pyrocufflink: Trust DCH Root CA

The *DCH Root CA* certificate needs to be trusted on all hosts, as most
internal communication is secured with certificates it has issued.

dch-root-ca.crt

@@ -0,0 +1,119 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            dd:bd:2c:48:e1:89:43:d8:8a:ae:6c:74:81:dd:39:64
+    Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C = US, O = Dustin C. Hatch, CN = DCH Root CA R1
+        Validity
+            Not Before: Feb 21 12:05:04 2018 GMT
+            Not After : Feb 16 12:05:04 2038 GMT
+        Subject: C = US, O = Dustin C. Hatch, CN = DCH Root CA R1
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (4096 bit)
+                Modulus:
+                    00:c6:1e:d9:7c:58:4c:92:fe:03:cf:4b:56:0c:6e:
+                    a8:2a:53:7c:50:86:2a:c4:ff:20:36:15:60:ff:bc:
+                    d6:af:b2:f5:b0:12:c3:d3:ae:92:7d:74:ba:cb:be:
+                    84:5c:f8:97:7d:6f:9c:53:b5:8e:75:d0:96:66:53:
+                    98:18:82:ce:61:83:a8:5d:69:4c:9d:17:54:f6:6b:
+                    a7:ed:55:d7:1b:d6:7d:03:58:42:90:63:2e:a3:fa:
+                    53:68:33:46:87:06:24:c2:26:8b:fd:18:eb:99:4e:
+                    1c:b6:a4:c7:ab:75:0e:e3:57:e9:01:e0:2a:4d:de:
+                    3d:cd:57:27:2a:d3:8a:91:04:0c:32:47:a6:1f:6c:
+                    5d:08:ee:d4:62:3d:24:f0:13:26:9a:52:af:15:f6:
+                    85:1a:d8:a9:99:4e:01:1b:33:83:6a:53:af:9d:90:
+                    63:dd:02:7c:04:49:24:8f:22:7a:12:38:93:b9:9a:
+                    54:7a:b6:9a:8a:e4:64:df:11:25:3a:d9:1f:ff:28:
+                    3a:12:44:15:7e:4d:75:e6:a0:f0:94:d1:be:e2:b3:
+                    54:a8:86:1c:a6:49:ff:1c:63:80:39:ea:17:5e:2f:
+                    4a:73:8f:98:ce:ed:b0:fa:45:31:fb:db:05:10:0e:
+                    95:79:8b:9c:a2:d5:d7:ac:4a:d7:36:49:f5:bd:27:
+                    ad:04:86:76:7a:07:b3:04:bf:4e:36:c8:0c:b4:2b:
+                    31:c4:c0:86:f6:14:cc:41:42:f5:1c:26:4e:45:6e:
+                    62:b6:4f:74:ad:66:32:d3:be:d3:62:81:e3:a3:61:
+                    3c:69:9a:ef:55:41:a6:5e:53:d8:56:c5:45:a6:84:
+                    7b:0b:cd:fe:7c:ba:dc:69:bb:0a:20:94:c8:fd:7a:
+                    e5:18:4b:50:60:cc:7c:d9:b5:5e:10:9c:f7:6e:5d:
+                    f6:57:81:82:1f:53:6e:81:7c:c1:ba:79:ad:e4:d7:
+                    da:47:16:9f:21:d1:3e:c2:9f:34:e3:ac:f4:c7:df:
+                    a6:82:3b:69:fb:91:5b:26:63:8d:ed:92:58:3b:ae:
+                    0f:a6:b0:5e:15:d6:4c:3f:0b:78:74:d0:72:4f:2b:
+                    47:57:0e:4d:2b:d9:20:1a:3a:b6:bc:61:49:37:54:
+                    93:61:90:1c:8b:91:d0:94:f4:4a:92:41:35:0a:b6:
+                    11:85:4d:ab:44:c9:69:8d:c3:cb:b9:b2:4d:30:e6:
+                    51:67:29:2b:3f:00:cf:ea:b4:86:7f:3e:44:51:cc:
+                    ac:a6:99:d1:6d:25:47:61:c2:49:ea:4a:13:b0:f4:
+                    5f:f5:b6:4f:17:0b:4a:a2:6c:3c:da:33:28:0f:ef:
+                    bb:52:05:38:3b:41:36:b1:4a:3b:36:b8:a4:74:5e:
+                    5d:b9:81
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: critical
+                CA:TRUE
+            X509v3 Key Usage: critical
+                Certificate Sign, CRL Sign
+            X509v3 Subject Key Identifier: 
+                C7:BF:DF:C7:69:05:A9:E8:E3:3E:DB:CE:E6:47:CE:92:2D:27:11:6A
+    Signature Algorithm: sha256WithRSAEncryption
+         53:15:96:21:e0:8a:fb:1d:1f:cf:ed:9b:df:cf:ea:7d:42:51:
+         bd:01:c5:08:86:83:0f:8f:66:39:55:c2:28:1e:bb:3a:ca:d1:
+         cf:91:cd:cd:cf:cb:3f:ad:6a:9a:ac:f9:7c:28:20:e8:8a:de:
+         55:51:12:cb:2e:41:e2:b4:88:c1:65:65:57:50:f7:0d:05:12:
+         78:5c:7f:1a:4f:26:5e:00:d8:af:f0:d6:d9:8c:27:56:dc:de:
+         c4:ba:ff:3a:8d:ef:19:21:c6:63:da:26:ac:f1:1d:ba:04:1e:
+         ac:41:6d:bb:9d:b7:c3:b5:9a:90:c1:60:2d:a8:b6:df:fe:f7:
+         e6:0b:41:62:e5:ee:8e:2c:0a:60:05:b5:9e:9f:9c:74:07:6e:
+         92:bc:bc:a5:86:23:58:d1:f9:b6:d4:be:15:1b:17:4a:48:89:
+         3a:07:7f:85:88:92:ab:4d:50:6a:ee:8a:a4:a7:41:06:83:c6:
+         87:f9:e9:fa:e0:ee:62:c4:30:77:5d:f6:0a:86:71:06:bf:97:
+         e9:e0:35:62:4d:1b:d9:91:e1:d9:f0:bb:99:38:a1:57:35:35:
+         89:63:08:b9:61:0c:28:3c:2f:48:b0:75:70:57:73:11:04:f7:
+         60:f2:b5:5f:4c:15:6a:ae:f3:6f:3b:7c:da:07:5b:db:6f:b0:
+         cd:38:52:8d:d3:f8:6a:09:2b:6d:f2:ba:62:cb:ad:55:54:a5:
+         d3:c4:ce:39:97:44:19:2b:67:17:6b:f2:16:84:4c:08:b8:09:
+         82:c9:6e:5d:de:28:db:51:a0:00:a3:f4:4f:d5:64:26:4b:96:
+         d7:9d:03:a7:60:3c:0b:d9:2b:ce:6e:b9:3f:02:b9:31:53:79:
+         70:e5:5e:89:a1:88:4c:32:ed:3a:84:1c:b7:0d:dc:56:04:ba:
+         b4:4d:11:8e:c3:5d:d8:08:09:78:9d:fe:b4:51:b5:1e:6d:c1:
+         89:fe:49:f9:a8:af:ec:da:fa:ea:4e:4d:e2:d8:40:35:75:39:
+         8f:f1:9f:cf:9a:d5:24:26:ec:2c:60:6d:10:d5:9b:ba:f8:22:
+         49:f8:b9:95:f8:80:82:af:1e:d2:2d:f4:b8:bb:62:58:a1:4b:
+         5d:4f:c8:9e:f5:d0:78:db:5a:fe:c7:dc:92:47:8e:40:7f:1c:
+         8d:f0:b1:68:8a:d9:6d:89:42:de:1a:b6:8c:04:94:3b:2e:4c:
+         fc:b8:b6:95:59:e6:d4:91:39:31:3e:f4:f2:74:b7:92:26:8c:
+         46:ba:98:ff:85:c1:70:64:e6:9c:91:4c:a9:0e:ce:07:ed:19:
+         86:c6:2d:7e:2c:e1:3b:9a:8a:9f:d0:83:48:05:9d:46:5b:90:
+         21:0d:fa:a0:38:15:9f:8a
+-----BEGIN CERTIFICATE-----
+MIIFTTCCAzWgAwIBAgIRAN29LEjhiUPYiq5sdIHdOWQwDQYJKoZIhvcNAQELBQAw
+QDELMAkGA1UEBhMCVVMxGDAWBgNVBAoMD0R1c3RpbiBDLiBIYXRjaDEXMBUGA1UE
+AwwORENIIFJvb3QgQ0EgUjEwHhcNMTgwMjIxMTIwNTA0WhcNMzgwMjE2MTIwNTA0
+WjBAMQswCQYDVQQGEwJVUzEYMBYGA1UECgwPRHVzdGluIEMuIEhhdGNoMRcwFQYD
+VQQDDA5EQ0ggUm9vdCBDQSBSMTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoC
+ggIBAMYe2XxYTJL+A89LVgxuqCpTfFCGKsT/IDYVYP+81q+y9bASw9Oukn10usu+
+hFz4l31vnFO1jnXQlmZTmBiCzmGDqF1pTJ0XVPZrp+1V1xvWfQNYQpBjLqP6U2gz
+RocGJMImi/0Y65lOHLakx6t1DuNX6QHgKk3ePc1XJyrTipEEDDJHph9sXQju1GI9
+JPATJppSrxX2hRrYqZlOARszg2pTr52QY90CfARJJI8iehI4k7maVHq2morkZN8R
+JTrZH/8oOhJEFX5Ndeag8JTRvuKzVKiGHKZJ/xxjgDnqF14vSnOPmM7tsPpFMfvb
+BRAOlXmLnKLV16xK1zZJ9b0nrQSGdnoHswS/TjbIDLQrMcTAhvYUzEFC9RwmTkVu
+YrZPdK1mMtO+02KB46NhPGma71VBpl5T2FbFRaaEewvN/ny63Gm7CiCUyP165RhL
+UGDMfNm1XhCc925d9leBgh9TboF8wbp5reTX2kcWnyHRPsKfNOOs9MffpoI7afuR
+WyZjje2SWDuuD6awXhXWTD8LeHTQck8rR1cOTSvZIBo6trxhSTdUk2GQHIuR0JT0
+SpJBNQq2EYVNq0TJaY3Dy7myTTDmUWcpKz8Az+q0hn8+RFHMrKaZ0W0lR2HCSepK
+E7D0X/W2TxcLSqJsPNozKA/vu1IFODtBNrFKOza4pHReXbmBAgMBAAGjQjBAMA8G
+A1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBTHv9/HaQWp
+6OM+287mR86SLScRajANBgkqhkiG9w0BAQsFAAOCAgEAUxWWIeCK+x0fz+2b38/q
+fUJRvQHFCIaDD49mOVXCKB67OsrRz5HNzc/LP61qmqz5fCgg6IreVVESyy5B4rSI
+wWVlV1D3DQUSeFx/Gk8mXgDYr/DW2YwnVtzexLr/Oo3vGSHGY9omrPEdugQerEFt
+u523w7WakMFgLai23/735gtBYuXujiwKYAW1np+cdAdukry8pYYjWNH5ttS+FRsX
+SkiJOgd/hYiSq01Qau6KpKdBBoPGh/np+uDuYsQwd132CoZxBr+X6eA1Yk0b2ZHh
+2fC7mTihVzU1iWMIuWEMKDwvSLB1cFdzEQT3YPK1X0wVaq7zbzt82gdb22+wzThS
+jdP4agkrbfK6YsutVVSl08TOOZdEGStnF2vyFoRMCLgJgsluXd4o21GgAKP0T9Vk
+JkuW150Dp2A8C9krzm65PwK5MVN5cOVeiaGITDLtOoQctw3cVgS6tE0RjsNd2AgJ
+eJ3+tFG1Hm3Bif5J+aiv7Nr66k5N4thANXU5j/Gfz5rVJCbsLGBtENWbuvgiSfi5
+lfiAgq8e0i30uLtiWKFLXU/InvXQeNta/sfckkeOQH8cjfCxaIrZbYlC3hq2jASU
+Oy5M/Li2lVnm1JE5MT708nS3kiaMRrqY/4XBcGTmnJFMqQ7OB+0ZhsYtfizhO5qK
+n9CDSAWdRluQIQ36oDgVn4o=
+-----END CERTIFICATE-----

pyrocufflink.yml

@@ -16,3 +16,7 @@
         %server\ admins ALL=(ALL) ALL
       mode: '0440'
       validate: visudo -cf %s
+- hosts: pyrocufflink
+  roles:
+  - role: trustca
+    ca: dch-root-ca