[req]
req_extensions = v3_req
distinguished_name = req_distinguished_name

[req_distinguished_name]

[ v3_req ]
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
subjectAltName = @alt_names

[ ssl_client ]
extendedKeyUsage = clientAuth, serverAuth
basicConstraints = CA:FALSE
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer
subjectAltName = @alt_names

[ v3_ca ]
basicConstraints = CA:TRUE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
subjectAltName = @alt_names
authorityKeyIdentifier=keyid:always,issuer

[alt_names]
{#
List all possible ways etcd instances can be contacted

main_{access_,}ips: those variables are explicitly set by network_facts role
and thus don't need a defined check
#}
{% for san in (
            groups['etcd'] | map('extract', hostvars, morekeys='etcd_access_address') | select('defined')
            + groups['etcd']
            + etcd_cert_alt_names
            + groups['etcd'] | map('extract', hostvars, morekeys='main_access_ips')
            + groups['etcd'] | map('extract', hostvars, morekeys='main_ips')
            + etcd_cert_alt_ips
            + ['localhost', '127.0.0.1', '::1']
            ) | flatten | unique
            %}
{{ 'IP' if san is ansible.utils.ip_address else 'DNS' }}.{{ loop.index }} = {{ san }}
{% endfor %}