How can I give openssl subject alternative name?

I find this form a bit more suited for Ansible. It sidesteps the problems of the official module openssl subject alternative name that is somewhat difficult to work with due to library dependency and version problems. The following is an adaptation of a part of the script generation by @Excalibur. You don't need to create a file. This particular playbook outputs the certificate to stdin which you can show with (ansible-playbook -vvvv ) or dump to a variable and output using the debug module.

The domain.key needs to be in the same directory as the playbook.--- - name: Test CSR generation 

 hosts: localhost

  vars:

  - country: 'US'                     # C

  - state: 'NJ'                       # ST

  - locality: 'Trenton'               # L

  - organization: 'ACME'              # O

  - organization_unit: 'IT'           # OU

  - common_name: 'host.example.com'

  - email_address: 'info@example.com' # emailAddress

  - add_subj_alt_name: 'IP:192.0.2.0' # without common_name, e.g. IP:2001:db8::1

  tasks:

  - name: Generate CSR

    shell: |

      STR="/C={{ country }}/

        ST={{ state }}/

        L={{ locality }}/

        O={{ organization }}/

        OU={{ organization_unit }}/

        CN={{ common_name }}/

        emailAddress={{ email_address }}"

      openssl req -new -sha256 -key domain.key -subj "$STR" 

      -reqexts v3_req -extensions v3_req -config 

      <(cat <<<'

      [req]

      distinguished_name = req_distinguished_name

      req_extensions     = v3_req

      x509_extensions    = v3_req

      [req_distinguished_name]

      countryName                         = {{ country }}

      stateOrProvinceNamecountryName      = {{ state }}

      localityName                        = {{ locality }}

      organizationName                    = {{ organization }}

      organizationalUnitName              = {{ organization_unit }}

      commonName                          = {{ common_name }}

      emailAddress                        = {{ email_address }}

      [v3_req]

      # The extentions to add to a self-signed cert

      subjectKeyIdentifier = hash

      basicConstraints     = critical,CA:false

      subjectAltName       = DNS:{{ common_name }},{{ add_subj_alt_name }}

      keyUsage             = critical,digitalSignature,keyEncipherment') -noout -text

    executable: '/bin/bash'