Add SSL keystore and truststore

tasks/elasticsearch-parameters.yml

@@ -17,6 +17,13 @@
     - es_api_basic_auth_username is not defined
     - es_api_basic_auth_password is not defined
 
+- name: fail when ssl enabled without defining a key and certificate
+  fail: msg="Enabling SSL/TLS (es_enable_http_ssl or es_enable_transport_ssl) requires es_ssl_keystore and es_ssl_truststore or es_ssl_key and es_ssl_certificate to be provided"
+  when:
+    - es_enable_http_ssl or es_enable_transport_ssl
+    - (es_ssl_key == "" or es_ssl_certificate == "")
+    - (es_ssl_keystore == "" or es_ssl_truststore == "")
+
 - name: set fact file_reserved_users
   set_fact: file_reserved_users={{ es_users.file.keys() | list | intersect (reserved_xpack_users) }}
   when: es_users is defined and es_users.file is defined and (es_users.file.keys() | list | length > 0) and (es_users.file.keys() | list | intersect (reserved_xpack_users) | length > 0)

tasks/elasticsearch-ssl.yml

@@ -4,20 +4,28 @@
     dest: "{{ es_ssl_certificate_path }}"
     state: directory
 
-- name: Upload HTTP SSL/TLS certificates
+- name: Upload SSL/TLS keystore and truststore
   copy:
     src: "{{ item }}"
     dest: "{{ es_ssl_certificate_path }}/{{ item | basename }}"
   with_items:
     - "{{ es_ssl_key }}"
     - "{{ es_ssl_certificate }}"
-  when: es_enable_http_ssl|bool or es_enable_transport_ssl|bool
+  when: es_ssl_keystore and es_ssl_truststore
+  register: copy_keystores
 
-- local_action: stat path="{{ role_path }}/files/{{ es_ssl_certificate_authority }}"
-  register: es_cafile
+- name: Upload SSL/TLS key and certificate
+  copy:
+    src: "{{ item }}"
+    dest: "{{ es_ssl_certificate_path }}/{{ item | basename }}"
+  with_items:
+    - "{{ es_ssl_key }}"
+    - "{{ es_ssl_certificate }}"
+  when: es_ssl_key and es_ssl_certificate
+  register: copy_certificates
 
 - name: Upload SSL Certificate Authority
   copy:
     src: "{{ es_ssl_certificate_authority }}"
     dest: "{{ es_ssl_certificate_path }}/{{ es_ssl_certificate_authority | basename }}"
-  when: es_cafile.stat.exists|bool and es_cafile.stat.isreg|bool
+  when: es_ssl_certificate_authority

tasks/main.yml

@@ -53,8 +53,9 @@
   tags:
       - xpack
 
-- name: include ssl.yml
+- name: include elasticsearch-ssl.yml
   include: elasticsearch-ssl.yml
+  when: es_enable_http_ssl or es_enable_transport_ssl
 
 - name: flush handlers
   meta: flush_handlers