Move the inline copy/content block into templates/openssl-root-ca.cnf.j2 and switch the task to ansible.builtin.template; the rendered config is identical. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>