Currently Majic Ansible Roles primarily use file extensions .key and .pem when deploying files that contain OpenSSL-style base64-encoded private keys and X.509 certificates. The only exception to this are tests that generate the material using Gimmecert. The problem with using these extensions is:

• .key does not convey what the format of the file is (is it OpenSSL-style base64-encoded private key, PKCS#1, PKCS#8, PKCS#12?).
• .pem does not convey what the content of the file really is, since this is a common extension used for most of the OpenSSL-generated artefacts.

It would be useful to pick a bit more structured file extension naming schema instead, that would convey both what is stored within the file and in what format.

The following should be done:

• Switch to using .key.pem extension for OpenSSL-style base64-encoded private key files.
• Switch to using .cert.pem extension for OpenSSL-style base64-encoded X.509 certificate files.
• Switch to using .dh.pem extension for OpenSSL-style base64-encoded Diffie-Hellman parameter files.
• Update all relevant roles.
  • Deploy files to their destination using the new schema.
  • Drop files from destination servers that used the old schema.
  • Make sure configuration files are referencing the new paths.
• Update all affected tests.
• Update usage instructions.
• Update role reference documentation.
• Update test site configuration and instructions.
• Update release notes.