step_ca_client

Installs the step CLI from the Smallstep APT repository, bootstraps trust with the internal CA, and installs the root certificate system-wide — which is what makes *.toolsera.lan certificates verify on a host.

- hosts: all
  roles:
    - role: step_ca_client
      step_ca_fingerprint: '<fingerprint>'

Variable	Default	Description
`step_ca_fingerprint`	none — required	Root certificate fingerprint
`step_ca_url`	`https://stepca.toolsera.lan`	CA server
`step_ca_install_cli`	`true`	Install the `step` CLI
`step_ca_bootstrap`	`true`	Bootstrap CA trust
`step_ca_install_system_cert`	`true`	Install the root system-wide

The three booleans let the role run as any subset — CLI only, or bootstrap onto a host that already has the CLI.

In this repo the fingerprint comes from STEP_CA_FINGERPRINT in ansible/.env. To read it off the CA server itself:

step certificate fingerprint $(step path)/certs/root_ca.crt

Afterwards, step ca health confirms the client trusts the CA, and step ca certificate <name> cert.crt key.key issues one.

Note that applications shipping their own trust store are unaffected by the system root — Node, for one, needs NODE_EXTRA_CA_CERTS pointed at /etc/ssl/certs/ca-certificates.crt.