openssl_csr

# Requirements: a Linux controller and one localhost inventory host, using --forks 1.
# The fresh /var/tmp/parallax-csr-file-profile directory must already be owned and writable.
# Its key.pem must already be an owned readable regular private key with mode 0600.
# request.csr is initially absent; this play requests mode 0600, without owner/group, SELinux or chattr changes.
# Use the supported native Go runtime with Go FIPS mode disabled.
# The shipped CPython64/seed0 JSON compatibility model needs no Python installation or PYTHONHASHSEED setting.
# Use 1-16 homogeneous file CSR tasks with literal no_log: true and the same valid literal register csr.
# Do not mix helper tasks, pipe CSR tasks, loops, delegation, roles, handlers or task/play environments.
# SSH, multiple hosts, general provider/filesystem parity and crash-consistent rollback are outside this profile.
# Codec/resource/native-provider limits fail closed; private source values are opaque to ordinary debug.
- name: Generate a private local file certificate signing request
  hosts: localhost
  connection: local
  gather_facts: false
  tasks:
    - name: Generate a private certificate signing request on disk
      community.crypto.openssl_csr:
        path: /var/tmp/parallax-csr-file-profile/request.csr
        privatekey_path: /var/tmp/parallax-csr-file-profile/key.pem
        common_name: example.test
        mode: '0600'
      no_log: true
      register: csr