# {{ ansible_managed }}
#
# This file lists certificates that you wish to use or to ignore to be
# installed in /etc/ssl/certs.
# update-ca-certificates(8) will update /etc/ssl/certs by reading this file.
#
# This is autogenerated by dpkg-reconfigure ca-certificates.
# Certificates should be installed under /usr/share/ca-certificates
# and files with extension '.crt' is recognized as available certs.
#
# line begins with # is comment.
# line begins with ! is certificate filename to be deselected.
#
{% for rootca in pki_register_ca_certificates_known.stdout_lines|d([]) %}
{% if rootca in (pki_register_ca_certificates_blacklist.stdout_lines|d([]) | intersect(pki_register_ca_certificates_whitelist.stdout_lines|d([]))) %}
!{{ rootca }}
{% else %}
{% if rootca in (pki_register_ca_certificates_blacklist.stdout_lines|d([]) | difference(pki_register_ca_certificates_whitelist.stdout_lines|d([]))) %}
!{{ rootca }}
{% elif rootca in pki_register_ca_certificates_whitelist.stdout_lines|d([]) %}
{{ rootca }}
{% elif rootca in pki_register_ca_certificates_untrusted.stdout_lines|d([]) %}
!{{ rootca }}
{% elif rootca in pki_register_ca_certificates_trusted.stdout_lines|d([]) %}
{{ rootca }}
{% endif %}
{% endif %}
{% endfor %}
