Integration with Automation and Infrastructure-as-Code (IaC) Tools

- name: Full certificate creation via REST API
  hosts: localhost
  vars:
    base_url: "https://ers.example.com"
    api_token: "your_keycloak_token_here"
    realm_id: "example-realm-id"
    policy_id: "example-policy-id"
    end_entity_common_name: "www.example.com"

  tasks:
    - name: Create End Entity
      uri:
        url: "{{ base_url }}/api/v1/end-entities/"
        method: POST
        headers:
          Content-Type: "application/json"
          Accept: "application/json"
          Authorization: "Bearer {{ api_token }}"
        body_format: json
        body:
          commonName: "{{ end_entity_common_name }}"
          realmId: "{{ realm_id }}"
          organization: "Example Org"
          organizationalUnit: "IT"
          country: "DE"
          externalId: "entity-001"
          email: "admin@example.com"
          domains:
            - "{{ end_entity_common_name }}"
          ips:
            - "192.168.0.1"
          genericDtoList:
            - key: "env"
              value: "prod"
        return_content: yes
      register: end_entity_response

    - name: Extract endEntityId
      set_fact:
        end_entity_id: "{{ end_entity_response.json.id }}"

    - name: Create Certificate Request
      uri:
        url: "{{ base_url }}/api/v1/cert-requests/"
        method: POST
        headers:
          Content-Type: "application/json"
          Accept: "application/json"
          Authorization: "Bearer {{ api_token }}"
        body_format: json
        body:
          endEntityId: "{{ end_entity_id }}"
          keyPairMode: "SERVER_GEN"
          policyId: "{{ policy_id }}"
          validFor: "SIX_MONTHS"
          keyGenParamsDto:
            cryptoAlgorithm: "RSA"
            keySize: "2048"
          pkcs10ReqBase64: null
          publicKeyBase64: null
        return_content: yes
      register: cert_request_response

    - name: Extract certRequestId
      set_fact:
        cert_request_id: "{{ cert_request_response.json.certRequestId }}"

    - name: Create Certificate
      uri:
        url: "{{ base_url }}/api/v1/certificates/cert-requests/{{ cert_request_id }}"
        method: POST
        headers:
          Accept: "application/json"
          Authorization: "Bearer {{ api_token }}"
        status_code: 201
        return_content: yes
      register: cert_response

    - name: Extract certificate (base64 PFX) and ID
      set_fact:
        certificate_pfx: "{{ cert_response.json.base64EncodedPkcs12 }}"
        certificate_id: "{{ cert_response.json.certificateId }}"

    - name: Output certificate ID
      debug:
        msg: "Certificate successfully created with ID: {{ certificate_id }}"

variable "ee_uuid"       { description = "End-Entity UUID (created on-the-fly if it does not exist)" }
variable "ee_password"   { description = "End-Entity password used for Basic Auth" }
variable "output_path"   { description = "Filesystem path where the resulting PKCS#12 file will be written" }

resource "null_resource" "issue_certificate" {
  provisioner "local-exec" {
    # 'ers' combines End-Entity creation (if needed), certificate request,
    # and certificate issuance in a single command.
    command = <<EOT
      ers certificate request \
        -m SERVER_GEN \
        --ee-uuid ${var.ee_uuid} \
        --ee-password ${var.ee_password} \
        --algorithm RSA \
        --rsa-key-size 2048 \
        --valid-for SIX_MONTHS \
        --output-type PKCS12 \
        --key-file ${var.output_path}/www_example_com.p12 \
        --key-file-password keystorePassword
    EOT
  }

  # Optional: re-run only when the input variables change
  triggers = {
    ee_uuid     = var.ee_uuid
    ee_password = sha1(var.ee_password)
    output_path = var.output_path
  }
}