Give a valid shell to the mkcert-ca user.

tasks/certificate_from_private_ca.yml

@@ -3,10 +3,14 @@
   tags: [pki, tls, tls_certificate]
   block:
     - name: Create the certificate (delegate to the CA vm)
+      become: true
       become_user: mkcert-ca
+      become_method: su
+      become_flags: '-s /bin/bash'
       ansible.builtin.command:
         cmd: mkcert -cert-file {{ mkcert_cert_name }} -key-file {{ mkcert_key_name }} {{ mkcert_dsn_and_ip_list }}
       args:
+        chdir: /srv/mkcert-ca
         creates: "/srv/mkcert-ca/{{ mkcert_cert_name }}"
       delegate_to: "{{ mkcert_ca_host }}"
 
@@ -14,7 +18,6 @@
   tags: [pki, tls, tls_certificate]
   block:
     - name: Get the certificate and its key from the CA server
-      become_user: mkcert-ca
       ansible.builtin.fetch:
         src: "/srv/mkcert-ca/{{ item }}"
         dest: "files/{{ item }}"