deployVa.yml

---

# ansible-playbook -i inventory -l va01,pkiTlsCerts,pkiCsrCerts deployVa.yml

- hosts: pkiServers:eeVaServers
  become: yes
  become_method: sudo
  roles:
    - ansible-hostname
    - ansible-role-mariadb
    - ansible-ejbca-wildfly
    - ansible-ejbca-pkc11-client
    - ansible-ejbca-prep
    - ansible-ejbca-va-ee

 The group_vars for pkiTlsCerts needs to be updated with the TLS cert info needed to create the TLS cert. 
 This is not dynamically created.
- hosts: pkiTlsCerts
  become: yes
  become_method: sudo
  gather_facts: false
  roles:
    - ansible-ejbca-certreq-cli

- hosts: pkiCsrCerts
  become: yes
  become_method: sudo
  gather_facts: false
  roles:
    - ansible-ejbca-certreq-cli

- hosts: pkiServers:eeVaServers
  become: yes
  become_method: sudo
  gather_facts: true
  roles:
    - ansible-ejbca-importcacrt
    - ansible-ejbca-crl-import-export
    - ansible-ejbca-peer-in
    - ansible-ejbca-va-ocsp-bind
    - ansible-pki-ss-httpd