Add pki_system_ca_certificates_download_all_hosts_force

CHANGES.rst

@@ -29,6 +29,8 @@ Added
 
 - Allow to disable CA certificates download for the different levels. [ypid_]
 
+- Added :envvar:`pki_system_ca_certificates_download_all_hosts_force`. [ypid_]
+
 Changed
 ~~~~~~~
 

defaults/main.yml

@@ -718,4 +718,13 @@ pki_system_ca_certificates_download_by_group: '{{ pki_enabled|bool }}'
 # hosts.
 pki_system_ca_certificates_download_all_hosts: '{{ pki_enabled|bool }}'
 
+
+# .. envvar:: pki_system_ca_certificates_download_all_hosts_force
+#
+# If ``True``, force the download of CA certificates intended for all hosts.
+# Note that this will overwrite by-host and by-group CA certificates.
+# This option can be used to push new root certificates from a internal CA to
+# hosts.
+pki_system_ca_certificates_download_all_hosts_force: False
+
 # ]]]

tasks/main.yml

@@ -448,7 +448,7 @@
     dest: '/usr/local/share/ca-certificates/pki/'
     owner: 'root'
     group: 'root'
-    force: False
+    force: '{{ pki_system_ca_certificates_download_all_hosts_force|bool }}'
   notify: [ 'Regenerate ca-certificates.crt' ]
   when: pki_system_ca_certificates_download_all_hosts|d(pki_enabled) | bool
 # ]]]