla.cnf"
-        -out "{{ external_dir }}/external.crt"
-        -days 365
-        -sha256
-      args:
-        creates: "{{ external_dir }}/external.crt"
-
-    - name: Setting permissions on external key
-      file:
-        path: "{{ external_dir }}/external.key"
-        mode: "0660"
-        state: file
+      vars:
+        _san:
+          - "{{ ('DNS:' ~ kolla_external_fqdn) if kolla_external_fqdn != kolla_external_vip_address }}"
+          - "IP:{{ kolla_external_vip_address }}"
+      community.crypto.openssl_csr:
+        path: "{{ certificates_external_dir }}/external.csr"
+        country_name: "US"
+        digest: "sha256"
+        locality_name: "RTP"
+        organizational_unit_name: "kolla"
+        privatekey_path: "{{ certificates_external_dir }}/external.key"
+        state_or_province_name: "NC"
+        subject_alt_name: "{{ _san | select() }}"
+
+    - name: Create external Server Certificate from CSR
+      community.crypto.x509_certificate:
+        path: "{{ certificates_external_dir }}/external.crt"
+        csr_path: "{{ certificates_external_dir }}/external.csr"
+        ownca_digest: "sha256"
+        ownca_not_after: "+365d"
+        ownca_path: "{{ certificates_root_dir }}/root.crt"
+        ownca_privatekey_path: "{{ certificates_root_dir }}/root.key"
+        privatekey_path: "{{ certificates_external_dir }}/external.key"
+        provider: ownca
 
 - name: Creating external Server PEM File
   assemble:
     regexp: \.(crt|key)$
-    src: "{{ external_dir }}"
+    src: "{{ certificates_external_dir }}"
     dest: "{{ kolla_external_fqdn_cert }}"
     mode: "0660"
   when:
@@ -81,13 +66,13 @@
   block:
     - name: Copy Certificate for ProxySQL
       copy:
-        src: "{{ external_dir }}/external.crt"
+        src: "{{ certificates_external_dir }}/external.crt"
         dest: "{{ kolla_certificates_dir }}/proxysql-cert.pem"
         mode: "0660"
 
     - name: Copy Key for ProxySQL
       copy:
-        src: "{{ external_dir }}/external.key"
+        src: "{{ certificates_external_dir }}/external.key"
         dest: "{{ kolla_certificates_dir }}/proxysql-key.pem"
         mode: "0660"
 
@@ -95,8 +80,8 @@
   copy:
     src: "{{ kolla_external_fqdn_cert }}"
     dest: "{{ kolla_internal_fqdn_cert }}"
-    remote_src: true
     mode: "0660"
+    remote_src: true
   when:
     - letsencrypt_managed_certs == 'external' or letsencrypt_managed_certs == ''
     - kolla_enable_tls_external | bool
@@ -109,58 +94,43 @@
     - kolla_enable_tls_internal | bool or database_enable_tls_internal | bool
     - not kolla_same_external_internal_vip | bool
   block:
-    - name: Creating internal SSL configuration file
-      template:
-        src: "{{ item }}.j2"
-        dest: "{{ kolla_certificates_dir }}/{{ item }}"
-        mode: "0660"
-      with_items:
-        - "openssl-kolla-internal.cnf"
-
     - name: Creating internal Server Certificate key
-      command: >
-        openssl genrsa
-        -out "{{ internal_dir }}/internal.key" 2048
-      args:
-        creates: "{{ internal_dir }}/internal.key"
+      community.crypto.openssl_privatekey:
+        path: "{{ certificates_internal_dir }}/internal.key"
+        mode: "0660"
+        size: 2048
+        type: RSA
 
     - name: Creating internal Server Certificate signing request
-      command: >
-        openssl req
-        -new
-        -key "{{ internal_dir }}/internal.key"
-        -out "{{ internal_dir }}/internal.csr"
-        -config "{{ kolla_certificates_dir }}/openssl-kolla-internal.cnf"
-        -sha256
-      args:
-        creates: "{{ internal_dir }}/internal.csr"
-
-    - name: Creating internal Server Certificate
-      command: >
-        openssl x509
-        -req
-        -in "{{ internal_dir }}/internal.csr"
-        -CA "{{ root_dir }}/root.crt"
-        -CAkey "{{ root_dir }}/root.key"
-        -CAcreateserial
-        -extensions v3_req
-        -extfile "{{ kolla_certificates_dir }}/openssl-kolla-internal.cnf"
-        -out "{{ internal_dir }}/internal.crt"
-        -days 365
-        -sha256
-      args:
-        creates: "{{ internal_dir }}/internal.crt"
-
-    - name: Setting permissions on internal key
-      file:
-        path: "{{ internal_dir }}/internal.key"
-        mode: "0660"
-        state: file
+      vars:
+        _san:
+          - "{{ ('DNS:' ~ kolla_internal_fqdn) if kolla_internal_fqdn != kolla_internal_vip_address }}"
+          - "IP:{{ kolla_internal_vip_address }}"
+      community.crypto.openssl_csr:
+        path: "{{ certificates_internal_dir }}/internal.csr"
+        country_name: "US"
+        digest: "sha256"
+        locality_name: "RTP"
+        organizational_unit_name: "kolla"
+        privatekey_path: "{{ certificates_internal_dir }}/internal.key"
+        state_or_province_name: "NC"
+        subject_alt_name: "{{ _san | select() }}"
+
+    - name: Create internal Server Certificate from CSR
+      community.crypto.x509_certificate:
+        path: "{{ certificates_internal_dir }}/internal.crt"
+        csr_path: "{{ certificates_internal_dir }}/internal.csr"
+        ownca_digest: "sha256"
+        ownca_not_after: "+365d"
+        ownca_path: "{{ certificates_root_dir }}/root.crt"
+        ownca_privatekey_path: "{{ certificates_root_dir }}/root.key"
+        privatekey_path: "{{ certificates_internal_dir }}/internal.key"
+        provider: ownca
 
 - name: Creating internal Server PEM File
   assemble:
     regexp: \.(crt|key)$
-    src: "{{ internal_dir }}"
+    src: "{{ certificates_internal_dir }}"
     dest: "{{ kolla_internal_fqdn_cert }}"
     mode: "0660"
   when:
@@ -175,12 +145,12 @@
   block:
     - name: Copy Certificate for ProxySQL
       copy:
-        src: "{{ internal_dir }}/internal.crt"
+        src: "{{ certificates_internal_dir }}/internal.crt"
         dest: "{{ kolla_certificates_dir }}/proxysql-cert.pem"
         mode: "0660"
 
     - name: Copy Key for ProxySQL
       copy:
-        src: "{{ internal_dir }}/internal.key"
+        src: "{{ certificates_internal_dir }}/internal.key"
         dest: "{{ kolla_certificates_dir }}/proxysql-key.pem"
         mode: "0660"
diff --git a/ansible/roles/certificates/templates/openssl-kolla-backend.cnf.j2 b/ansible/roles/certificates/templates/openssl-kolla-backend.cnf.j2
deleted file mode 100644
index bd862832a..000000000
--- a/ansible/roles/certificates/templates/openssl-kolla-backend.cnf.j2
+++ /dev/null
@@ -1,18 +0,0 @@
-[req]
-prompt = no
-distinguished_name = req_distinguished_name
-req_extensions = v3_req
-
-[req_distinguished_name]
-countryName = US
-stateOrProvinceName = NC
-localityName = RTP
-organizationalUnitName = kolla
-
-[v3_req]
-subjectAltName = @alt_names
-
-[alt_names]
-{% for host in groups['tls-backend']%}
-IP.{{ loop.index }} = {{ 'api' | kolla_address(host) }}
-{% endfor %}
diff --git a/ansible/roles/certificates/templates/openssl-kolla-internal.cnf.j2 b/ansible/roles/certificates/templates/openssl-kolla-internal.cnf.j2
deleted file mode 100644
index e41313032..000000000
--- a/ansible/roles/certificates/templates/openssl-kolla-internal.cnf.j2
+++ /dev/null
@@ -1,19 +0,0 @@
-[req]
-prompt = no
-distinguished_name = req_distinguished_name
-req_extensions = v3_req
-
-[req_distinguished_name]
-countryName = US
-stateOrProvinceName = NC
-localityName = RTP
-organizationalUnitName = kolla
-
-[v3_req]
-subjectAltName = @alt_names
-
-[alt_names]
-{% if kolla_internal_fqdn != kolla_internal_vip_address %}
-DNS.1 = {{ kolla_internal_fqdn }}
-{% endif %}
-IP.1 = {{ kolla_internal_vip_address }}
diff --git a/ansible/roles/certificates/templates/openssl-kolla-libvirt.cnf.j2 b/ansible/roles/certificates/templates/openssl-kolla-libvirt.cnf.j2
deleted file mode 100644
index f625e03a4..000000000
--- a/ansible/roles/certificates/templates/openssl-kolla-libvirt.cnf.j2
+++ /dev/null
@@ -1,18 +0,0 @@
-[req]
-prompt = no
-distinguished_name = req_distinguished_name
-req_extensions = v3_req
-
-[req_distinguished_name]
-countryName = US
-stateOrProvinceName = NC
-localityName = RTP
-organizationalUnitName = kolla
-
-[v3_req]
-subjectAltName = @alt_names
-
-[alt_names]
-{% for host in groups['compute'] %}
-DNS.{{ loop.index }} = {{ hostvars[host].migration_hostname | default(hostvars[host].ansible_facts.nodename) }}
-{% endfor %}
diff --git a/ansible/roles/certificates/templates/openssl-kolla.cnf.j2 b/ansible/roles/certificates/templates/openssl-kolla.cnf.j2
deleted file mode 100644
index 0e828df6b..000000000
--- a/ansible/roles/certificates/templates/openssl-kolla.cnf.j2
+++ /dev/null
@@ -1,19 +0,0 @@
-[req]
-prompt = no
-distinguished_name = req_distinguished_name
-req_extensions = v3_req
-
-[req_distinguished_name]
-countryName = US
-stateOrProvinceName = NC
-localityName = RTP
-organizationalUnitName = kolla
-
-[v3_req]
-subjectAltName = @alt_names
-
-[alt_names]
-{% if kolla_external_fqdn != kolla_external_vip_address %}
-DNS.1 = {{ kolla_external_fqdn }}
-{% endif %}
-IP.1 = {{ kolla_external_vip_address }}
diff --git a/zuul.d/base.yaml b/zuul.d/base.yaml
index 33eff0080..65fef1fb6 100644
--- a/zuul.d/base.yaml
+++ b/zuul.d/base.yaml
@@ -14,6 +14,7 @@
     files:
       - ^ansible/site.yml
       - ^ansible/group_vars/all/common.yml
+      - ^ansible/roles/certificates/
       - ^requirements-core.yml
       - ^roles/kolla-ansible-test-dashboard/
       - ^tests/check-(config|failure|logs).sh
diff --git a/zuul.d/scenarios/cephadm.yaml b/zuul.d/scenarios/cephadm.yaml
index 3df106c99..115589a79 100644
--- a/zuul.d/scenarios/cephadm.yaml
+++ b/zuul.d/scenarios/cephadm.yaml
@@ -6,7 +6,7 @@
     files:
       - ^ansible/group_vars/all/(ceph|ceph-rgw|common|fluentd|glance|heat|horizon|keepalived|keystone|loadbalancer|neutron|nova|openvswitch|placement|proxysql|rabbitmq|valkey).yml
       - ^ansible/group_vars/baremetal/ansible-python-interpreter.yml
-      - ^ansible/roles/(ceph-rgw|common|fluentd|glance|haproxy-config|heat|horizon|keystone|loadbalancer|loadbalancer-config|neutron|nova|openvswitch|placement|proxysql|rabbitmq|valkey)/
+      - ^ansible/roles/(ceph-rgw|certificates|common|fluentd|glance|haproxy-config|heat|horizon|keystone|loadbalancer|loadbalancer-config|neutron|nova|openvswitch|placement|proxysql|rabbitmq|valkey)/
       - ^roles/cephadm/
     vars:
       kolla_ansible_setup_disks_file_path: "/var/lib/ceph-osd.img"