fix

  become: yes

  vars:

    - ssl_refresher_success: |

        ipa-server-certinstall -w -d /opt/ssl/privkey.pem /opt/ssl/fullchain.pem

        ipa-server-certinstall -w -d /opt/ssl/cert.pem /opt/ssl/privkey.pem --pin='' -d "{{ ipadm_password }}"

  roles:

    - ssl_refresher

- name: Update IPA certs

  hosts: ipaserver:ipareplicas

  become: yes

  tasks:

    - name: Update IPA certs

      ansible.builtin.shell: ipa-certupdate

      changed_when: False

- name: Install ucarp

  hosts: ipaserver:ipareplicas