- block:
  - name: base | system setup | get step-ca certificate
    get_url:
      url: "https://step-ca.universe.local/roots.pem"
      dest: "/etc/ca-certificates/trust-source/anchors/"
      validate_certs: false

  - name: base | system setup | import step-ca certificate
    command:
      cmd: "update-ca-trust"
  become: yes
  rescue:
    - set_fact: task_failed=true