Regenerate certs when --certificate-cname is present

Author: stejskalleos

docs/certificates.md

@@ -65,6 +65,17 @@ foremanctl deploy \
 
 When CNAMEs are specified, certificates will include all names in the Subject Alternative Name field, allowing the same certificate to be valid for multiple hostnames.
 
+If certificates already exist from a previous deployment, passing `--certificate-cname` will automatically regenerate the server certificate and CSR to include the new CNAMEs. Existing private keys are reused.
+
+To remove all CNAMEs from an existing certificate, use `--reset-certificate-cname`:
+
+```bash
+# Remove all CNAMEs, re-issue cert with only the primary hostname
+foremanctl deploy --reset-certificate-cname
+```
+
+On each run the role compares the Subject Alternative Names in the existing server certificate against the desired list (hostname + any `--certificate-cname` values). If they differ, the CSR and certificate are regenerated automatically. This means both adding and removing CNAMEs are handled transparently without manual cleanup.
+
 ### Current Limitations
 
 - Cannot provide custom certificate files during deployment

src/roles/certificates/tasks/issue.yml

@@ -32,6 +32,66 @@
   args:
     creates: "{{ certificates_ca_directory_certs }}/{{ certificates_hostname }}.crt"
 
+- name: 'Read current SANs from server certificate'
+  ansible.builtin.command: >
+    openssl x509
+      -noout
+      -ext subjectAltName
+      -in "{{ certificates_ca_directory_certs }}/{{ certificates_hostname }}.crt"
+  register: certificates_current_sans
+  changed_when: false
+  failed_when: false
+
+- name: 'Determine desired SANs'
+  ansible.builtin.set_fact:
+    certificates_desired_sans: >-
+      DNS:{{ certificates_hostname }}{% for cname in certificates_cnames %}, DNS:{{ cname }}{% endfor %}
+    certificates_current_sans_normalized: >-
+      {{ certificates_current_sans.stdout | default('')
+         | regex_search('DNS:.*')
+         | default('') | trim }}
+
+- name: 'Determine if server certificate SANs need updating'
+  ansible.builtin.set_fact:
+    certificates_update_sans: >-
+      {{ certificates_current_sans.rc == 0 and
+         certificates_desired_sans != certificates_current_sans_normalized }}
+
+- name: 'Remove outdated server signing request'
+  ansible.builtin.file:
+    path: "{{ certificates_ca_directory_requests }}/{{ certificates_hostname }}.csr"
+    state: absent
+  when: certificates_update_sans | bool
+
+- name: 'Recreate server signing request with updated SANs'
+  ansible.builtin.command: >
+    openssl req
+      -new
+      -config "{{ certificates_ca_directory }}/openssl.cnf"
+      -key "{{ certificates_ca_directory_keys }}/{{ certificates_hostname }}.key"
+      -subj "/CN={{ certificates_hostname }}"
+      -addext "subjectAltName = {{ certificates_desired_sans }}"
+      -out "{{ certificates_ca_directory_requests }}/{{ certificates_hostname }}.csr"
+  when: certificates_update_sans | bool
+
+- name: 'Remove outdated server certificate'
+  ansible.builtin.file:
+    path: "{{ certificates_ca_directory_certs }}/{{ certificates_hostname }}.crt"
+    state: absent
+  when: certificates_update_sans | bool
+
+- name: 'Re-sign server certificate with updated SANs'
+  ansible.builtin.command: >
+    openssl ca
+      -create_serial
+      -batch
+      -extensions ssl_server
+      -config "{{ certificates_ca_directory }}/openssl.cnf"
+      -passin "file:{{ certificates_ca_directory_keys }}/ca.pwd"
+      -in "{{ certificates_ca_directory_requests }}/{{ certificates_hostname }}.csr"
+      -out "{{ certificates_ca_directory_certs }}/{{ certificates_hostname }}.crt"
+  when: certificates_update_sans | bool
+
 - name: 'Create client key'
   ansible.builtin.command: >
     openssl genrsa

src/roles/httpd/tasks/main.yml

@@ -50,6 +50,8 @@
       dest: "certs/katello-apache.crt"
     - src: "{{ httpd_server_key }}"
       dest: "private/katello-apache.key"
+  notify:
+    - Restart httpd
 
 - name: Copy CA certificate to pub directory for client trust
   ansible.builtin.copy: