name: Create PKI
testcases:
- name: get_login_token
  steps:
  - type: get_login_token

- name: create_root_ca
  steps:
  - type: http
    method: POST
    url: '{{.pfserver_webadmin_url}}/api/v1/pki/cas'
    ignore_verify_ssl: true
    body: >-
      {
        "cn": "{{.wired_dot1x_eap_tls_scep.certs.ca.cn}}",
        "mail": "{{.wired_dot1x_eap_tls_scep.certs.ca.mail}}",
        "organisational_unit": "{{.wired_dot1x_eap_tls_scep.certs.organisational_unit}}",
        "organisation": "{{.wired_dot1x_eap_tls_scep.certs.organisation}}",
        "country": "{{.wired_dot1x_eap_tls_scep.certs.country}}",
        "state": "{{.wired_dot1x_eap_tls_scep.certs.state}}",
        "locality": "{{.wired_dot1x_eap_tls_scep.certs.locality}}",
        "key_type": "{{.wired_dot1x_eap_tls_scep.certs.key_type}}",
        "digest": "{{.wired_dot1x_eap_tls_scep.certs.digest.number}}",
        "key_usage": "",
        "extended_key_usage": "",
        "days": "{{.wired_dot1x_eap_tls_scep.certs.validity}}",
        "key_size": "{{.wired_dot1x_eap_tls_scep.certs.key_size}}",
        "ocsp_url": "{{.wired_dot1x_eap_tls_scep.certs.ocsp_url}}"
      }
    headers:
      "Authorization": "{{.get_login_token.result.token}}"
      "Content-Type": "application/json"
    assertions:
      - result.statuscode ShouldEqual 200
    vars:
      ca_id:
        from: result.bodyjson.items.items0.id

### RADIUS certificate part
- name: create_pf_radius_cert_template
  steps:
  - type: http
    method: POST
    url: '{{.pfserver_webadmin_url}}/api/v1/pki/profiles'
    ignore_verify_ssl: true
    body: >-
      {
        "ca_id": "{{.create_root_ca.ca_id}}",
        "name": "{{.wired_dot1x_eap_tls_scep.templates.radius.name}}",
        "validity": "{{.wired_dot1x_eap_tls_scep.certs.validity}}",
        "key_type": "{{.wired_dot1x_eap_tls_scep.certs.key_type}}",
        "digest": "{{.wired_dot1x_eap_tls_scep.certs.digest.number}}",
        "key_usage": "",
        "extended_key_usage": "1",
        "key_size": "{{.wired_dot1x_eap_tls_scep.certs.key_size}}",
        "organisational_unit": "{{.wired_dot1x_eap_tls_scep.certs.organisational_unit}}",
        "organisation": "{{.wired_dot1x_eap_tls_scep.certs.organisation}}",
        "country": "{{.wired_dot1x_eap_tls_scep.certs.country}}",
        "state": "{{.wired_dot1x_eap_tls_scep.certs.state}}",
        "locality": "{{.wired_dot1x_eap_tls_scep.certs.locality}}",
        "ocsp_url": "{{.wired_dot1x_eap_tls_scep.certs.ocsp_url}}"
      }
    headers:
      "Authorization": "{{.get_login_token.result.token}}"
      "Content-Type": "application/json"
    assertions:
      - result.statuscode ShouldEqual 200
    vars:
      profile_id:
        from: result.bodyjson.items.items0.id

- name: create_pf_radius_cert
  steps:
  - type: http
    method: POST
    url: '{{.pfserver_webadmin_url}}/api/v1/pki/certs'
    ignore_verify_ssl: true
    body: >-
      {
        "profile_id": "{{.create_pf_radius_cert_template.profile_id}}",
        "cn": "{{.wired_dot1x_eap_tls_scep.certs.radius.cn}}",
        "mail": "{{.wired_dot1x_eap_tls_scep.certs.radius.mail}}",
        "dns_names": "{{.wired_dot1x_eap_tls_scep.certs.radius.dns_names}}",
        "ip_addresses": "{{.wired_dot1x_eap_tls_scep.certs.radius.ip_addresses}}"
      }
    headers:
      "Authorization": "{{.get_login_token.result.token}}"
      "Content-Type": "application/json"
    assertions:
      - result.statuscode ShouldEqual 200
    vars:
      serial_number:
        from: result.bodyjson.items.items0.id

- name: create_temp_directory
  steps:
    - type: exec
      script: "mktemp -d"
      vars:
        temp_dir:
          from: result.systemout

- name: download_radius_p12_file
  steps:
  - type: exec
    script: |
      curl -k --output {{.create_temp_directory.temp_dir}}/{{.wired_dot1x_eap_tls_scep.certs.radius.cn}}.p12 \
      http://127.0.0.1:22225/api/v1/pki/cert/{{.create_pf_radius_cert.serial_number}}/download/secret

- name: extract_ca_certificate
  steps:
  - type: exec
    script: |
      openssl pkcs12 -in {{.create_temp_directory.temp_dir}}/{{.wired_dot1x_eap_tls_scep.certs.radius.cn}}.p12 -cacerts -nokeys \
      -out {{.create_temp_directory.temp_dir}}/{{.wired_dot1x_eap_tls_scep.certs.ca.cn}}.crt -passin pass:secret $(. /etc/os-release; if [ "${ID}_${VERSION_ID%.*}" != "rhel_8" ]; then echo "-legacy"; fi)

- name: extract_radius_certificate
  steps:
  - type: exec
    script: |
      openssl pkcs12 -in {{.create_temp_directory.temp_dir}}/{{.wired_dot1x_eap_tls_scep.certs.radius.cn}}.p12 -clcerts -nokeys \
      -out {{.create_temp_directory.temp_dir}}/{{.wired_dot1x_eap_tls_scep.certs.radius.cn}}.crt -passin pass:secret $(. /etc/os-release; if [ "${ID}_${VERSION_ID%.*}" != "rhel_8" ]; then echo "-legacy"; fi)

- name: extract_radius_key
  steps:
  - type: exec
    script: |
      openssl pkcs12 -in {{.create_temp_directory.temp_dir}}/{{.wired_dot1x_eap_tls_scep.certs.radius.cn}}.p12 -nocerts -nodes \
      -out {{.create_temp_directory.temp_dir}}/{{.wired_dot1x_eap_tls_scep.certs.radius.cn}}.key -passin pass:secret $(. /etc/os-release; if [ "${ID}_${VERSION_ID%.*}" != "rhel_8" ]; then echo "-legacy"; fi)

- name: install_ca_cert
  steps:
  - type: exec
    script: "cp {{.create_temp_directory.temp_dir}}/{{.wired_dot1x_eap_tls_scep.certs.ca.cn}}.crt /usr/local/pf/raddb/certs/ca.pem"

- name: install_radius_cert
  steps:
  - type: exec
    script: "cp {{.create_temp_directory.temp_dir}}/{{.wired_dot1x_eap_tls_scep.certs.radius.cn}}.crt /usr/local/pf/raddb/certs/server.crt"

- name: install_radius_key
  steps:
  - type: exec
    script: "cp {{.create_temp_directory.temp_dir}}/{{.wired_dot1x_eap_tls_scep.certs.radius.cn}}.key /usr/local/pf/raddb/certs/server.key"

### HTTP certificate part
- name: create_pf_http_cert_template
  steps:
  - type: http
    method: POST
    url: '{{.pfserver_webadmin_url}}/api/v1/pki/profiles'
    ignore_verify_ssl: true
    body: >-
      {
        "ca_id": "{{.create_root_ca.ca_id}}",
        "name": "{{.wired_dot1x_eap_tls_scep.templates.http.name}}",
        "validity": "{{.wired_dot1x_eap_tls_scep.certs.validity}}",
        "key_type": "{{.wired_dot1x_eap_tls_scep.certs.key_type}}",
        "digest": "{{.wired_dot1x_eap_tls_scep.certs.digest.number}}",
        "key_usage": "",
        "extended_key_usage": "1",
        "key_size": "{{.wired_dot1x_eap_tls_scep.certs.key_size}}",
        "organisational_unit": "{{.wired_dot1x_eap_tls_scep.certs.organisational_unit}}",
        "organisation": "{{.wired_dot1x_eap_tls_scep.certs.organisation}}",
        "country": "{{.wired_dot1x_eap_tls_scep.certs.country}}",
        "state": "{{.wired_dot1x_eap_tls_scep.certs.state}}",
        "locality": "{{.wired_dot1x_eap_tls_scep.certs.locality}}",
        "ocsp_url": "{{.wired_dot1x_eap_tls_scep.certs.ocsp_url}}"
      }
    headers:
      "Authorization": "{{.get_login_token.result.token}}"
      "Content-Type": "application/json"
    assertions:
      - result.statuscode ShouldEqual 200
    vars:
      profile_id:
        from: result.bodyjson.items.items0.id

- name: create_pf_http_cert
  steps:
  - type: http
    method: POST
    url: '{{.pfserver_webadmin_url}}/api/v1/pki/certs'
    ignore_verify_ssl: true
    body: >-
      {
        "profile_id": "{{.create_pf_http_cert_template.profile_id}}",
        "cn": "{{.wired_dot1x_eap_tls_scep.certs.http.cn}}",
        "mail": "{{.wired_dot1x_eap_tls_scep.certs.http.mail}}",
        "dns_names": "{{.wired_dot1x_eap_tls_scep.certs.http.dns_names}}",
        "ip_addresses": "{{.wired_dot1x_eap_tls_scep.certs.http.ip_addresses}}"
      }
    headers:
      "Authorization": "{{.get_login_token.result.token}}"
      "Content-Type": "application/json"
    assertions:
      - result.statuscode ShouldEqual 200
    vars:
      serial_number:
        from: result.bodyjson.items.items0.id

- name: create_temp_directory
  steps:
    - type: exec
      script: "mktemp -d"
      vars:
        temp_dir:
          from: result.systemout

- name: download_http_p12_file
  steps:
  - type: exec
    script: |
      curl -k --output {{.create_temp_directory.temp_dir}}/{{.wired_dot1x_eap_tls_scep.certs.http.cn}}.p12 \
      http://127.0.0.1:22225/api/v1/pki/cert/{{.create_pf_http_cert.serial_number}}/download/secret

- name: extract_ca_certificate
  steps:
  - type: exec
    script: |
      openssl pkcs12 -in {{.create_temp_directory.temp_dir}}/{{.wired_dot1x_eap_tls_scep.certs.http.cn}}.p12 -cacerts -nokeys \
      -out {{.create_temp_directory.temp_dir}}/{{.wired_dot1x_eap_tls_scep.certs.ca.cn}}.crt -passin pass:secret $(. /etc/os-release; if [ "${ID}_${VERSION_ID%.*}" != "rhel_8" ]; then echo "-legacy"; fi)

- name: extract_http_certificate
  steps:
  - type: exec
    script: |
      openssl pkcs12 -in {{.create_temp_directory.temp_dir}}/{{.wired_dot1x_eap_tls_scep.certs.http.cn}}.p12 -clcerts -nokeys \
      -out {{.create_temp_directory.temp_dir}}/{{.wired_dot1x_eap_tls_scep.certs.http.cn}}.crt -passin pass:secret $(. /etc/os-release; if [ "${ID}_${VERSION_ID%.*}" != "rhel_8" ]; then echo "-legacy"; fi)

- name: extract_http_key
  steps:
  - type: exec
    script: |
      openssl pkcs12 -in {{.create_temp_directory.temp_dir}}/{{.wired_dot1x_eap_tls_scep.certs.http.cn}}.p12 -nocerts -nodes \
      -out {{.create_temp_directory.temp_dir}}/{{.wired_dot1x_eap_tls_scep.certs.http.cn}}.key -passin pass:secret $(. /etc/os-release; if [ "${ID}_${VERSION_ID%.*}" != "rhel_8" ]; then echo "-legacy"; fi)

- name: install_http_cert_portal
  steps:
  - type: exec
    script: |
      cat {{.create_temp_directory.temp_dir}}/{{.wired_dot1x_eap_tls_scep.certs.http.cn}}.crt \
      {{.create_temp_directory.temp_dir}}/{{.wired_dot1x_eap_tls_scep.certs.http.cn}}.key > /usr/local/pf/conf/ssl/server.pem

- name: install_http_cert_webadmin
  steps:
  - type: exec
    script: "cat {{.create_temp_directory.temp_dir}}/{{.wired_dot1x_eap_tls_scep.certs.http.cn}}.crt > /usr/local/pf/conf/ssl/server.crt"

- name: install_http_key_webadmin
  steps:
  - type: exec
    script: "cat {{.create_temp_directory.temp_dir}}/{{.wired_dot1x_eap_tls_scep.certs.http.cn}}.key > /usr/local/pf/conf/ssl/server.key"
        

### User certificate part
- name: create_user_cert_template
  steps:
  - type: http
    method: POST
    url: '{{.pfserver_webadmin_url}}/api/v1/pki/profiles'
    ignore_verify_ssl: true
    body: >-
      {
        "ca_id": "{{.create_root_ca.ca_id}}",
        "name": "{{.wired_dot1x_eap_tls_scep.templates.user.name}}",
        "validity": "{{.wired_dot1x_eap_tls_scep.certs.validity}}",
        "key_type": "{{.wired_dot1x_eap_tls_scep.certs.key_type}}",
        "digest": "{{.wired_dot1x_eap_tls_scep.certs.digest.number}}",
        "key_usage": "",
        "extended_key_usage": "{{.wired_dot1x_eap_tls_scep.certs.user.extended_key_usage.number}}",
        "key_size": "{{.wired_dot1x_eap_tls_scep.certs.key_size}}",
        "organisational_unit": "{{.wired_dot1x_eap_tls_scep.certs.organisational_unit}}",
        "organisation": "{{.wired_dot1x_eap_tls_scep.certs.organisation}}",
        "country": "{{.wired_dot1x_eap_tls_scep.certs.country}}",
        "state": "{{.wired_dot1x_eap_tls_scep.certs.state}}",
        "locality": "{{.wired_dot1x_eap_tls_scep.certs.locality}}",
        "ocsp_url": "{{.wired_dot1x_eap_tls_scep.certs.ocsp_url}}",
        "scep_enabled": {{.wired_dot1x_eap_tls_scep.certs.user.scep_enabled}},
        "scep_challenge_password": "{{.wired_dot1x_eap_tls_scep.certs.user.scep_challenge_password}}",
        "scep_days_before_renewal": "{{.wired_dot1x_eap_tls_scep.certs.user.scep_days_before_renewal}}"
      }
    headers:
      "Authorization": "{{.get_login_token.result.token}}"
      "Content-Type": "application/json"
    assertions:
      - result.statuscode ShouldEqual 200
    vars:
      profile_id:
        from: result.bodyjson.items.items0.id
