Use community.crypto for the certificates role

* Use the community.crypto module
* Fix re-generating certs
* --reset-certificate-cname

Author: stejskalleos

.claude/settings.local.json

@@ -0,0 +1,11 @@
+{
+  "permissions": {
+    "allow": [
+      "Bash(./foremanctl --help)",
+      "Bash(./forge --help)",
+      "Bash(./setup-environment)",
+      "Bash(./forge vms)",
+      "Bash(./foremanctl deploy)"
+    ]
+  }
+}

CLAUDE.md

@@ -0,0 +1,206 @@
+# CLAUDE.md
+
+This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+
+## Project Overview
+
+foremanctl is a deployment tool for Foreman and Katello using Podman quadlets and Ansible. It targets Foreman 3.18 with Katello 4.20, Pulp 3.85, and Candlepin 4.6 on CentOS Stream 9 with ansible-core 2.14.
+
+The project uses the [obsah](https://pypi.org/project/obsah/) CLI framework. Two main executables wrap obsah:
+
+- `./foremanctl` - production deployment tool (uses src/ directory)
+- `./forge` - development/testing tool (uses development/ directory)
+
+## Setup
+
+```bash
+./setup-environment          # Creates virtualenv and installs dependencies
+source .venv/bin/activate    # Activate the virtualenv
+```
+
+This installs dependencies from `src/requirements.txt` and `development/requirements.txt`, and builds Ansible collections in `build/collections/`.
+
+## Common Commands
+
+### Deployment (Development)
+
+```bash
+./forge vms start                                                                   # Start Vagrant VMs
+./foremanctl deploy --foreman-initial-admin-password=changeme --tuning development  # Deploy Foreman
+./forge vms stop                                                                    # Stop VMs
+```
+
+### Optional Features
+
+```bash
+./forge setup-repositories                       # Setup repositories
+./foremanctl deploy --add-feature hammer         # Deploy with hammer CLI
+./foremanctl features                            # List enabled and available features
+```
+
+### Testing
+
+```bash
+./forge test                   # Run pytest-based integration tests (requires deployment)
+./forge smoker                 # Run smoker-based tests
+```
+
+Test execution generates SSH config at `.tmp/ssh-config` and runs pytest with testinfra. Tests require an active deployment. Hammer tests require hammer to be deployed.
+
+To run specific tests or with custom pytest arguments, use:
+
+```bash
+./forge test -- -k test_name  # Pass additional pytest arguments after --
+```
+
+### Linting
+
+```bash
+ansible-lint src/             # Lint production playbooks/roles
+ansible-lint development/     # Lint development playbooks/roles
+```
+
+Configuration is in `.ansible-lint`.
+
+### Building
+
+```bash
+make dist                     # Create distribution tarball (foremanctl-VERSION.tar.gz)
+make clean-var                # Clean .var directory
+```
+
+## Architecture
+
+### Directory Structure
+
+- **src/** - Production Ansible content
+  - **playbooks/** - Main playbooks organized by action (deploy, checks, pull-images, features, setup-*)
+  - **roles/** - Ansible roles for each component (foreman, pulp, candlepin, postgresql, httpd, hammer, certificates, etc.)
+  - **vars/** - Configuration variables
+    - **flavors/** - Feature sets (e.g., katello.yml defines enabled features)
+    - **tuning/** - Resource tuning profiles (development, default, medium, large, extra-large, extra-extra-large)
+    - **base.yaml**, **database.yml**, **foreman.yml**, **images.yml** - Base configuration
+    - **default_certificates.yml**, **installer_certificates.yml** - Certificate sources
+  - **features.yaml** - Feature definitions with dependencies
+  - **filter_plugins/**, **callback_plugins/** - Ansible plugins
+
+- **development/** - Development-specific Ansible content
+  - **playbooks/** - Development playbooks (vms, test, smoker, setup-repositories, etc.)
+  - **roles/** - Development-specific roles
+
+- **tests/** - pytest-based integration tests
+  - Uses testinfra for infrastructure testing
+  - Uses apypie for Foreman API testing
+  - **conftest.py** - pytest fixtures for server, client, database connections, and Foreman API resources
+
+- **inventories/** - Ansible inventory files
+  - **broker.py** - Dynamic inventory script
+
+- **build/collections/** - Built Ansible collections (generated, not committed)
+  - **foremanctl/** - Production collections
+  - **forge/** - Development collections
+
+### Core Components
+
+Each Ansible role manages a specific service/component:
+
+- **foreman** - Main Foreman application
+- **pulp** - Content management (RPM, Deb, Container, File repositories)
+- **candlepin** - Subscription management
+- **postgresql** - Database (internal mode only)
+- **httpd** - Web server/reverse proxy
+- **redis** - Cache
+- **foreman_proxy** - Smart proxy (optional feature)
+- **hammer** - CLI tool (optional feature)
+- **certificates** - SSL/TLS certificate management
+
+### Configuration as Podman Secrets
+
+Service configuration files are stored as Podman secrets and mounted into containers.
+
+Naming convention:
+
+- Config files: `<role_namespace>-<filename>-<extension>` or `<role_namespace>-<app>-<filename>-<extension>`
+- Strings: `<role_namespace>-<descriptive_name>` or `<role_namespace>-<app>-<descriptive_name>`
+
+Required labels:
+
+- Config files: `filename`, `app`
+- Strings: `app`
+
+Commands:
+
+```bash
+podman secret ls                                                      # List secrets
+podman secret inspect --showsecret --format "{{.SecretData}}" <name>  # View secret content
+```
+
+### Features System
+
+Features are defined in `src/features.yaml` and control which components are deployed. Each feature can specify:
+
+- **description** - Human-readable description
+- **foreman** - Foreman plugin configuration
+- **foreman_proxy** - Proxy plugin configuration
+- **hammer** - Hammer CLI plugin
+- **dependencies** - Required features
+- **internal** - Whether feature is user-facing or internal-only
+
+Flavors (in `src/vars/flavors/`) define preset feature sets. The katello flavor includes foreman, katello, and content management features (rpm, deb, container, ansible).
+
+### Deploy Playbook Flow
+
+The main deployment playbook (`src/playbooks/deploy/deploy.yaml`) executes roles in order:
+
+1. pre_install - Pre-installation tasks
+2. checks - System requirement validation
+3. certificates - Generate/configure certificates (if certificate_source == 'default')
+4. certificate_checks - Validate certificates
+5. postgresql - Database setup (if database_mode == 'internal')
+6. redis - Redis cache
+7. candlepin - Subscription management
+8. httpd - Web server
+9. pulp - Content management
+10. foreman - Main application
+11. systemd_target - Systemd target for service management
+12. foreman_proxy - Smart proxy (if 'foreman-proxy' in enabled_features)
+13. hammer - CLI (if 'hammer' in enabled_features)
+14. post_install - Post-installation tasks
+
+### Test Architecture
+
+Tests use pytest with fixtures defined in `tests/conftest.py`:
+
+- **server**, **client**, **database** - testinfra hosts via paramiko SSH
+- **foremanapi** - apypie ForemanApi client
+- **organization**, **product**, **yum_repository**, **file_repository**, **container_repository** - Foreman API resources (auto-created/cleaned)
+- **lifecycle_environment**, **content_view**, **activation_key** - Content management fixtures
+
+Tests connect to VMs using SSH config generated at `.tmp/ssh-config` from Ansible inventory.
+
+## Development Notes
+
+### obsah Framework
+
+Both `foremanctl` and `forge` are bash wrappers that configure environment variables and exec `obsah`. Key environment variables:
+
+- `OBSAH_NAME` - Tool name
+- `OBSAH_DATA` - Playbook directory (src/ or development/)
+- `OBSAH_INVENTORY` - Inventory directory
+- `OBSAH_STATE` - State directory (.var/lib/foremanctl)
+- `ANSIBLE_COLLECTIONS_PATH` - Collections path (build/collections/foremanctl or forge)
+- `ANSIBLE_LOG_PATH` - Log file location
+
+### Vagrant Development Environment
+
+The Vagrantfile defines VMs for testing. Use `./forge vms start` and `./forge vms stop` to manage them.
+
+### Running Single Tests
+
+```bash
+source .venv/bin/activate
+pytest tests/foreman_api_test.py::test_foreman_organization -vv
+pytest tests/ -k "repository" -vv
+```
+
+Ensure deployment is active before running tests.

docs/certificates.md

@@ -65,6 +65,12 @@ foremanctl deploy \
 
 When CNAMEs are specified, certificates will include all names in the Subject Alternative Name field, allowing the same certificate to be valid for multiple hostnames.
 
+If certificates already exist from a previous deployment, passing `--certificate-cname` will automatically regenerate the server certificate and CSR to include the new CNAMEs. Existing private keys are reused.
+
+To remove all CNAMEs from an existing certificate, use `--reset-certificate-cname`.
+
+On each run the role compares the Subject Alternative Names in the existing server certificate against the desired list (hostname + any `--certificate-cname` values). If they differ, the CSR and certificate are regenerated automatically. This means both adding and removing CNAMEs are handled transparently without manual cleanup.
+
 ### Current Limitations
 
 - Cannot provide custom certificate files during deployment

src/roles/certificates/tasks/ca.yml

@@ -1,7 +1,8 @@
 ---
-- name: 'Install openssl'
+- name: 'Install crypto dependencies'
   ansible.builtin.package:
-    name: openssl
+    name:
+      - python3-cryptography
     state: present
 
 - name: 'Create certs directory'
@@ -22,31 +23,6 @@
     state: directory
     mode: '0755'
 
-- name: 'Deploy configuration file'
-  ansible.builtin.template:
-    src: openssl.cnf.j2
-    dest: "{{ certificates_ca_directory }}/openssl.cnf"
-    owner: root
-    group: root
-    mode: '0644'
-
-- name: 'Create index file'
-  ansible.builtin.file:
-    path: "{{ certificates_ca_directory }}/index.txt"
-    state: touch
-    owner: root
-    group: root
-    mode: '0644'
-
-- name: 'Ensure serial starting number'
-  ansible.builtin.template:
-    src: serial.j2
-    dest: "{{ certificates_ca_directory }}/serial"
-    force: false
-    owner: root
-    group: root
-    mode: '0644'
-
 - name: 'Create CA key password file'
   ansible.builtin.copy:
     content: "{{ certificates_ca_password }}"
@@ -56,17 +32,36 @@
     mode: '0600'
   no_log: true
 
-- name: 'Creating CA certificate and key'
-  ansible.builtin.command: >
-    openssl req -new
-      -x509
-      -nodes
-      -extensions v3_ca
-      -days 7300
-      -config "{{ certificates_ca_directory }}/openssl.cnf"
-      -subj "/CN=Foreman Self-signed CA"
-      -keyout "{{ certificates_ca_directory_keys }}/ca.key"
-      -out "{{ certificates_ca_directory_certs }}/ca.crt"
-      -passout "file:{{ certificates_ca_directory_keys }}/ca.pwd"
-  args:
-    creates: "{{ certificates_ca_directory_certs }}/ca.crt"
+- name: 'Create CA private key'
+  community.crypto.openssl_privatekey:
+    path: "{{ certificates_ca_directory_keys }}/ca.key"
+    type: RSA
+    size: 4096
+    passphrase: "{{ certificates_ca_password }}"
+    owner: root
+    group: root
+    mode: '0600'
+
+- name: 'Create CA certificate signing request'
+  community.crypto.openssl_csr:
+    path: "{{ certificates_ca_directory_requests }}/ca.csr"
+    privatekey_path: "{{ certificates_ca_directory_keys }}/ca.key"
+    privatekey_passphrase: "{{ certificates_ca_password }}"
+    common_name: "Foreman Self-signed CA"
+    use_common_name_for_san: false
+    basic_constraints:
+      - 'CA:TRUE'
+    basic_constraints_critical: true
+    key_usage:
+      - keyCertSign
+      - cRLSign
+    key_usage_critical: true
+
+- name: 'Create self-signed CA certificate'
+  community.crypto.x509_certificate:
+    path: "{{ certificates_ca_directory_certs }}/ca.crt"
+    csr_path: "{{ certificates_ca_directory_requests }}/ca.csr"
+    privatekey_path: "{{ certificates_ca_directory_keys }}/ca.key"
+    privatekey_passphrase: "{{ certificates_ca_password }}"
+    provider: selfsigned
+    selfsigned_not_after: "+7300d"