- name : Import constant
  shell: echo 'Import constants'
  notify:
  - INC_CONSTANTS

- name: Install CA master
  shell: pkispawn -s CA -f /tmp/test_dir/ca.cfg

- name: Stopping CA Subsystem
  shell: systemctl stop pki-tomcatd@{{ topology }}-CA.service

- name: Enable SignedAudit for Subsystem
  shell: pki-server ca-audit-config-mod -i {{ topology }}-CA --logSigning True

- name: Getting certificate nickname for CA CS.cfg
  shell: grep "ca.cert.signing.nickname" /etc/pki/{{ topology }}-CA/ca/CS.cfg |awk -F"=" ' { print $2 } '
  register: nickname_ca_signing

- name: getting root CA cert for other subsystem installation
  shell: certutil -L -d /var/lib/pki/{{ topology }}-CA/alias/ -n '{{ nickname_ca_signing.stdout }}' -a -o {{ variable.ROOT_CA_CERT_PATH }}

- name: Getting certificate nickname for CA CS.cfg
  shell: grep "ca.ocsp_signing.nickname" /etc/pki/{{ topology }}-CA/ca/CS.cfg |awk -F"=" ' { print $2 } '
  register: nickname_ocsp

- name: Importing client certificate for OCSP
  shell: certutil -L -d /var/lib/pki/{{ topology }}-CA/alias -n "{{ nickname_ocsp.stdout }}" -a > /tmp/test_dir/ocsp_signing.crt

- name: Set debug log level to 5
  shell: pki-server -i {{ topology }}-CA ca-config-set debug.level 5
  when: debug == "true" or ca_debug == "true"

- name: Starting CA Subsystem
  service:
    name: pki-tomcatd@{{ topology }}-CA.service
    state: started

- name: CA Clone Preparation
  block:
    - name: Export CA subsystem certificates
      shell: pki-server ca-clone-prepare -i {{topology}}-CA --pkcs12-file /tmp/ca_certs.p12 --pkcs12-password {{variable.CLIENT_PKCS12_PASSWORD}}

    - name: Get the CA subsystem certificates to the local
      fetch: src=/tmp/ca_certs.p12 dest=/tmp/test_dir/clonecerts/ flat=yes

    - name: Get the RootCA cert for subsystem clone
      fetch: src=/tmp/rootCA.pem dest=/tmp/test_dir/clonecerts/ flat=yes
  when: clone == "true" or clone == "True"
