Inventory example:

cacert_ca_name: "kojiCA"
cacert_ca_copy_to:
  - { host: "dev-1", path: "/opt/koji/certs" }
cacert_ca_trust_anchors_update: True

cacert_certs:
  - name: kojiadmin
    dest:
      - { host: "dev-1", path: "/opt/koji/certs" }
      - { host: "dev-1", name: "client", path: "/opt/koji/certs", concat: "crt" }
  - name: koji.lan
    dest:
      - { host: "dev-1", path: "/opt/koji/certs" }
      - { host: "dev-1", path: "/etc/haproxy/ssl", concat: "pem" }
  - name: koji-hub.lan
    subject_alt_names:
      - koji-files.lan
    dest:
      - { host: "dev-1", path: "/opt/koji/certs" }
      - { host: "dev-1", path: "/etc/haproxy/ssl", concat: "pem" }
  - name: koji-web.lan
    dest:
      - { host: "dev-1", path: "/opt/koji/certs" }
      - { host: "dev-1", path: "/etc/haproxy/ssl", concat: "pem" }
      - { host: "dev-1", path: "/opt/koji/certs", concat: "pem" }
  - name: kojibuilder1.lan
    dest:
      - { host: "kojibuilder1.lan", path: "/opt/koji/certs" }
      - { host: "kojibuilder1.lan", path: "/opt/koji/certs", concat: "pem" }
  - name: kojira.lan
    dest:
      - { host: "dev-1", path: "/opt/koji/certs" }
      - { host: "dev-1", path: "/opt/koji/certs", concat: "pem" }