Generate a chain (self signed + one signed by the self signed) of certificates using Ansible OpenSSL module.

ansible_openssl_CA_example.yml

---

- hosts: localhost
  gather_facts: no
# # darwin
#   vars:
#     ansible_python_interpreter: /usr/local/bin/python
  tasks:
    - block:
        - apt: 
            name: python-openssl
            update_cache: yes
            cache_valid_time: 3600
      rescue:
        - pip:
            name: PyOpenSSL
    
    - name: Generate CA key
      openssl_privatekey:
        path: /tmp/CA.key
    
    - name: Generate CA signing request
      openssl_csr:
        path: /tmp/CA.csr
        privatekey_path: /tmp/CA.key
        common_name: CA
    
    - name: Generate CA certificate
      openssl_certificate:
        path: /tmp/CA.crt
        privatekey_path: /tmp/CA.key
        csr_path: /tmp/CA.csr
        provider: selfsigned
    
    - name: Generate end-user private key
      openssl_privatekey:
        path: /tmp/child.com.pem
    
    - name: Generate end-user signing request
      openssl_csr:
        path: /tmp/child.com.csr
        privatekey_path: /tmp/child.com.pem
        common_name: child.com

    - name: Generate an OpenSSL certificate signed with your own CA certificate
      openssl_certificate:
        path: /tmp/child.com.crt
        csr_path: /tmp/child.com.csr
        ownca_path: /tmp/CA.crt
        ownca_privatekey_path: /tmp/CA.key
        provider: ownca

#     - name: shell verify
#       shell: openssl verify -verbose -CAfile /tmp/CA.crt /tmp/child.com.crt

Please, note: you must have ansible >= 2.8.