Refactor
When Ansible 2.9 is available in Buster backports or when running Bullseye the use of the openssl_certificate_info module and perhaps the openssl_privatekey_info would make sense together with a refactor to remove Bash code where possible and also try to make the role checks run a lot quicker.