Currently the private keys and certificates are assumed to be deployed to servers manually by the system administrator.

This means that the procedure for setting-up a site (let's say the sample testsite) is roughly:

# Bootstrap servers via bootstrap.yml.
# Set-up servers via site.yml.
# Deploy the necessary private keys/certificates.
# Re-run site.yml

This feels a bit awkward, and it might not even serve any good purpose. Instead of a set-up like this, it would be better to deploy both private keys and certificates via Ansible.

This makes Ansible a bit of a bigger target, but on the other hand the private keys normally need to be backed-up somewhere anyway, and the backup system is no smaller target. With some smart encryption the risk to files on Ansible host might be minimal.

In general, a single truststore for all roles should be enough. This means the truststore should be deployed as part of the common role. The remaining roles should simply point their own configurations etc to this truststore. Eventually the application should take care of copying the truststore to desired destination, if it needs it in chroot etc.

For private key/certificates, each application should take care of its own.

This way the optimal separation between roles should be achievable, with minimal duplication.

Current roles that would need to be updated (the list should be verified before starting work):

* LDAP Client
* LDAP Server
* Prosody
* Mail Server
* Mail Forwarder