# Given a leaf certificate for www.ansible.com and one or more intermediate
# certificates, finds the associated root certificate.
- name: Find root certificate
  community.crypto.certificate_complete_chain:
    input_chain: "{{ lookup('ansible.builtin.file', '/etc/ssl/csr/***CONTENTS REDACTED***-fullchain.pem') }}"
    root_certificates:
    - /etc/ca-certificates/
  register: www_ansible_com
- name: Write root certificate to disk
  ansible.builtin.copy:
    dest: /etc/ssl/csr/***CONTENTS REDACTED***-root.pem
    content: "{{ www_ansible_com.root }}"

/etc/ssl/certs/***CONTENTS REDACTED***.cert
/etc/ssl/private/***CONTENTS REDACTED***.edu.key
/etc/ssl/certs/***CONTENTS REDACTED***.edu-cabundle.pem