From e4621ebf51879e170aef718def6dfe9ee25f0129 Mon Sep 17 00:00:00 2001
From: Jay Patel <78554593+jarpat@users.noreply.github.com>
Date: Thu, 21 Jul 2022 14:45:54 -0400
Subject: [PATCH] fix: (IAC-578) Update SSL Cert/Key Naming Scheme (#27)

---
 docs/CONFIG-VARS.md                    | 2 +-
 roles/systems/postgres/tasks/main.yaml | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/docs/CONFIG-VARS.md b/docs/CONFIG-VARS.md
index 4437e1f..cabd112 100644
--- a/docs/CONFIG-VARS.md
+++ b/docs/CONFIG-VARS.md
@@ -261,7 +261,7 @@ nfs_ip        = ""    # Assigned values for static IP addresses
 
 **NOTES**:
 
-1. If you set `server_ssl` to on, and you do not define either `server_ssl_cert_file` or `server_ssl_cert_file` the system's default SSL certificate and key will be used instead. By default, on Ubuntu systems we create a copy of those files and name them `ssl-cert-sas.pem` and `ssl-cert-sas.key`
+1. If you set `server_ssl` to on, and you do not define either `server_ssl_cert_file` or `server_ssl_cert_file` the system's default SSL certificate and key will be used instead. By default, on Ubuntu systems we create a copy of those files and name them `ssl-cert-sas-${PG_HOST}.pem` and `ssl-cert-sas-${PG_HOST}.key`
     * The Ansible tasks will take care of copying the certificate and key from the Postgres VM into your local workspace directory
 2. If you are planning on using the [viya4-deployment repository](https://github.com/sassoftware/viya4-deployment) to perform a Viya deployment where you have [full-stack TLS](https://github.com/sassoftware/viya4-deployment/blob/main/docs/CONFIG-VARS.md#tls), ensure in the viya4-deployment ansible-vars.yaml the `V4_CFG_TLS_TRUSTED_CA_CERTS` variable points to a directory that contains the `server_ssl_cert_file`.
 
diff --git a/roles/systems/postgres/tasks/main.yaml b/roles/systems/postgres/tasks/main.yaml
index c3587ff..f5d815f 100644
--- a/roles/systems/postgres/tasks/main.yaml
+++ b/roles/systems/postgres/tasks/main.yaml
@@ -101,7 +101,7 @@
     - name: Copy Ubuntu default SSL Cert
       ansible.builtin.copy:
         src: /etc/ssl/certs/ssl-cert-snakeoil.pem
-        dest: /etc/ssl/certs/ssl-cert-sas.pem
+        dest: "/etc/ssl/certs/ssl-cert-sas-{{ ansible_hostname }}.pem"
         owner: root
         group: root
         mode: "0644"
@@ -110,7 +110,7 @@
     - name: Copy Ubuntu default SSL Key
       ansible.builtin.copy:
         src: /etc/ssl/private/ssl-cert-snakeoil.key
-        dest: /etc/ssl/private/ssl-cert-sas.key
+        dest: "/etc/ssl/private/ssl-cert-sas-{{ ansible_hostname }}.key"
         owner: root
         group: ssl-cert
         mode: "0640"