Rename openssl_certificate* to x509_certificate* (#7)
* Rename openssl_certificate* to x509_certificate*. * Update README. * Add redirects. * Also print warnings when using Ansible 2.9. * Adjust ignore-2.9.txt. * Update documentation.pull/25/head
Felix Fontein
GitHub
parent
28827db5d9
commit
f7dbd61fa7
|
|
@ -20,8 +20,6 @@ Most modules require a recent enough version of [the Python cryptography library
|
||||||
## Included content
|
## Included content
|
||||||
|
|
||||||
- OpenSSL / PKI modules:
|
- OpenSSL / PKI modules:
|
||||||
- openssl_certificate_info
|
|
||||||
- openssl_certificate
|
|
||||||
- openssl_csr_info
|
- openssl_csr_info
|
||||||
- openssl_csr
|
- openssl_csr
|
||||||
- openssl_dhparam
|
- openssl_dhparam
|
||||||
|
|
@ -29,6 +27,8 @@ Most modules require a recent enough version of [the Python cryptography library
|
||||||
- openssl_privatekey_info
|
- openssl_privatekey_info
|
||||||
- openssl_privatekey
|
- openssl_privatekey
|
||||||
- openssl_publickey
|
- openssl_publickey
|
||||||
|
- x509_certificate_info
|
||||||
|
- x509_certificate
|
||||||
- x509_crl_info
|
- x509_crl_info
|
||||||
- x509_crl
|
- x509_crl
|
||||||
- certificate_complete_chain
|
- certificate_complete_chain
|
||||||
|
|
|
||||||
|
|
@ -3,4 +3,15 @@ plugin_routing:
|
||||||
acme_account_facts:
|
acme_account_facts:
|
||||||
deprecation:
|
deprecation:
|
||||||
removal_date: TBD
|
removal_date: TBD
|
||||||
warning_text: see plugin documentation for details
|
removal_version: '2.12'
|
||||||
|
warning_text: The 'community.crypto.acme_account_facts' module has been renamed to 'community.crypto.acme_account_info'.
|
||||||
|
openssl_certificate:
|
||||||
|
deprecation:
|
||||||
|
removal_date: TBD
|
||||||
|
removal_version: '2.14'
|
||||||
|
warning_text: The 'community.crypto.openssl_certificate' module has been renamed to 'community.crypto.x509_certificate'
|
||||||
|
openssl_certificate_info:
|
||||||
|
deprecation:
|
||||||
|
removal_date: TBD
|
||||||
|
removal_version: '2.14'
|
||||||
|
warning_text: The 'community.crypto.openssl_certificate_info' module has been renamed to 'community.crypto.x509_certificate_info'
|
||||||
|
|
|
||||||
|
|
@ -67,7 +67,7 @@ try:
|
||||||
# general name objects (DNSName, IPAddress, ...), while providing overloaded
|
# general name objects (DNSName, IPAddress, ...), while providing overloaded
|
||||||
# equality and string representation operations. This makes it impossible to
|
# equality and string representation operations. This makes it impossible to
|
||||||
# use them in hash-based data structures such as set or dict. Since we are
|
# use them in hash-based data structures such as set or dict. Since we are
|
||||||
# actually doing that in openssl_certificate, and potentially in other code,
|
# actually doing that in x509_certificate, and potentially in other code,
|
||||||
# we need to monkey-patch __hash__ for these classes to make sure our code
|
# we need to monkey-patch __hash__ for these classes to make sure our code
|
||||||
# works fine.
|
# works fine.
|
||||||
if LooseVersion(cryptography.__version__) < LooseVersion('2.1'):
|
if LooseVersion(cryptography.__version__) < LooseVersion('2.1'):
|
||||||
|
|
|
||||||
|
|
@ -259,7 +259,7 @@ def main():
|
||||||
),
|
),
|
||||||
supports_check_mode=True,
|
supports_check_mode=True,
|
||||||
)
|
)
|
||||||
if module._name == 'acme_account_facts':
|
if module._name in ('acme_account_facts', 'community.crypto.acme_account_facts'):
|
||||||
module.deprecate("The 'acme_account_facts' module has been renamed to 'acme_account_info'", version='2.12')
|
module.deprecate("The 'acme_account_facts' module has been renamed to 'acme_account_info'", version='2.12')
|
||||||
handle_standard_module_arguments(module, needs_acme_v2=True)
|
handle_standard_module_arguments(module, needs_acme_v2=True)
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -78,7 +78,7 @@ options:
|
||||||
- Only allowed if C(verification_method=email)
|
- Only allowed if C(verification_method=email)
|
||||||
type: str
|
type: str
|
||||||
seealso:
|
seealso:
|
||||||
- module: openssl_certificate
|
- module: x509_certificate
|
||||||
description: Can be used to request certificates from ECS, with C(provider=entrust).
|
description: Can be used to request certificates from ECS, with C(provider=entrust).
|
||||||
- module: ecs_certificate
|
- module: ecs_certificate
|
||||||
description: Can be used to request a Certificate from ECS using a verified domain.
|
description: Can be used to request a Certificate from ECS using a verified domain.
|
||||||
|
|
|
||||||
File diff suppressed because it is too large
Load Diff
|
|
@ -0,0 +1 @@
|
||||||
|
x509_certificate.py
|
||||||
|
|
@ -1,863 +0,0 @@
|
||||||
#!/usr/bin/python
|
|
||||||
# -*- coding: utf-8 -*-
|
|
||||||
|
|
||||||
# Copyright: (c) 2016-2017, Yanis Guenane <yanis+ansible@guenane.org>
|
|
||||||
# Copyright: (c) 2017, Markus Teufelberger <mteufelberger+ansible@mgit.at>
|
|
||||||
# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
|
|
||||||
|
|
||||||
from __future__ import absolute_import, division, print_function
|
|
||||||
__metaclass__ = type
|
|
||||||
|
|
||||||
ANSIBLE_METADATA = {'metadata_version': '1.1',
|
|
||||||
'status': ['preview'],
|
|
||||||
'supported_by': 'community'}
|
|
||||||
|
|
||||||
DOCUMENTATION = r'''
|
|
||||||
---
|
|
||||||
module: openssl_certificate_info
|
|
||||||
short_description: Provide information of OpenSSL X.509 certificates
|
|
||||||
description:
|
|
||||||
- This module allows one to query information on OpenSSL certificates.
|
|
||||||
- It uses the pyOpenSSL or cryptography python library to interact with OpenSSL. If both the
|
|
||||||
cryptography and PyOpenSSL libraries are available (and meet the minimum version requirements)
|
|
||||||
cryptography will be preferred as a backend over PyOpenSSL (unless the backend is forced with
|
|
||||||
C(select_crypto_backend)). Please note that the PyOpenSSL backend was deprecated in Ansible 2.9
|
|
||||||
and will be removed in Ansible 2.13.
|
|
||||||
requirements:
|
|
||||||
- PyOpenSSL >= 0.15 or cryptography >= 1.6
|
|
||||||
author:
|
|
||||||
- Felix Fontein (@felixfontein)
|
|
||||||
- Yanis Guenane (@Spredzy)
|
|
||||||
- Markus Teufelberger (@MarkusTeufelberger)
|
|
||||||
options:
|
|
||||||
path:
|
|
||||||
description:
|
|
||||||
- Remote absolute path where the certificate file is loaded from.
|
|
||||||
- Either I(path) or I(content) must be specified, but not both.
|
|
||||||
type: path
|
|
||||||
content:
|
|
||||||
description:
|
|
||||||
- Content of the X.509 certificate in PEM format.
|
|
||||||
- Either I(path) or I(content) must be specified, but not both.
|
|
||||||
type: str
|
|
||||||
valid_at:
|
|
||||||
description:
|
|
||||||
- A dict of names mapping to time specifications. Every time specified here
|
|
||||||
will be checked whether the certificate is valid at this point. See the
|
|
||||||
C(valid_at) return value for informations on the result.
|
|
||||||
- Time can be specified either as relative time or as absolute timestamp.
|
|
||||||
- Time will always be interpreted as UTC.
|
|
||||||
- Valid format is C([+-]timespec | ASN.1 TIME) where timespec can be an integer
|
|
||||||
+ C([w | d | h | m | s]) (e.g. C(+32w1d2h), and ASN.1 TIME (i.e. pattern C(YYYYMMDDHHMMSSZ)).
|
|
||||||
Note that all timestamps will be treated as being in UTC.
|
|
||||||
type: dict
|
|
||||||
select_crypto_backend:
|
|
||||||
description:
|
|
||||||
- Determines which crypto backend to use.
|
|
||||||
- The default choice is C(auto), which tries to use C(cryptography) if available, and falls back to C(pyopenssl).
|
|
||||||
- If set to C(pyopenssl), will try to use the L(pyOpenSSL,https://pypi.org/project/pyOpenSSL/) library.
|
|
||||||
- If set to C(cryptography), will try to use the L(cryptography,https://cryptography.io/) library.
|
|
||||||
- Please note that the C(pyopenssl) backend has been deprecated in Ansible 2.9, and will be removed in Ansible 2.13.
|
|
||||||
From that point on, only the C(cryptography) backend will be available.
|
|
||||||
type: str
|
|
||||||
default: auto
|
|
||||||
choices: [ auto, cryptography, pyopenssl ]
|
|
||||||
|
|
||||||
notes:
|
|
||||||
- All timestamp values are provided in ASN.1 TIME format, i.e. following the C(YYYYMMDDHHMMSSZ) pattern.
|
|
||||||
They are all in UTC.
|
|
||||||
seealso:
|
|
||||||
- module: openssl_certificate
|
|
||||||
'''
|
|
||||||
|
|
||||||
EXAMPLES = r'''
|
|
||||||
- name: Generate a Self Signed OpenSSL certificate
|
|
||||||
community.crypto.openssl_certificate:
|
|
||||||
path: /etc/ssl/crt/ansible.com.crt
|
|
||||||
privatekey_path: /etc/ssl/private/ansible.com.pem
|
|
||||||
csr_path: /etc/ssl/csr/ansible.com.csr
|
|
||||||
provider: selfsigned
|
|
||||||
|
|
||||||
|
|
||||||
# Get information on the certificate
|
|
||||||
|
|
||||||
- name: Get information on generated certificate
|
|
||||||
community.crypto.openssl_certificate_info:
|
|
||||||
path: /etc/ssl/crt/ansible.com.crt
|
|
||||||
register: result
|
|
||||||
|
|
||||||
- name: Dump information
|
|
||||||
debug:
|
|
||||||
var: result
|
|
||||||
|
|
||||||
|
|
||||||
# Check whether the certificate is valid or not valid at certain times, fail
|
|
||||||
# if this is not the case. The first task (openssl_certificate_info) collects
|
|
||||||
# the information, and the second task (assert) validates the result and
|
|
||||||
# makes the playbook fail in case something is not as expected.
|
|
||||||
|
|
||||||
- name: Test whether that certificate is valid tomorrow and/or in three weeks
|
|
||||||
community.crypto.openssl_certificate_info:
|
|
||||||
path: /etc/ssl/crt/ansible.com.crt
|
|
||||||
valid_at:
|
|
||||||
point_1: "+1d"
|
|
||||||
point_2: "+3w"
|
|
||||||
register: result
|
|
||||||
|
|
||||||
- name: Validate that certificate is valid tomorrow, but not in three weeks
|
|
||||||
assert:
|
|
||||||
that:
|
|
||||||
- result.valid_at.point_1 # valid in one day
|
|
||||||
- not result.valid_at.point_2 # not valid in three weeks
|
|
||||||
'''
|
|
||||||
|
|
||||||
RETURN = r'''
|
|
||||||
expired:
|
|
||||||
description: Whether the certificate is expired (i.e. C(notAfter) is in the past)
|
|
||||||
returned: success
|
|
||||||
type: bool
|
|
||||||
basic_constraints:
|
|
||||||
description: Entries in the C(basic_constraints) extension, or C(none) if extension is not present.
|
|
||||||
returned: success
|
|
||||||
type: list
|
|
||||||
elements: str
|
|
||||||
sample: "[CA:TRUE, pathlen:1]"
|
|
||||||
basic_constraints_critical:
|
|
||||||
description: Whether the C(basic_constraints) extension is critical.
|
|
||||||
returned: success
|
|
||||||
type: bool
|
|
||||||
extended_key_usage:
|
|
||||||
description: Entries in the C(extended_key_usage) extension, or C(none) if extension is not present.
|
|
||||||
returned: success
|
|
||||||
type: list
|
|
||||||
elements: str
|
|
||||||
sample: "[Biometric Info, DVCS, Time Stamping]"
|
|
||||||
extended_key_usage_critical:
|
|
||||||
description: Whether the C(extended_key_usage) extension is critical.
|
|
||||||
returned: success
|
|
||||||
type: bool
|
|
||||||
extensions_by_oid:
|
|
||||||
description: Returns a dictionary for every extension OID
|
|
||||||
returned: success
|
|
||||||
type: dict
|
|
||||||
contains:
|
|
||||||
critical:
|
|
||||||
description: Whether the extension is critical.
|
|
||||||
returned: success
|
|
||||||
type: bool
|
|
||||||
value:
|
|
||||||
description: The Base64 encoded value (in DER format) of the extension
|
|
||||||
returned: success
|
|
||||||
type: str
|
|
||||||
sample: "MAMCAQU="
|
|
||||||
sample: '{"1.3.6.1.5.5.7.1.24": { "critical": false, "value": "MAMCAQU="}}'
|
|
||||||
key_usage:
|
|
||||||
description: Entries in the C(key_usage) extension, or C(none) if extension is not present.
|
|
||||||
returned: success
|
|
||||||
type: str
|
|
||||||
sample: "[Key Agreement, Data Encipherment]"
|
|
||||||
key_usage_critical:
|
|
||||||
description: Whether the C(key_usage) extension is critical.
|
|
||||||
returned: success
|
|
||||||
type: bool
|
|
||||||
subject_alt_name:
|
|
||||||
description: Entries in the C(subject_alt_name) extension, or C(none) if extension is not present.
|
|
||||||
returned: success
|
|
||||||
type: list
|
|
||||||
elements: str
|
|
||||||
sample: "[DNS:www.ansible.com, IP:1.2.3.4]"
|
|
||||||
subject_alt_name_critical:
|
|
||||||
description: Whether the C(subject_alt_name) extension is critical.
|
|
||||||
returned: success
|
|
||||||
type: bool
|
|
||||||
ocsp_must_staple:
|
|
||||||
description: C(yes) if the OCSP Must Staple extension is present, C(none) otherwise.
|
|
||||||
returned: success
|
|
||||||
type: bool
|
|
||||||
ocsp_must_staple_critical:
|
|
||||||
description: Whether the C(ocsp_must_staple) extension is critical.
|
|
||||||
returned: success
|
|
||||||
type: bool
|
|
||||||
issuer:
|
|
||||||
description:
|
|
||||||
- The certificate's issuer.
|
|
||||||
- Note that for repeated values, only the last one will be returned.
|
|
||||||
returned: success
|
|
||||||
type: dict
|
|
||||||
sample: '{"organizationName": "Ansible", "commonName": "ca.example.com"}'
|
|
||||||
issuer_ordered:
|
|
||||||
description: The certificate's issuer as an ordered list of tuples.
|
|
||||||
returned: success
|
|
||||||
type: list
|
|
||||||
elements: list
|
|
||||||
sample: '[["organizationName", "Ansible"], ["commonName": "ca.example.com"]]'
|
|
||||||
version_added: "2.9"
|
|
||||||
subject:
|
|
||||||
description:
|
|
||||||
- The certificate's subject as a dictionary.
|
|
||||||
- Note that for repeated values, only the last one will be returned.
|
|
||||||
returned: success
|
|
||||||
type: dict
|
|
||||||
sample: '{"commonName": "www.example.com", "emailAddress": "test@example.com"}'
|
|
||||||
subject_ordered:
|
|
||||||
description: The certificate's subject as an ordered list of tuples.
|
|
||||||
returned: success
|
|
||||||
type: list
|
|
||||||
elements: list
|
|
||||||
sample: '[["commonName", "www.example.com"], ["emailAddress": "test@example.com"]]'
|
|
||||||
version_added: "2.9"
|
|
||||||
not_after:
|
|
||||||
description: C(notAfter) date as ASN.1 TIME
|
|
||||||
returned: success
|
|
||||||
type: str
|
|
||||||
sample: 20190413202428Z
|
|
||||||
not_before:
|
|
||||||
description: C(notBefore) date as ASN.1 TIME
|
|
||||||
returned: success
|
|
||||||
type: str
|
|
||||||
sample: 20190331202428Z
|
|
||||||
public_key:
|
|
||||||
description: Certificate's public key in PEM format
|
|
||||||
returned: success
|
|
||||||
type: str
|
|
||||||
sample: "-----BEGIN PUBLIC KEY-----\nMIICIjANBgkqhkiG9w0BAQEFAAOCAg8A..."
|
|
||||||
public_key_fingerprints:
|
|
||||||
description:
|
|
||||||
- Fingerprints of certificate's public key.
|
|
||||||
- For every hash algorithm available, the fingerprint is computed.
|
|
||||||
returned: success
|
|
||||||
type: dict
|
|
||||||
sample: "{'sha256': 'd4:b3:aa:6d:c8:04:ce:4e:ba:f6:29:4d:92:a3:94:b0:c2:ff:bd:bf:33:63:11:43:34:0f:51:b0:95:09:2f:63',
|
|
||||||
'sha512': 'f7:07:4a:f0:b0:f0:e6:8b:95:5f:f9:e6:61:0a:32:68:f1..."
|
|
||||||
signature_algorithm:
|
|
||||||
description: The signature algorithm used to sign the certificate.
|
|
||||||
returned: success
|
|
||||||
type: str
|
|
||||||
sample: sha256WithRSAEncryption
|
|
||||||
serial_number:
|
|
||||||
description: The certificate's serial number.
|
|
||||||
returned: success
|
|
||||||
type: int
|
|
||||||
sample: 1234
|
|
||||||
version:
|
|
||||||
description: The certificate version.
|
|
||||||
returned: success
|
|
||||||
type: int
|
|
||||||
sample: 3
|
|
||||||
valid_at:
|
|
||||||
description: For every time stamp provided in the I(valid_at) option, a
|
|
||||||
boolean whether the certificate is valid at that point in time
|
|
||||||
or not.
|
|
||||||
returned: success
|
|
||||||
type: dict
|
|
||||||
subject_key_identifier:
|
|
||||||
description:
|
|
||||||
- The certificate's subject key identifier.
|
|
||||||
- The identifier is returned in hexadecimal, with C(:) used to separate bytes.
|
|
||||||
- Is C(none) if the C(SubjectKeyIdentifier) extension is not present.
|
|
||||||
returned: success and if the pyOpenSSL backend is I(not) used
|
|
||||||
type: str
|
|
||||||
sample: '00:11:22:33:44:55:66:77:88:99:aa:bb:cc:dd:ee:ff:00:11:22:33'
|
|
||||||
version_added: "2.9"
|
|
||||||
authority_key_identifier:
|
|
||||||
description:
|
|
||||||
- The certificate's authority key identifier.
|
|
||||||
- The identifier is returned in hexadecimal, with C(:) used to separate bytes.
|
|
||||||
- Is C(none) if the C(AuthorityKeyIdentifier) extension is not present.
|
|
||||||
returned: success and if the pyOpenSSL backend is I(not) used
|
|
||||||
type: str
|
|
||||||
sample: '00:11:22:33:44:55:66:77:88:99:aa:bb:cc:dd:ee:ff:00:11:22:33'
|
|
||||||
version_added: "2.9"
|
|
||||||
authority_cert_issuer:
|
|
||||||
description:
|
|
||||||
- The certificate's authority cert issuer as a list of general names.
|
|
||||||
- Is C(none) if the C(AuthorityKeyIdentifier) extension is not present.
|
|
||||||
returned: success and if the pyOpenSSL backend is I(not) used
|
|
||||||
type: list
|
|
||||||
elements: str
|
|
||||||
sample: "[DNS:www.ansible.com, IP:1.2.3.4]"
|
|
||||||
version_added: "2.9"
|
|
||||||
authority_cert_serial_number:
|
|
||||||
description:
|
|
||||||
- The certificate's authority cert serial number.
|
|
||||||
- Is C(none) if the C(AuthorityKeyIdentifier) extension is not present.
|
|
||||||
returned: success and if the pyOpenSSL backend is I(not) used
|
|
||||||
type: int
|
|
||||||
sample: '12345'
|
|
||||||
version_added: "2.9"
|
|
||||||
ocsp_uri:
|
|
||||||
description: The OCSP responder URI, if included in the certificate. Will be
|
|
||||||
C(none) if no OCSP responder URI is included.
|
|
||||||
returned: success
|
|
||||||
type: str
|
|
||||||
version_added: "2.9"
|
|
||||||
'''
|
|
||||||
|
|
||||||
|
|
||||||
import abc
|
|
||||||
import binascii
|
|
||||||
import datetime
|
|
||||||
import os
|
|
||||||
import re
|
|
||||||
import traceback
|
|
||||||
|
|
||||||
from distutils.version import LooseVersion
|
|
||||||
|
|
||||||
from ansible.module_utils.basic import AnsibleModule, missing_required_lib
|
|
||||||
from ansible.module_utils.six import string_types
|
|
||||||
from ansible.module_utils._text import to_native, to_text, to_bytes
|
|
||||||
|
|
||||||
from ansible_collections.community.crypto.plugins.module_utils import crypto as crypto_utils
|
|
||||||
from ansible_collections.community.crypto.plugins.module_utils.compat import ipaddress as compat_ipaddress
|
|
||||||
|
|
||||||
MINIMAL_CRYPTOGRAPHY_VERSION = '1.6'
|
|
||||||
MINIMAL_PYOPENSSL_VERSION = '0.15'
|
|
||||||
|
|
||||||
PYOPENSSL_IMP_ERR = None
|
|
||||||
try:
|
|
||||||
import OpenSSL
|
|
||||||
from OpenSSL import crypto
|
|
||||||
PYOPENSSL_VERSION = LooseVersion(OpenSSL.__version__)
|
|
||||||
if OpenSSL.SSL.OPENSSL_VERSION_NUMBER >= 0x10100000:
|
|
||||||
# OpenSSL 1.1.0 or newer
|
|
||||||
OPENSSL_MUST_STAPLE_NAME = b"tlsfeature"
|
|
||||||
OPENSSL_MUST_STAPLE_VALUE = b"status_request"
|
|
||||||
else:
|
|
||||||
# OpenSSL 1.0.x or older
|
|
||||||
OPENSSL_MUST_STAPLE_NAME = b"1.3.6.1.5.5.7.1.24"
|
|
||||||
OPENSSL_MUST_STAPLE_VALUE = b"DER:30:03:02:01:05"
|
|
||||||
except ImportError:
|
|
||||||
PYOPENSSL_IMP_ERR = traceback.format_exc()
|
|
||||||
PYOPENSSL_FOUND = False
|
|
||||||
else:
|
|
||||||
PYOPENSSL_FOUND = True
|
|
||||||
|
|
||||||
CRYPTOGRAPHY_IMP_ERR = None
|
|
||||||
try:
|
|
||||||
import cryptography
|
|
||||||
from cryptography import x509
|
|
||||||
from cryptography.hazmat.primitives import serialization
|
|
||||||
CRYPTOGRAPHY_VERSION = LooseVersion(cryptography.__version__)
|
|
||||||
except ImportError:
|
|
||||||
CRYPTOGRAPHY_IMP_ERR = traceback.format_exc()
|
|
||||||
CRYPTOGRAPHY_FOUND = False
|
|
||||||
else:
|
|
||||||
CRYPTOGRAPHY_FOUND = True
|
|
||||||
|
|
||||||
|
|
||||||
TIMESTAMP_FORMAT = "%Y%m%d%H%M%SZ"
|
|
||||||
|
|
||||||
|
|
||||||
class CertificateInfo(crypto_utils.OpenSSLObject):
|
|
||||||
def __init__(self, module, backend):
|
|
||||||
super(CertificateInfo, self).__init__(
|
|
||||||
module.params['path'] or '',
|
|
||||||
'present',
|
|
||||||
False,
|
|
||||||
module.check_mode,
|
|
||||||
)
|
|
||||||
self.backend = backend
|
|
||||||
self.module = module
|
|
||||||
self.content = module.params['content']
|
|
||||||
if self.content is not None:
|
|
||||||
self.content = self.content.encode('utf-8')
|
|
||||||
|
|
||||||
self.valid_at = module.params['valid_at']
|
|
||||||
if self.valid_at:
|
|
||||||
for k, v in self.valid_at.items():
|
|
||||||
if not isinstance(v, string_types):
|
|
||||||
self.module.fail_json(
|
|
||||||
msg='The value for valid_at.{0} must be of type string (got {1})'.format(k, type(v))
|
|
||||||
)
|
|
||||||
self.valid_at[k] = crypto_utils.get_relative_time_option(v, 'valid_at.{0}'.format(k))
|
|
||||||
|
|
||||||
def generate(self):
|
|
||||||
# Empty method because crypto_utils.OpenSSLObject wants this
|
|
||||||
pass
|
|
||||||
|
|
||||||
def dump(self):
|
|
||||||
# Empty method because crypto_utils.OpenSSLObject wants this
|
|
||||||
pass
|
|
||||||
|
|
||||||
@abc.abstractmethod
|
|
||||||
def _get_signature_algorithm(self):
|
|
||||||
pass
|
|
||||||
|
|
||||||
@abc.abstractmethod
|
|
||||||
def _get_subject_ordered(self):
|
|
||||||
pass
|
|
||||||
|
|
||||||
@abc.abstractmethod
|
|
||||||
def _get_issuer_ordered(self):
|
|
||||||
pass
|
|
||||||
|
|
||||||
@abc.abstractmethod
|
|
||||||
def _get_version(self):
|
|
||||||
pass
|
|
||||||
|
|
||||||
@abc.abstractmethod
|
|
||||||
def _get_key_usage(self):
|
|
||||||
pass
|
|
||||||
|
|
||||||
@abc.abstractmethod
|
|
||||||
def _get_extended_key_usage(self):
|
|
||||||
pass
|
|
||||||
|
|
||||||
@abc.abstractmethod
|
|
||||||
def _get_basic_constraints(self):
|
|
||||||
pass
|
|
||||||
|
|
||||||
@abc.abstractmethod
|
|
||||||
def _get_ocsp_must_staple(self):
|
|
||||||
pass
|
|
||||||
|
|
||||||
@abc.abstractmethod
|
|
||||||
def _get_subject_alt_name(self):
|
|
||||||
pass
|
|
||||||
|
|
||||||
@abc.abstractmethod
|
|
||||||
def _get_not_before(self):
|
|
||||||
pass
|
|
||||||
|
|
||||||
@abc.abstractmethod
|
|
||||||
def _get_not_after(self):
|
|
||||||
pass
|
|
||||||
|
|
||||||
@abc.abstractmethod
|
|
||||||
def _get_public_key(self, binary):
|
|
||||||
pass
|
|
||||||
|
|
||||||
@abc.abstractmethod
|
|
||||||
def _get_subject_key_identifier(self):
|
|
||||||
pass
|
|
||||||
|
|
||||||
@abc.abstractmethod
|
|
||||||
def _get_authority_key_identifier(self):
|
|
||||||
pass
|
|
||||||
|
|
||||||
@abc.abstractmethod
|
|
||||||
def _get_serial_number(self):
|
|
||||||
pass
|
|
||||||
|
|
||||||
@abc.abstractmethod
|
|
||||||
def _get_all_extensions(self):
|
|
||||||
pass
|
|
||||||
|
|
||||||
@abc.abstractmethod
|
|
||||||
def _get_ocsp_uri(self):
|
|
||||||
pass
|
|
||||||
|
|
||||||
def get_info(self):
|
|
||||||
result = dict()
|
|
||||||
self.cert = crypto_utils.load_certificate(self.path, content=self.content, backend=self.backend)
|
|
||||||
|
|
||||||
result['signature_algorithm'] = self._get_signature_algorithm()
|
|
||||||
subject = self._get_subject_ordered()
|
|
||||||
issuer = self._get_issuer_ordered()
|
|
||||||
result['subject'] = dict()
|
|
||||||
for k, v in subject:
|
|
||||||
result['subject'][k] = v
|
|
||||||
result['subject_ordered'] = subject
|
|
||||||
result['issuer'] = dict()
|
|
||||||
for k, v in issuer:
|
|
||||||
result['issuer'][k] = v
|
|
||||||
result['issuer_ordered'] = issuer
|
|
||||||
result['version'] = self._get_version()
|
|
||||||
result['key_usage'], result['key_usage_critical'] = self._get_key_usage()
|
|
||||||
result['extended_key_usage'], result['extended_key_usage_critical'] = self._get_extended_key_usage()
|
|
||||||
result['basic_constraints'], result['basic_constraints_critical'] = self._get_basic_constraints()
|
|
||||||
result['ocsp_must_staple'], result['ocsp_must_staple_critical'] = self._get_ocsp_must_staple()
|
|
||||||
result['subject_alt_name'], result['subject_alt_name_critical'] = self._get_subject_alt_name()
|
|
||||||
|
|
||||||
not_before = self._get_not_before()
|
|
||||||
not_after = self._get_not_after()
|
|
||||||
result['not_before'] = not_before.strftime(TIMESTAMP_FORMAT)
|
|
||||||
result['not_after'] = not_after.strftime(TIMESTAMP_FORMAT)
|
|
||||||
result['expired'] = not_after < datetime.datetime.utcnow()
|
|
||||||
|
|
||||||
result['valid_at'] = dict()
|
|
||||||
if self.valid_at:
|
|
||||||
for k, v in self.valid_at.items():
|
|
||||||
result['valid_at'][k] = not_before <= v <= not_after
|
|
||||||
|
|
||||||
result['public_key'] = self._get_public_key(binary=False)
|
|
||||||
pk = self._get_public_key(binary=True)
|
|
||||||
result['public_key_fingerprints'] = crypto_utils.get_fingerprint_of_bytes(pk) if pk is not None else dict()
|
|
||||||
|
|
||||||
if self.backend != 'pyopenssl':
|
|
||||||
ski = self._get_subject_key_identifier()
|
|
||||||
if ski is not None:
|
|
||||||
ski = to_native(binascii.hexlify(ski))
|
|
||||||
ski = ':'.join([ski[i:i + 2] for i in range(0, len(ski), 2)])
|
|
||||||
result['subject_key_identifier'] = ski
|
|
||||||
|
|
||||||
aki, aci, acsn = self._get_authority_key_identifier()
|
|
||||||
if aki is not None:
|
|
||||||
aki = to_native(binascii.hexlify(aki))
|
|
||||||
aki = ':'.join([aki[i:i + 2] for i in range(0, len(aki), 2)])
|
|
||||||
result['authority_key_identifier'] = aki
|
|
||||||
result['authority_cert_issuer'] = aci
|
|
||||||
result['authority_cert_serial_number'] = acsn
|
|
||||||
|
|
||||||
result['serial_number'] = self._get_serial_number()
|
|
||||||
result['extensions_by_oid'] = self._get_all_extensions()
|
|
||||||
result['ocsp_uri'] = self._get_ocsp_uri()
|
|
||||||
|
|
||||||
return result
|
|
||||||
|
|
||||||
|
|
||||||
class CertificateInfoCryptography(CertificateInfo):
|
|
||||||
"""Validate the supplied cert, using the cryptography backend"""
|
|
||||||
def __init__(self, module):
|
|
||||||
super(CertificateInfoCryptography, self).__init__(module, 'cryptography')
|
|
||||||
|
|
||||||
def _get_signature_algorithm(self):
|
|
||||||
return crypto_utils.cryptography_oid_to_name(self.cert.signature_algorithm_oid)
|
|
||||||
|
|
||||||
def _get_subject_ordered(self):
|
|
||||||
result = []
|
|
||||||
for attribute in self.cert.subject:
|
|
||||||
result.append([crypto_utils.cryptography_oid_to_name(attribute.oid), attribute.value])
|
|
||||||
return result
|
|
||||||
|
|
||||||
def _get_issuer_ordered(self):
|
|
||||||
result = []
|
|
||||||
for attribute in self.cert.issuer:
|
|
||||||
result.append([crypto_utils.cryptography_oid_to_name(attribute.oid), attribute.value])
|
|
||||||
return result
|
|
||||||
|
|
||||||
def _get_version(self):
|
|
||||||
if self.cert.version == x509.Version.v1:
|
|
||||||
return 1
|
|
||||||
if self.cert.version == x509.Version.v3:
|
|
||||||
return 3
|
|
||||||
return "unknown"
|
|
||||||
|
|
||||||
def _get_key_usage(self):
|
|
||||||
try:
|
|
||||||
current_key_ext = self.cert.extensions.get_extension_for_class(x509.KeyUsage)
|
|
||||||
current_key_usage = current_key_ext.value
|
|
||||||
key_usage = dict(
|
|
||||||
digital_signature=current_key_usage.digital_signature,
|
|
||||||
content_commitment=current_key_usage.content_commitment,
|
|
||||||
key_encipherment=current_key_usage.key_encipherment,
|
|
||||||
data_encipherment=current_key_usage.data_encipherment,
|
|
||||||
key_agreement=current_key_usage.key_agreement,
|
|
||||||
key_cert_sign=current_key_usage.key_cert_sign,
|
|
||||||
crl_sign=current_key_usage.crl_sign,
|
|
||||||
encipher_only=False,
|
|
||||||
decipher_only=False,
|
|
||||||
)
|
|
||||||
if key_usage['key_agreement']:
|
|
||||||
key_usage.update(dict(
|
|
||||||
encipher_only=current_key_usage.encipher_only,
|
|
||||||
decipher_only=current_key_usage.decipher_only
|
|
||||||
))
|
|
||||||
|
|
||||||
key_usage_names = dict(
|
|
||||||
digital_signature='Digital Signature',
|
|
||||||
content_commitment='Non Repudiation',
|
|
||||||
key_encipherment='Key Encipherment',
|
|
||||||
data_encipherment='Data Encipherment',
|
|
||||||
key_agreement='Key Agreement',
|
|
||||||
key_cert_sign='Certificate Sign',
|
|
||||||
crl_sign='CRL Sign',
|
|
||||||
encipher_only='Encipher Only',
|
|
||||||
decipher_only='Decipher Only',
|
|
||||||
)
|
|
||||||
return sorted([
|
|
||||||
key_usage_names[name] for name, value in key_usage.items() if value
|
|
||||||
]), current_key_ext.critical
|
|
||||||
except cryptography.x509.ExtensionNotFound:
|
|
||||||
return None, False
|
|
||||||
|
|
||||||
def _get_extended_key_usage(self):
|
|
||||||
try:
|
|
||||||
ext_keyusage_ext = self.cert.extensions.get_extension_for_class(x509.ExtendedKeyUsage)
|
|
||||||
return sorted([
|
|
||||||
crypto_utils.cryptography_oid_to_name(eku) for eku in ext_keyusage_ext.value
|
|
||||||
]), ext_keyusage_ext.critical
|
|
||||||
except cryptography.x509.ExtensionNotFound:
|
|
||||||
return None, False
|
|
||||||
|
|
||||||
def _get_basic_constraints(self):
|
|
||||||
try:
|
|
||||||
ext_keyusage_ext = self.cert.extensions.get_extension_for_class(x509.BasicConstraints)
|
|
||||||
result = []
|
|
||||||
result.append('CA:{0}'.format('TRUE' if ext_keyusage_ext.value.ca else 'FALSE'))
|
|
||||||
if ext_keyusage_ext.value.path_length is not None:
|
|
||||||
result.append('pathlen:{0}'.format(ext_keyusage_ext.value.path_length))
|
|
||||||
return sorted(result), ext_keyusage_ext.critical
|
|
||||||
except cryptography.x509.ExtensionNotFound:
|
|
||||||
return None, False
|
|
||||||
|
|
||||||
def _get_ocsp_must_staple(self):
|
|
||||||
try:
|
|
||||||
try:
|
|
||||||
# This only works with cryptography >= 2.1
|
|
||||||
tlsfeature_ext = self.cert.extensions.get_extension_for_class(x509.TLSFeature)
|
|
||||||
value = cryptography.x509.TLSFeatureType.status_request in tlsfeature_ext.value
|
|
||||||
except AttributeError as dummy:
|
|
||||||
# Fallback for cryptography < 2.1
|
|
||||||
oid = x509.oid.ObjectIdentifier("1.3.6.1.5.5.7.1.24")
|
|
||||||
tlsfeature_ext = self.cert.extensions.get_extension_for_oid(oid)
|
|
||||||
value = tlsfeature_ext.value.value == b"\x30\x03\x02\x01\x05"
|
|
||||||
return value, tlsfeature_ext.critical
|
|
||||||
except cryptography.x509.ExtensionNotFound:
|
|
||||||
return None, False
|
|
||||||
|
|
||||||
def _get_subject_alt_name(self):
|
|
||||||
try:
|
|
||||||
san_ext = self.cert.extensions.get_extension_for_class(x509.SubjectAlternativeName)
|
|
||||||
result = [crypto_utils.cryptography_decode_name(san) for san in san_ext.value]
|
|
||||||
return result, san_ext.critical
|
|
||||||
except cryptography.x509.ExtensionNotFound:
|
|
||||||
return None, False
|
|
||||||
|
|
||||||
def _get_not_before(self):
|
|
||||||
return self.cert.not_valid_before
|
|
||||||
|
|
||||||
def _get_not_after(self):
|
|
||||||
return self.cert.not_valid_after
|
|
||||||
|
|
||||||
def _get_public_key(self, binary):
|
|
||||||
return self.cert.public_key().public_bytes(
|
|
||||||
serialization.Encoding.DER if binary else serialization.Encoding.PEM,
|
|
||||||
serialization.PublicFormat.SubjectPublicKeyInfo
|
|
||||||
)
|
|
||||||
|
|
||||||
def _get_subject_key_identifier(self):
|
|
||||||
try:
|
|
||||||
ext = self.cert.extensions.get_extension_for_class(x509.SubjectKeyIdentifier)
|
|
||||||
return ext.value.digest
|
|
||||||
except cryptography.x509.ExtensionNotFound:
|
|
||||||
return None
|
|
||||||
|
|
||||||
def _get_authority_key_identifier(self):
|
|
||||||
try:
|
|
||||||
ext = self.cert.extensions.get_extension_for_class(x509.AuthorityKeyIdentifier)
|
|
||||||
issuer = None
|
|
||||||
if ext.value.authority_cert_issuer is not None:
|
|
||||||
issuer = [crypto_utils.cryptography_decode_name(san) for san in ext.value.authority_cert_issuer]
|
|
||||||
return ext.value.key_identifier, issuer, ext.value.authority_cert_serial_number
|
|
||||||
except cryptography.x509.ExtensionNotFound:
|
|
||||||
return None, None, None
|
|
||||||
|
|
||||||
def _get_serial_number(self):
|
|
||||||
return self.cert.serial_number
|
|
||||||
|
|
||||||
def _get_all_extensions(self):
|
|
||||||
return crypto_utils.cryptography_get_extensions_from_cert(self.cert)
|
|
||||||
|
|
||||||
def _get_ocsp_uri(self):
|
|
||||||
try:
|
|
||||||
ext = self.cert.extensions.get_extension_for_class(x509.AuthorityInformationAccess)
|
|
||||||
for desc in ext.value:
|
|
||||||
if desc.access_method == x509.oid.AuthorityInformationAccessOID.OCSP:
|
|
||||||
if isinstance(desc.access_location, x509.UniformResourceIdentifier):
|
|
||||||
return desc.access_location.value
|
|
||||||
except x509.ExtensionNotFound as dummy:
|
|
||||||
pass
|
|
||||||
return None
|
|
||||||
|
|
||||||
|
|
||||||
class CertificateInfoPyOpenSSL(CertificateInfo):
|
|
||||||
"""validate the supplied certificate."""
|
|
||||||
|
|
||||||
def __init__(self, module):
|
|
||||||
super(CertificateInfoPyOpenSSL, self).__init__(module, 'pyopenssl')
|
|
||||||
|
|
||||||
def _get_signature_algorithm(self):
|
|
||||||
return to_text(self.cert.get_signature_algorithm())
|
|
||||||
|
|
||||||
def __get_name(self, name):
|
|
||||||
result = []
|
|
||||||
for sub in name.get_components():
|
|
||||||
result.append([crypto_utils.pyopenssl_normalize_name(sub[0]), to_text(sub[1])])
|
|
||||||
return result
|
|
||||||
|
|
||||||
def _get_subject_ordered(self):
|
|
||||||
return self.__get_name(self.cert.get_subject())
|
|
||||||
|
|
||||||
def _get_issuer_ordered(self):
|
|
||||||
return self.__get_name(self.cert.get_issuer())
|
|
||||||
|
|
||||||
def _get_version(self):
|
|
||||||
# Version numbers in certs are off by one:
|
|
||||||
# v1: 0, v2: 1, v3: 2 ...
|
|
||||||
return self.cert.get_version() + 1
|
|
||||||
|
|
||||||
def _get_extension(self, short_name):
|
|
||||||
for extension_idx in range(0, self.cert.get_extension_count()):
|
|
||||||
extension = self.cert.get_extension(extension_idx)
|
|
||||||
if extension.get_short_name() == short_name:
|
|
||||||
result = [
|
|
||||||
crypto_utils.pyopenssl_normalize_name(usage.strip()) for usage in to_text(extension, errors='surrogate_or_strict').split(',')
|
|
||||||
]
|
|
||||||
return sorted(result), bool(extension.get_critical())
|
|
||||||
return None, False
|
|
||||||
|
|
||||||
def _get_key_usage(self):
|
|
||||||
return self._get_extension(b'keyUsage')
|
|
||||||
|
|
||||||
def _get_extended_key_usage(self):
|
|
||||||
return self._get_extension(b'extendedKeyUsage')
|
|
||||||
|
|
||||||
def _get_basic_constraints(self):
|
|
||||||
return self._get_extension(b'basicConstraints')
|
|
||||||
|
|
||||||
def _get_ocsp_must_staple(self):
|
|
||||||
extensions = [self.cert.get_extension(i) for i in range(0, self.cert.get_extension_count())]
|
|
||||||
oms_ext = [
|
|
||||||
ext for ext in extensions
|
|
||||||
if to_bytes(ext.get_short_name()) == OPENSSL_MUST_STAPLE_NAME and to_bytes(ext) == OPENSSL_MUST_STAPLE_VALUE
|
|
||||||
]
|
|
||||||
if OpenSSL.SSL.OPENSSL_VERSION_NUMBER < 0x10100000:
|
|
||||||
# Older versions of libssl don't know about OCSP Must Staple
|
|
||||||
oms_ext.extend([ext for ext in extensions if ext.get_short_name() == b'UNDEF' and ext.get_data() == b'\x30\x03\x02\x01\x05'])
|
|
||||||
if oms_ext:
|
|
||||||
return True, bool(oms_ext[0].get_critical())
|
|
||||||
else:
|
|
||||||
return None, False
|
|
||||||
|
|
||||||
def _normalize_san(self, san):
|
|
||||||
if san.startswith('IP Address:'):
|
|
||||||
san = 'IP:' + san[len('IP Address:'):]
|
|
||||||
if san.startswith('IP:'):
|
|
||||||
ip = compat_ipaddress.ip_address(san[3:])
|
|
||||||
san = 'IP:{0}'.format(ip.compressed)
|
|
||||||
return san
|
|
||||||
|
|
||||||
def _get_subject_alt_name(self):
|
|
||||||
for extension_idx in range(0, self.cert.get_extension_count()):
|
|
||||||
extension = self.cert.get_extension(extension_idx)
|
|
||||||
if extension.get_short_name() == b'subjectAltName':
|
|
||||||
result = [self._normalize_san(altname.strip()) for altname in
|
|
||||||
to_text(extension, errors='surrogate_or_strict').split(', ')]
|
|
||||||
return result, bool(extension.get_critical())
|
|
||||||
return None, False
|
|
||||||
|
|
||||||
def _get_not_before(self):
|
|
||||||
time_string = to_native(self.cert.get_notBefore())
|
|
||||||
return datetime.datetime.strptime(time_string, "%Y%m%d%H%M%SZ")
|
|
||||||
|
|
||||||
def _get_not_after(self):
|
|
||||||
time_string = to_native(self.cert.get_notAfter())
|
|
||||||
return datetime.datetime.strptime(time_string, "%Y%m%d%H%M%SZ")
|
|
||||||
|
|
||||||
def _get_public_key(self, binary):
|
|
||||||
try:
|
|
||||||
return crypto.dump_publickey(
|
|
||||||
crypto.FILETYPE_ASN1 if binary else crypto.FILETYPE_PEM,
|
|
||||||
self.cert.get_pubkey()
|
|
||||||
)
|
|
||||||
except AttributeError:
|
|
||||||
try:
|
|
||||||
# pyOpenSSL < 16.0:
|
|
||||||
bio = crypto._new_mem_buf()
|
|
||||||
if binary:
|
|
||||||
rc = crypto._lib.i2d_PUBKEY_bio(bio, self.cert.get_pubkey()._pkey)
|
|
||||||
else:
|
|
||||||
rc = crypto._lib.PEM_write_bio_PUBKEY(bio, self.cert.get_pubkey()._pkey)
|
|
||||||
if rc != 1:
|
|
||||||
crypto._raise_current_error()
|
|
||||||
return crypto._bio_to_string(bio)
|
|
||||||
except AttributeError:
|
|
||||||
self.module.warn('Your pyOpenSSL version does not support dumping public keys. '
|
|
||||||
'Please upgrade to version 16.0 or newer, or use the cryptography backend.')
|
|
||||||
|
|
||||||
def _get_subject_key_identifier(self):
|
|
||||||
# Won't be implemented
|
|
||||||
return None
|
|
||||||
|
|
||||||
def _get_authority_key_identifier(self):
|
|
||||||
# Won't be implemented
|
|
||||||
return None, None, None
|
|
||||||
|
|
||||||
def _get_serial_number(self):
|
|
||||||
return self.cert.get_serial_number()
|
|
||||||
|
|
||||||
def _get_all_extensions(self):
|
|
||||||
return crypto_utils.pyopenssl_get_extensions_from_cert(self.cert)
|
|
||||||
|
|
||||||
def _get_ocsp_uri(self):
|
|
||||||
for i in range(self.cert.get_extension_count()):
|
|
||||||
ext = self.cert.get_extension(i)
|
|
||||||
if ext.get_short_name() == b'authorityInfoAccess':
|
|
||||||
v = str(ext)
|
|
||||||
m = re.search('^OCSP - URI:(.*)$', v, flags=re.MULTILINE)
|
|
||||||
if m:
|
|
||||||
return m.group(1)
|
|
||||||
return None
|
|
||||||
|
|
||||||
|
|
||||||
def main():
|
|
||||||
module = AnsibleModule(
|
|
||||||
argument_spec=dict(
|
|
||||||
path=dict(type='path'),
|
|
||||||
content=dict(type='str'),
|
|
||||||
valid_at=dict(type='dict'),
|
|
||||||
select_crypto_backend=dict(type='str', default='auto', choices=['auto', 'cryptography', 'pyopenssl']),
|
|
||||||
),
|
|
||||||
required_one_of=(
|
|
||||||
['path', 'content'],
|
|
||||||
),
|
|
||||||
mutually_exclusive=(
|
|
||||||
['path', 'content'],
|
|
||||||
),
|
|
||||||
supports_check_mode=True,
|
|
||||||
)
|
|
||||||
|
|
||||||
try:
|
|
||||||
if module.params['path'] is not None:
|
|
||||||
base_dir = os.path.dirname(module.params['path']) or '.'
|
|
||||||
if not os.path.isdir(base_dir):
|
|
||||||
module.fail_json(
|
|
||||||
name=base_dir,
|
|
||||||
msg='The directory %s does not exist or the file is not a directory' % base_dir
|
|
||||||
)
|
|
||||||
|
|
||||||
backend = module.params['select_crypto_backend']
|
|
||||||
if backend == 'auto':
|
|
||||||
# Detect what backend we can use
|
|
||||||
can_use_cryptography = CRYPTOGRAPHY_FOUND and CRYPTOGRAPHY_VERSION >= LooseVersion(MINIMAL_CRYPTOGRAPHY_VERSION)
|
|
||||||
can_use_pyopenssl = PYOPENSSL_FOUND and PYOPENSSL_VERSION >= LooseVersion(MINIMAL_PYOPENSSL_VERSION)
|
|
||||||
|
|
||||||
# If cryptography is available we'll use it
|
|
||||||
if can_use_cryptography:
|
|
||||||
backend = 'cryptography'
|
|
||||||
elif can_use_pyopenssl:
|
|
||||||
backend = 'pyopenssl'
|
|
||||||
|
|
||||||
# Fail if no backend has been found
|
|
||||||
if backend == 'auto':
|
|
||||||
module.fail_json(msg=("Can't detect any of the required Python libraries "
|
|
||||||
"cryptography (>= {0}) or PyOpenSSL (>= {1})").format(
|
|
||||||
MINIMAL_CRYPTOGRAPHY_VERSION,
|
|
||||||
MINIMAL_PYOPENSSL_VERSION))
|
|
||||||
|
|
||||||
if backend == 'pyopenssl':
|
|
||||||
if not PYOPENSSL_FOUND:
|
|
||||||
module.fail_json(msg=missing_required_lib('pyOpenSSL >= {0}'.format(MINIMAL_PYOPENSSL_VERSION)),
|
|
||||||
exception=PYOPENSSL_IMP_ERR)
|
|
||||||
try:
|
|
||||||
getattr(crypto.X509Req, 'get_extensions')
|
|
||||||
except AttributeError:
|
|
||||||
module.fail_json(msg='You need to have PyOpenSSL>=0.15')
|
|
||||||
|
|
||||||
module.deprecate('The module is using the PyOpenSSL backend. This backend has been deprecated', version='2.13')
|
|
||||||
certificate = CertificateInfoPyOpenSSL(module)
|
|
||||||
elif backend == 'cryptography':
|
|
||||||
if not CRYPTOGRAPHY_FOUND:
|
|
||||||
module.fail_json(msg=missing_required_lib('cryptography >= {0}'.format(MINIMAL_CRYPTOGRAPHY_VERSION)),
|
|
||||||
exception=CRYPTOGRAPHY_IMP_ERR)
|
|
||||||
certificate = CertificateInfoCryptography(module)
|
|
||||||
|
|
||||||
result = certificate.get_info()
|
|
||||||
module.exit_json(**result)
|
|
||||||
except crypto_utils.OpenSSLObjectError as exc:
|
|
||||||
module.fail_json(msg=to_native(exc))
|
|
||||||
|
|
||||||
|
|
||||||
if __name__ == "__main__":
|
|
||||||
main()
|
|
||||||
|
|
@ -0,0 +1 @@
|
||||||
|
x509_certificate_info.py
|
||||||
|
|
@ -277,7 +277,7 @@ notes:
|
||||||
keyUsage, extendedKeyUsage and basicConstraints only contain the requested values, whether
|
keyUsage, extendedKeyUsage and basicConstraints only contain the requested values, whether
|
||||||
OCSP Must Staple is as requested, and if the request was signed by the given private key.
|
OCSP Must Staple is as requested, and if the request was signed by the given private key.
|
||||||
seealso:
|
seealso:
|
||||||
- module: openssl_certificate
|
- module: x509_certificate
|
||||||
- module: openssl_dhparam
|
- module: openssl_dhparam
|
||||||
- module: openssl_pkcs12
|
- module: openssl_pkcs12
|
||||||
- module: openssl_privatekey
|
- module: openssl_privatekey
|
||||||
|
|
|
||||||
|
|
@ -75,7 +75,7 @@ options:
|
||||||
extends_documentation_fragment:
|
extends_documentation_fragment:
|
||||||
- files
|
- files
|
||||||
seealso:
|
seealso:
|
||||||
- module: openssl_certificate
|
- module: x509_certificate
|
||||||
- module: openssl_csr
|
- module: openssl_csr
|
||||||
- module: openssl_pkcs12
|
- module: openssl_pkcs12
|
||||||
- module: openssl_privatekey
|
- module: openssl_privatekey
|
||||||
|
|
|
||||||
|
|
@ -101,7 +101,7 @@ options:
|
||||||
extends_documentation_fragment:
|
extends_documentation_fragment:
|
||||||
- files
|
- files
|
||||||
seealso:
|
seealso:
|
||||||
- module: openssl_certificate
|
- module: x509_certificate
|
||||||
- module: openssl_csr
|
- module: openssl_csr
|
||||||
- module: openssl_dhparam
|
- module: openssl_dhparam
|
||||||
- module: openssl_privatekey
|
- module: openssl_privatekey
|
||||||
|
|
|
||||||
|
|
@ -190,7 +190,7 @@ options:
|
||||||
extends_documentation_fragment:
|
extends_documentation_fragment:
|
||||||
- files
|
- files
|
||||||
seealso:
|
seealso:
|
||||||
- module: openssl_certificate
|
- module: x509_certificate
|
||||||
- module: openssl_csr
|
- module: openssl_csr
|
||||||
- module: openssl_dhparam
|
- module: openssl_dhparam
|
||||||
- module: openssl_pkcs12
|
- module: openssl_pkcs12
|
||||||
|
|
|
||||||
|
|
@ -92,7 +92,7 @@ options:
|
||||||
extends_documentation_fragment:
|
extends_documentation_fragment:
|
||||||
- files
|
- files
|
||||||
seealso:
|
seealso:
|
||||||
- module: openssl_certificate
|
- module: x509_certificate
|
||||||
- module: openssl_csr
|
- module: openssl_csr
|
||||||
- module: openssl_dhparam
|
- module: openssl_dhparam
|
||||||
- module: openssl_pkcs12
|
- module: openssl_pkcs12
|
||||||
|
|
|
||||||
File diff suppressed because it is too large
Load Diff
|
|
@ -0,0 +1,871 @@
|
||||||
|
#!/usr/bin/python
|
||||||
|
# -*- coding: utf-8 -*-
|
||||||
|
|
||||||
|
# Copyright: (c) 2016-2017, Yanis Guenane <yanis+ansible@guenane.org>
|
||||||
|
# Copyright: (c) 2017, Markus Teufelberger <mteufelberger+ansible@mgit.at>
|
||||||
|
# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
|
||||||
|
|
||||||
|
from __future__ import absolute_import, division, print_function
|
||||||
|
__metaclass__ = type
|
||||||
|
|
||||||
|
ANSIBLE_METADATA = {'metadata_version': '1.1',
|
||||||
|
'status': ['preview'],
|
||||||
|
'supported_by': 'community'}
|
||||||
|
|
||||||
|
DOCUMENTATION = r'''
|
||||||
|
---
|
||||||
|
module: x509_certificate_info
|
||||||
|
short_description: Provide information of OpenSSL X.509 certificates
|
||||||
|
description:
|
||||||
|
- This module allows one to query information on OpenSSL certificates.
|
||||||
|
- It uses the pyOpenSSL or cryptography python library to interact with OpenSSL. If both the
|
||||||
|
cryptography and PyOpenSSL libraries are available (and meet the minimum version requirements)
|
||||||
|
cryptography will be preferred as a backend over PyOpenSSL (unless the backend is forced with
|
||||||
|
C(select_crypto_backend)). Please note that the PyOpenSSL backend was deprecated in Ansible 2.9
|
||||||
|
and will be removed in Ansible 2.13.
|
||||||
|
- Note that this module was called C(openssl_certificate_info) when included directly in Ansible up to version 2.9.
|
||||||
|
When moved to the collection C(community.crypto), it was renamed to M(x509_certificate_info). From Ansible 2.10 on, it can
|
||||||
|
still be used by the old short name (or by C(ansible.builtin.openssl_certificate_info)), which redirects to
|
||||||
|
C(community.crypto.x509_certificate_info). When using FQCNs or when using the
|
||||||
|
L(collections,https://docs.ansible.com/ansible/latest/user_guide/collections_using.html#using-collections-in-a-playbook)
|
||||||
|
keyword, the new name M(x509_certificate_info) should be used to avoid a deprecation warning.
|
||||||
|
requirements:
|
||||||
|
- PyOpenSSL >= 0.15 or cryptography >= 1.6
|
||||||
|
author:
|
||||||
|
- Felix Fontein (@felixfontein)
|
||||||
|
- Yanis Guenane (@Spredzy)
|
||||||
|
- Markus Teufelberger (@MarkusTeufelberger)
|
||||||
|
options:
|
||||||
|
path:
|
||||||
|
description:
|
||||||
|
- Remote absolute path where the certificate file is loaded from.
|
||||||
|
- Either I(path) or I(content) must be specified, but not both.
|
||||||
|
type: path
|
||||||
|
content:
|
||||||
|
description:
|
||||||
|
- Content of the X.509 certificate in PEM format.
|
||||||
|
- Either I(path) or I(content) must be specified, but not both.
|
||||||
|
type: str
|
||||||
|
valid_at:
|
||||||
|
description:
|
||||||
|
- A dict of names mapping to time specifications. Every time specified here
|
||||||
|
will be checked whether the certificate is valid at this point. See the
|
||||||
|
C(valid_at) return value for informations on the result.
|
||||||
|
- Time can be specified either as relative time or as absolute timestamp.
|
||||||
|
- Time will always be interpreted as UTC.
|
||||||
|
- Valid format is C([+-]timespec | ASN.1 TIME) where timespec can be an integer
|
||||||
|
+ C([w | d | h | m | s]) (e.g. C(+32w1d2h), and ASN.1 TIME (i.e. pattern C(YYYYMMDDHHMMSSZ)).
|
||||||
|
Note that all timestamps will be treated as being in UTC.
|
||||||
|
type: dict
|
||||||
|
select_crypto_backend:
|
||||||
|
description:
|
||||||
|
- Determines which crypto backend to use.
|
||||||
|
- The default choice is C(auto), which tries to use C(cryptography) if available, and falls back to C(pyopenssl).
|
||||||
|
- If set to C(pyopenssl), will try to use the L(pyOpenSSL,https://pypi.org/project/pyOpenSSL/) library.
|
||||||
|
- If set to C(cryptography), will try to use the L(cryptography,https://cryptography.io/) library.
|
||||||
|
- Please note that the C(pyopenssl) backend has been deprecated in Ansible 2.9, and will be removed in Ansible 2.13.
|
||||||
|
From that point on, only the C(cryptography) backend will be available.
|
||||||
|
type: str
|
||||||
|
default: auto
|
||||||
|
choices: [ auto, cryptography, pyopenssl ]
|
||||||
|
|
||||||
|
notes:
|
||||||
|
- All timestamp values are provided in ASN.1 TIME format, i.e. following the C(YYYYMMDDHHMMSSZ) pattern.
|
||||||
|
They are all in UTC.
|
||||||
|
seealso:
|
||||||
|
- module: x509_certificate
|
||||||
|
'''
|
||||||
|
|
||||||
|
EXAMPLES = r'''
|
||||||
|
- name: Generate a Self Signed OpenSSL certificate
|
||||||
|
community.crypto.x509_certificate:
|
||||||
|
path: /etc/ssl/crt/ansible.com.crt
|
||||||
|
privatekey_path: /etc/ssl/private/ansible.com.pem
|
||||||
|
csr_path: /etc/ssl/csr/ansible.com.csr
|
||||||
|
provider: selfsigned
|
||||||
|
|
||||||
|
|
||||||
|
# Get information on the certificate
|
||||||
|
|
||||||
|
- name: Get information on generated certificate
|
||||||
|
community.crypto.x509_certificate_info:
|
||||||
|
path: /etc/ssl/crt/ansible.com.crt
|
||||||
|
register: result
|
||||||
|
|
||||||
|
- name: Dump information
|
||||||
|
debug:
|
||||||
|
var: result
|
||||||
|
|
||||||
|
|
||||||
|
# Check whether the certificate is valid or not valid at certain times, fail
|
||||||
|
# if this is not the case. The first task (x509_certificate_info) collects
|
||||||
|
# the information, and the second task (assert) validates the result and
|
||||||
|
# makes the playbook fail in case something is not as expected.
|
||||||
|
|
||||||
|
- name: Test whether that certificate is valid tomorrow and/or in three weeks
|
||||||
|
community.crypto.x509_certificate_info:
|
||||||
|
path: /etc/ssl/crt/ansible.com.crt
|
||||||
|
valid_at:
|
||||||
|
point_1: "+1d"
|
||||||
|
point_2: "+3w"
|
||||||
|
register: result
|
||||||
|
|
||||||
|
- name: Validate that certificate is valid tomorrow, but not in three weeks
|
||||||
|
assert:
|
||||||
|
that:
|
||||||
|
- result.valid_at.point_1 # valid in one day
|
||||||
|
- not result.valid_at.point_2 # not valid in three weeks
|
||||||
|
'''
|
||||||
|
|
||||||
|
RETURN = r'''
|
||||||
|
expired:
|
||||||
|
description: Whether the certificate is expired (i.e. C(notAfter) is in the past)
|
||||||
|
returned: success
|
||||||
|
type: bool
|
||||||
|
basic_constraints:
|
||||||
|
description: Entries in the C(basic_constraints) extension, or C(none) if extension is not present.
|
||||||
|
returned: success
|
||||||
|
type: list
|
||||||
|
elements: str
|
||||||
|
sample: "[CA:TRUE, pathlen:1]"
|
||||||
|
basic_constraints_critical:
|
||||||
|
description: Whether the C(basic_constraints) extension is critical.
|
||||||
|
returned: success
|
||||||
|
type: bool
|
||||||
|
extended_key_usage:
|
||||||
|
description: Entries in the C(extended_key_usage) extension, or C(none) if extension is not present.
|
||||||
|
returned: success
|
||||||
|
type: list
|
||||||
|
elements: str
|
||||||
|
sample: "[Biometric Info, DVCS, Time Stamping]"
|
||||||
|
extended_key_usage_critical:
|
||||||
|
description: Whether the C(extended_key_usage) extension is critical.
|
||||||
|
returned: success
|
||||||
|
type: bool
|
||||||
|
extensions_by_oid:
|
||||||
|
description: Returns a dictionary for every extension OID
|
||||||
|
returned: success
|
||||||
|
type: dict
|
||||||
|
contains:
|
||||||
|
critical:
|
||||||
|
description: Whether the extension is critical.
|
||||||
|
returned: success
|
||||||
|
type: bool
|
||||||
|
value:
|
||||||
|
description: The Base64 encoded value (in DER format) of the extension
|
||||||
|
returned: success
|
||||||
|
type: str
|
||||||
|
sample: "MAMCAQU="
|
||||||
|
sample: '{"1.3.6.1.5.5.7.1.24": { "critical": false, "value": "MAMCAQU="}}'
|
||||||
|
key_usage:
|
||||||
|
description: Entries in the C(key_usage) extension, or C(none) if extension is not present.
|
||||||
|
returned: success
|
||||||
|
type: str
|
||||||
|
sample: "[Key Agreement, Data Encipherment]"
|
||||||
|
key_usage_critical:
|
||||||
|
description: Whether the C(key_usage) extension is critical.
|
||||||
|
returned: success
|
||||||
|
type: bool
|
||||||
|
subject_alt_name:
|
||||||
|
description: Entries in the C(subject_alt_name) extension, or C(none) if extension is not present.
|
||||||
|
returned: success
|
||||||
|
type: list
|
||||||
|
elements: str
|
||||||
|
sample: "[DNS:www.ansible.com, IP:1.2.3.4]"
|
||||||
|
subject_alt_name_critical:
|
||||||
|
description: Whether the C(subject_alt_name) extension is critical.
|
||||||
|
returned: success
|
||||||
|
type: bool
|
||||||
|
ocsp_must_staple:
|
||||||
|
description: C(yes) if the OCSP Must Staple extension is present, C(none) otherwise.
|
||||||
|
returned: success
|
||||||
|
type: bool
|
||||||
|
ocsp_must_staple_critical:
|
||||||
|
description: Whether the C(ocsp_must_staple) extension is critical.
|
||||||
|
returned: success
|
||||||
|
type: bool
|
||||||
|
issuer:
|
||||||
|
description:
|
||||||
|
- The certificate's issuer.
|
||||||
|
- Note that for repeated values, only the last one will be returned.
|
||||||
|
returned: success
|
||||||
|
type: dict
|
||||||
|
sample: '{"organizationName": "Ansible", "commonName": "ca.example.com"}'
|
||||||
|
issuer_ordered:
|
||||||
|
description: The certificate's issuer as an ordered list of tuples.
|
||||||
|
returned: success
|
||||||
|
type: list
|
||||||
|
elements: list
|
||||||
|
sample: '[["organizationName", "Ansible"], ["commonName": "ca.example.com"]]'
|
||||||
|
version_added: "2.9"
|
||||||
|
subject:
|
||||||
|
description:
|
||||||
|
- The certificate's subject as a dictionary.
|
||||||
|
- Note that for repeated values, only the last one will be returned.
|
||||||
|
returned: success
|
||||||
|
type: dict
|
||||||
|
sample: '{"commonName": "www.example.com", "emailAddress": "test@example.com"}'
|
||||||
|
subject_ordered:
|
||||||
|
description: The certificate's subject as an ordered list of tuples.
|
||||||
|
returned: success
|
||||||
|
type: list
|
||||||
|
elements: list
|
||||||
|
sample: '[["commonName", "www.example.com"], ["emailAddress": "test@example.com"]]'
|
||||||
|
version_added: "2.9"
|
||||||
|
not_after:
|
||||||
|
description: C(notAfter) date as ASN.1 TIME
|
||||||
|
returned: success
|
||||||
|
type: str
|
||||||
|
sample: 20190413202428Z
|
||||||
|
not_before:
|
||||||
|
description: C(notBefore) date as ASN.1 TIME
|
||||||
|
returned: success
|
||||||
|
type: str
|
||||||
|
sample: 20190331202428Z
|
||||||
|
public_key:
|
||||||
|
description: Certificate's public key in PEM format
|
||||||
|
returned: success
|
||||||
|
type: str
|
||||||
|
sample: "-----BEGIN PUBLIC KEY-----\nMIICIjANBgkqhkiG9w0BAQEFAAOCAg8A..."
|
||||||
|
public_key_fingerprints:
|
||||||
|
description:
|
||||||
|
- Fingerprints of certificate's public key.
|
||||||
|
- For every hash algorithm available, the fingerprint is computed.
|
||||||
|
returned: success
|
||||||
|
type: dict
|
||||||
|
sample: "{'sha256': 'd4:b3:aa:6d:c8:04:ce:4e:ba:f6:29:4d:92:a3:94:b0:c2:ff:bd:bf:33:63:11:43:34:0f:51:b0:95:09:2f:63',
|
||||||
|
'sha512': 'f7:07:4a:f0:b0:f0:e6:8b:95:5f:f9:e6:61:0a:32:68:f1..."
|
||||||
|
signature_algorithm:
|
||||||
|
description: The signature algorithm used to sign the certificate.
|
||||||
|
returned: success
|
||||||
|
type: str
|
||||||
|
sample: sha256WithRSAEncryption
|
||||||
|
serial_number:
|
||||||
|
description: The certificate's serial number.
|
||||||
|
returned: success
|
||||||
|
type: int
|
||||||
|
sample: 1234
|
||||||
|
version:
|
||||||
|
description: The certificate version.
|
||||||
|
returned: success
|
||||||
|
type: int
|
||||||
|
sample: 3
|
||||||
|
valid_at:
|
||||||
|
description: For every time stamp provided in the I(valid_at) option, a
|
||||||
|
boolean whether the certificate is valid at that point in time
|
||||||
|
or not.
|
||||||
|
returned: success
|
||||||
|
type: dict
|
||||||
|
subject_key_identifier:
|
||||||
|
description:
|
||||||
|
- The certificate's subject key identifier.
|
||||||
|
- The identifier is returned in hexadecimal, with C(:) used to separate bytes.
|
||||||
|
- Is C(none) if the C(SubjectKeyIdentifier) extension is not present.
|
||||||
|
returned: success and if the pyOpenSSL backend is I(not) used
|
||||||
|
type: str
|
||||||
|
sample: '00:11:22:33:44:55:66:77:88:99:aa:bb:cc:dd:ee:ff:00:11:22:33'
|
||||||
|
version_added: "2.9"
|
||||||
|
authority_key_identifier:
|
||||||
|
description:
|
||||||
|
- The certificate's authority key identifier.
|
||||||
|
- The identifier is returned in hexadecimal, with C(:) used to separate bytes.
|
||||||
|
- Is C(none) if the C(AuthorityKeyIdentifier) extension is not present.
|
||||||
|
returned: success and if the pyOpenSSL backend is I(not) used
|
||||||
|
type: str
|
||||||
|
sample: '00:11:22:33:44:55:66:77:88:99:aa:bb:cc:dd:ee:ff:00:11:22:33'
|
||||||
|
version_added: "2.9"
|
||||||
|
authority_cert_issuer:
|
||||||
|
description:
|
||||||
|
- The certificate's authority cert issuer as a list of general names.
|
||||||
|
- Is C(none) if the C(AuthorityKeyIdentifier) extension is not present.
|
||||||
|
returned: success and if the pyOpenSSL backend is I(not) used
|
||||||
|
type: list
|
||||||
|
elements: str
|
||||||
|
sample: "[DNS:www.ansible.com, IP:1.2.3.4]"
|
||||||
|
version_added: "2.9"
|
||||||
|
authority_cert_serial_number:
|
||||||
|
description:
|
||||||
|
- The certificate's authority cert serial number.
|
||||||
|
- Is C(none) if the C(AuthorityKeyIdentifier) extension is not present.
|
||||||
|
returned: success and if the pyOpenSSL backend is I(not) used
|
||||||
|
type: int
|
||||||
|
sample: '12345'
|
||||||
|
version_added: "2.9"
|
||||||
|
ocsp_uri:
|
||||||
|
description: The OCSP responder URI, if included in the certificate. Will be
|
||||||
|
C(none) if no OCSP responder URI is included.
|
||||||
|
returned: success
|
||||||
|
type: str
|
||||||
|
version_added: "2.9"
|
||||||
|
'''
|
||||||
|
|
||||||
|
|
||||||
|
import abc
|
||||||
|
import binascii
|
||||||
|
import datetime
|
||||||
|
import os
|
||||||
|
import re
|
||||||
|
import traceback
|
||||||
|
|
||||||
|
from distutils.version import LooseVersion
|
||||||
|
|
||||||
|
from ansible.module_utils.basic import AnsibleModule, missing_required_lib
|
||||||
|
from ansible.module_utils.six import string_types
|
||||||
|
from ansible.module_utils._text import to_native, to_text, to_bytes
|
||||||
|
|
||||||
|
from ansible_collections.community.crypto.plugins.module_utils import crypto as crypto_utils
|
||||||
|
from ansible_collections.community.crypto.plugins.module_utils.compat import ipaddress as compat_ipaddress
|
||||||
|
|
||||||
|
MINIMAL_CRYPTOGRAPHY_VERSION = '1.6'
|
||||||
|
MINIMAL_PYOPENSSL_VERSION = '0.15'
|
||||||
|
|
||||||
|
PYOPENSSL_IMP_ERR = None
|
||||||
|
try:
|
||||||
|
import OpenSSL
|
||||||
|
from OpenSSL import crypto
|
||||||
|
PYOPENSSL_VERSION = LooseVersion(OpenSSL.__version__)
|
||||||
|
if OpenSSL.SSL.OPENSSL_VERSION_NUMBER >= 0x10100000:
|
||||||
|
# OpenSSL 1.1.0 or newer
|
||||||
|
OPENSSL_MUST_STAPLE_NAME = b"tlsfeature"
|
||||||
|
OPENSSL_MUST_STAPLE_VALUE = b"status_request"
|
||||||
|
else:
|
||||||
|
# OpenSSL 1.0.x or older
|
||||||
|
OPENSSL_MUST_STAPLE_NAME = b"1.3.6.1.5.5.7.1.24"
|
||||||
|
OPENSSL_MUST_STAPLE_VALUE = b"DER:30:03:02:01:05"
|
||||||
|
except ImportError:
|
||||||
|
PYOPENSSL_IMP_ERR = traceback.format_exc()
|
||||||
|
PYOPENSSL_FOUND = False
|
||||||
|
else:
|
||||||
|
PYOPENSSL_FOUND = True
|
||||||
|
|
||||||
|
CRYPTOGRAPHY_IMP_ERR = None
|
||||||
|
try:
|
||||||
|
import cryptography
|
||||||
|
from cryptography import x509
|
||||||
|
from cryptography.hazmat.primitives import serialization
|
||||||
|
CRYPTOGRAPHY_VERSION = LooseVersion(cryptography.__version__)
|
||||||
|
except ImportError:
|
||||||
|
CRYPTOGRAPHY_IMP_ERR = traceback.format_exc()
|
||||||
|
CRYPTOGRAPHY_FOUND = False
|
||||||
|
else:
|
||||||
|
CRYPTOGRAPHY_FOUND = True
|
||||||
|
|
||||||
|
|
||||||
|
TIMESTAMP_FORMAT = "%Y%m%d%H%M%SZ"
|
||||||
|
|
||||||
|
|
||||||
|
class CertificateInfo(crypto_utils.OpenSSLObject):
|
||||||
|
def __init__(self, module, backend):
|
||||||
|
super(CertificateInfo, self).__init__(
|
||||||
|
module.params['path'] or '',
|
||||||
|
'present',
|
||||||
|
False,
|
||||||
|
module.check_mode,
|
||||||
|
)
|
||||||
|
self.backend = backend
|
||||||
|
self.module = module
|
||||||
|
self.content = module.params['content']
|
||||||
|
if self.content is not None:
|
||||||
|
self.content = self.content.encode('utf-8')
|
||||||
|
|
||||||
|
self.valid_at = module.params['valid_at']
|
||||||
|
if self.valid_at:
|
||||||
|
for k, v in self.valid_at.items():
|
||||||
|
if not isinstance(v, string_types):
|
||||||
|
self.module.fail_json(
|
||||||
|
msg='The value for valid_at.{0} must be of type string (got {1})'.format(k, type(v))
|
||||||
|
)
|
||||||
|
self.valid_at[k] = crypto_utils.get_relative_time_option(v, 'valid_at.{0}'.format(k))
|
||||||
|
|
||||||
|
def generate(self):
|
||||||
|
# Empty method because crypto_utils.OpenSSLObject wants this
|
||||||
|
pass
|
||||||
|
|
||||||
|
def dump(self):
|
||||||
|
# Empty method because crypto_utils.OpenSSLObject wants this
|
||||||
|
pass
|
||||||
|
|
||||||
|
@abc.abstractmethod
|
||||||
|
def _get_signature_algorithm(self):
|
||||||
|
pass
|
||||||
|
|
||||||
|
@abc.abstractmethod
|
||||||
|
def _get_subject_ordered(self):
|
||||||
|
pass
|
||||||
|
|
||||||
|
@abc.abstractmethod
|
||||||
|
def _get_issuer_ordered(self):
|
||||||
|
pass
|
||||||
|
|
||||||
|
@abc.abstractmethod
|
||||||
|
def _get_version(self):
|
||||||
|
pass
|
||||||
|
|
||||||
|
@abc.abstractmethod
|
||||||
|
def _get_key_usage(self):
|
||||||
|
pass
|
||||||
|
|
||||||
|
@abc.abstractmethod
|
||||||
|
def _get_extended_key_usage(self):
|
||||||
|
pass
|
||||||
|
|
||||||
|
@abc.abstractmethod
|
||||||
|
def _get_basic_constraints(self):
|
||||||
|
pass
|
||||||
|
|
||||||
|
@abc.abstractmethod
|
||||||
|
def _get_ocsp_must_staple(self):
|
||||||
|
pass
|
||||||
|
|
||||||
|
@abc.abstractmethod
|
||||||
|
def _get_subject_alt_name(self):
|
||||||
|
pass
|
||||||
|
|
||||||
|
@abc.abstractmethod
|
||||||
|
def _get_not_before(self):
|
||||||
|
pass
|
||||||
|
|
||||||
|
@abc.abstractmethod
|
||||||
|
def _get_not_after(self):
|
||||||
|
pass
|
||||||
|
|
||||||
|
@abc.abstractmethod
|
||||||
|
def _get_public_key(self, binary):
|
||||||
|
pass
|
||||||
|
|
||||||
|
@abc.abstractmethod
|
||||||
|
def _get_subject_key_identifier(self):
|
||||||
|
pass
|
||||||
|
|
||||||
|
@abc.abstractmethod
|
||||||
|
def _get_authority_key_identifier(self):
|
||||||
|
pass
|
||||||
|
|
||||||
|
@abc.abstractmethod
|
||||||
|
def _get_serial_number(self):
|
||||||
|
pass
|
||||||
|
|
||||||
|
@abc.abstractmethod
|
||||||
|
def _get_all_extensions(self):
|
||||||
|
pass
|
||||||
|
|
||||||
|
@abc.abstractmethod
|
||||||
|
def _get_ocsp_uri(self):
|
||||||
|
pass
|
||||||
|
|
||||||
|
def get_info(self):
|
||||||
|
result = dict()
|
||||||
|
self.cert = crypto_utils.load_certificate(self.path, content=self.content, backend=self.backend)
|
||||||
|
|
||||||
|
result['signature_algorithm'] = self._get_signature_algorithm()
|
||||||
|
subject = self._get_subject_ordered()
|
||||||
|
issuer = self._get_issuer_ordered()
|
||||||
|
result['subject'] = dict()
|
||||||
|
for k, v in subject:
|
||||||
|
result['subject'][k] = v
|
||||||
|
result['subject_ordered'] = subject
|
||||||
|
result['issuer'] = dict()
|
||||||
|
for k, v in issuer:
|
||||||
|
result['issuer'][k] = v
|
||||||
|
result['issuer_ordered'] = issuer
|
||||||
|
result['version'] = self._get_version()
|
||||||
|
result['key_usage'], result['key_usage_critical'] = self._get_key_usage()
|
||||||
|
result['extended_key_usage'], result['extended_key_usage_critical'] = self._get_extended_key_usage()
|
||||||
|
result['basic_constraints'], result['basic_constraints_critical'] = self._get_basic_constraints()
|
||||||
|
result['ocsp_must_staple'], result['ocsp_must_staple_critical'] = self._get_ocsp_must_staple()
|
||||||
|
result['subject_alt_name'], result['subject_alt_name_critical'] = self._get_subject_alt_name()
|
||||||
|
|
||||||
|
not_before = self._get_not_before()
|
||||||
|
not_after = self._get_not_after()
|
||||||
|
result['not_before'] = not_before.strftime(TIMESTAMP_FORMAT)
|
||||||
|
result['not_after'] = not_after.strftime(TIMESTAMP_FORMAT)
|
||||||
|
result['expired'] = not_after < datetime.datetime.utcnow()
|
||||||
|
|
||||||
|
result['valid_at'] = dict()
|
||||||
|
if self.valid_at:
|
||||||
|
for k, v in self.valid_at.items():
|
||||||
|
result['valid_at'][k] = not_before <= v <= not_after
|
||||||
|
|
||||||
|
result['public_key'] = self._get_public_key(binary=False)
|
||||||
|
pk = self._get_public_key(binary=True)
|
||||||
|
result['public_key_fingerprints'] = crypto_utils.get_fingerprint_of_bytes(pk) if pk is not None else dict()
|
||||||
|
|
||||||
|
if self.backend != 'pyopenssl':
|
||||||
|
ski = self._get_subject_key_identifier()
|
||||||
|
if ski is not None:
|
||||||
|
ski = to_native(binascii.hexlify(ski))
|
||||||
|
ski = ':'.join([ski[i:i + 2] for i in range(0, len(ski), 2)])
|
||||||
|
result['subject_key_identifier'] = ski
|
||||||
|
|
||||||
|
aki, aci, acsn = self._get_authority_key_identifier()
|
||||||
|
if aki is not None:
|
||||||
|
aki = to_native(binascii.hexlify(aki))
|
||||||
|
aki = ':'.join([aki[i:i + 2] for i in range(0, len(aki), 2)])
|
||||||
|
result['authority_key_identifier'] = aki
|
||||||
|
result['authority_cert_issuer'] = aci
|
||||||
|
result['authority_cert_serial_number'] = acsn
|
||||||
|
|
||||||
|
result['serial_number'] = self._get_serial_number()
|
||||||
|
result['extensions_by_oid'] = self._get_all_extensions()
|
||||||
|
result['ocsp_uri'] = self._get_ocsp_uri()
|
||||||
|
|
||||||
|
return result
|
||||||
|
|
||||||
|
|
||||||
|
class CertificateInfoCryptography(CertificateInfo):
|
||||||
|
"""Validate the supplied cert, using the cryptography backend"""
|
||||||
|
def __init__(self, module):
|
||||||
|
super(CertificateInfoCryptography, self).__init__(module, 'cryptography')
|
||||||
|
|
||||||
|
def _get_signature_algorithm(self):
|
||||||
|
return crypto_utils.cryptography_oid_to_name(self.cert.signature_algorithm_oid)
|
||||||
|
|
||||||
|
def _get_subject_ordered(self):
|
||||||
|
result = []
|
||||||
|
for attribute in self.cert.subject:
|
||||||
|
result.append([crypto_utils.cryptography_oid_to_name(attribute.oid), attribute.value])
|
||||||
|
return result
|
||||||
|
|
||||||
|
def _get_issuer_ordered(self):
|
||||||
|
result = []
|
||||||
|
for attribute in self.cert.issuer:
|
||||||
|
result.append([crypto_utils.cryptography_oid_to_name(attribute.oid), attribute.value])
|
||||||
|
return result
|
||||||
|
|
||||||
|
def _get_version(self):
|
||||||
|
if self.cert.version == x509.Version.v1:
|
||||||
|
return 1
|
||||||
|
if self.cert.version == x509.Version.v3:
|
||||||
|
return 3
|
||||||
|
return "unknown"
|
||||||
|
|
||||||
|
def _get_key_usage(self):
|
||||||
|
try:
|
||||||
|
current_key_ext = self.cert.extensions.get_extension_for_class(x509.KeyUsage)
|
||||||
|
current_key_usage = current_key_ext.value
|
||||||
|
key_usage = dict(
|
||||||
|
digital_signature=current_key_usage.digital_signature,
|
||||||
|
content_commitment=current_key_usage.content_commitment,
|
||||||
|
key_encipherment=current_key_usage.key_encipherment,
|
||||||
|
data_encipherment=current_key_usage.data_encipherment,
|
||||||
|
key_agreement=current_key_usage.key_agreement,
|
||||||
|
key_cert_sign=current_key_usage.key_cert_sign,
|
||||||
|
crl_sign=current_key_usage.crl_sign,
|
||||||
|
encipher_only=False,
|
||||||
|
decipher_only=False,
|
||||||
|
)
|
||||||
|
if key_usage['key_agreement']:
|
||||||
|
key_usage.update(dict(
|
||||||
|
encipher_only=current_key_usage.encipher_only,
|
||||||
|
decipher_only=current_key_usage.decipher_only
|
||||||
|
))
|
||||||
|
|
||||||
|
key_usage_names = dict(
|
||||||
|
digital_signature='Digital Signature',
|
||||||
|
content_commitment='Non Repudiation',
|
||||||
|
key_encipherment='Key Encipherment',
|
||||||
|
data_encipherment='Data Encipherment',
|
||||||
|
key_agreement='Key Agreement',
|
||||||
|
key_cert_sign='Certificate Sign',
|
||||||
|
crl_sign='CRL Sign',
|
||||||
|
encipher_only='Encipher Only',
|
||||||
|
decipher_only='Decipher Only',
|
||||||
|
)
|
||||||
|
return sorted([
|
||||||
|
key_usage_names[name] for name, value in key_usage.items() if value
|
||||||
|
]), current_key_ext.critical
|
||||||
|
except cryptography.x509.ExtensionNotFound:
|
||||||
|
return None, False
|
||||||
|
|
||||||
|
def _get_extended_key_usage(self):
|
||||||
|
try:
|
||||||
|
ext_keyusage_ext = self.cert.extensions.get_extension_for_class(x509.ExtendedKeyUsage)
|
||||||
|
return sorted([
|
||||||
|
crypto_utils.cryptography_oid_to_name(eku) for eku in ext_keyusage_ext.value
|
||||||
|
]), ext_keyusage_ext.critical
|
||||||
|
except cryptography.x509.ExtensionNotFound:
|
||||||
|
return None, False
|
||||||
|
|
||||||
|
def _get_basic_constraints(self):
|
||||||
|
try:
|
||||||
|
ext_keyusage_ext = self.cert.extensions.get_extension_for_class(x509.BasicConstraints)
|
||||||
|
result = []
|
||||||
|
result.append('CA:{0}'.format('TRUE' if ext_keyusage_ext.value.ca else 'FALSE'))
|
||||||
|
if ext_keyusage_ext.value.path_length is not None:
|
||||||
|
result.append('pathlen:{0}'.format(ext_keyusage_ext.value.path_length))
|
||||||
|
return sorted(result), ext_keyusage_ext.critical
|
||||||
|
except cryptography.x509.ExtensionNotFound:
|
||||||
|
return None, False
|
||||||
|
|
||||||
|
def _get_ocsp_must_staple(self):
|
||||||
|
try:
|
||||||
|
try:
|
||||||
|
# This only works with cryptography >= 2.1
|
||||||
|
tlsfeature_ext = self.cert.extensions.get_extension_for_class(x509.TLSFeature)
|
||||||
|
value = cryptography.x509.TLSFeatureType.status_request in tlsfeature_ext.value
|
||||||
|
except AttributeError as dummy:
|
||||||
|
# Fallback for cryptography < 2.1
|
||||||
|
oid = x509.oid.ObjectIdentifier("1.3.6.1.5.5.7.1.24")
|
||||||
|
tlsfeature_ext = self.cert.extensions.get_extension_for_oid(oid)
|
||||||
|
value = tlsfeature_ext.value.value == b"\x30\x03\x02\x01\x05"
|
||||||
|
return value, tlsfeature_ext.critical
|
||||||
|
except cryptography.x509.ExtensionNotFound:
|
||||||
|
return None, False
|
||||||
|
|
||||||
|
def _get_subject_alt_name(self):
|
||||||
|
try:
|
||||||
|
san_ext = self.cert.extensions.get_extension_for_class(x509.SubjectAlternativeName)
|
||||||
|
result = [crypto_utils.cryptography_decode_name(san) for san in san_ext.value]
|
||||||
|
return result, san_ext.critical
|
||||||
|
except cryptography.x509.ExtensionNotFound:
|
||||||
|
return None, False
|
||||||
|
|
||||||
|
def _get_not_before(self):
|
||||||
|
return self.cert.not_valid_before
|
||||||
|
|
||||||
|
def _get_not_after(self):
|
||||||
|
return self.cert.not_valid_after
|
||||||
|
|
||||||
|
def _get_public_key(self, binary):
|
||||||
|
return self.cert.public_key().public_bytes(
|
||||||
|
serialization.Encoding.DER if binary else serialization.Encoding.PEM,
|
||||||
|
serialization.PublicFormat.SubjectPublicKeyInfo
|
||||||
|
)
|
||||||
|
|
||||||
|
def _get_subject_key_identifier(self):
|
||||||
|
try:
|
||||||
|
ext = self.cert.extensions.get_extension_for_class(x509.SubjectKeyIdentifier)
|
||||||
|
return ext.value.digest
|
||||||
|
except cryptography.x509.ExtensionNotFound:
|
||||||
|
return None
|
||||||
|
|
||||||
|
def _get_authority_key_identifier(self):
|
||||||
|
try:
|
||||||
|
ext = self.cert.extensions.get_extension_for_class(x509.AuthorityKeyIdentifier)
|
||||||
|
issuer = None
|
||||||
|
if ext.value.authority_cert_issuer is not None:
|
||||||
|
issuer = [crypto_utils.cryptography_decode_name(san) for san in ext.value.authority_cert_issuer]
|
||||||
|
return ext.value.key_identifier, issuer, ext.value.authority_cert_serial_number
|
||||||
|
except cryptography.x509.ExtensionNotFound:
|
||||||
|
return None, None, None
|
||||||
|
|
||||||
|
def _get_serial_number(self):
|
||||||
|
return self.cert.serial_number
|
||||||
|
|
||||||
|
def _get_all_extensions(self):
|
||||||
|
return crypto_utils.cryptography_get_extensions_from_cert(self.cert)
|
||||||
|
|
||||||
|
def _get_ocsp_uri(self):
|
||||||
|
try:
|
||||||
|
ext = self.cert.extensions.get_extension_for_class(x509.AuthorityInformationAccess)
|
||||||
|
for desc in ext.value:
|
||||||
|
if desc.access_method == x509.oid.AuthorityInformationAccessOID.OCSP:
|
||||||
|
if isinstance(desc.access_location, x509.UniformResourceIdentifier):
|
||||||
|
return desc.access_location.value
|
||||||
|
except x509.ExtensionNotFound as dummy:
|
||||||
|
pass
|
||||||
|
return None
|
||||||
|
|
||||||
|
|
||||||
|
class CertificateInfoPyOpenSSL(CertificateInfo):
|
||||||
|
"""validate the supplied certificate."""
|
||||||
|
|
||||||
|
def __init__(self, module):
|
||||||
|
super(CertificateInfoPyOpenSSL, self).__init__(module, 'pyopenssl')
|
||||||
|
|
||||||
|
def _get_signature_algorithm(self):
|
||||||
|
return to_text(self.cert.get_signature_algorithm())
|
||||||
|
|
||||||
|
def __get_name(self, name):
|
||||||
|
result = []
|
||||||
|
for sub in name.get_components():
|
||||||
|
result.append([crypto_utils.pyopenssl_normalize_name(sub[0]), to_text(sub[1])])
|
||||||
|
return result
|
||||||
|
|
||||||
|
def _get_subject_ordered(self):
|
||||||
|
return self.__get_name(self.cert.get_subject())
|
||||||
|
|
||||||
|
def _get_issuer_ordered(self):
|
||||||
|
return self.__get_name(self.cert.get_issuer())
|
||||||
|
|
||||||
|
def _get_version(self):
|
||||||
|
# Version numbers in certs are off by one:
|
||||||
|
# v1: 0, v2: 1, v3: 2 ...
|
||||||
|
return self.cert.get_version() + 1
|
||||||
|
|
||||||
|
def _get_extension(self, short_name):
|
||||||
|
for extension_idx in range(0, self.cert.get_extension_count()):
|
||||||
|
extension = self.cert.get_extension(extension_idx)
|
||||||
|
if extension.get_short_name() == short_name:
|
||||||
|
result = [
|
||||||
|
crypto_utils.pyopenssl_normalize_name(usage.strip()) for usage in to_text(extension, errors='surrogate_or_strict').split(',')
|
||||||
|
]
|
||||||
|
return sorted(result), bool(extension.get_critical())
|
||||||
|
return None, False
|
||||||
|
|
||||||
|
def _get_key_usage(self):
|
||||||
|
return self._get_extension(b'keyUsage')
|
||||||
|
|
||||||
|
def _get_extended_key_usage(self):
|
||||||
|
return self._get_extension(b'extendedKeyUsage')
|
||||||
|
|
||||||
|
def _get_basic_constraints(self):
|
||||||
|
return self._get_extension(b'basicConstraints')
|
||||||
|
|
||||||
|
def _get_ocsp_must_staple(self):
|
||||||
|
extensions = [self.cert.get_extension(i) for i in range(0, self.cert.get_extension_count())]
|
||||||
|
oms_ext = [
|
||||||
|
ext for ext in extensions
|
||||||
|
if to_bytes(ext.get_short_name()) == OPENSSL_MUST_STAPLE_NAME and to_bytes(ext) == OPENSSL_MUST_STAPLE_VALUE
|
||||||
|
]
|
||||||
|
if OpenSSL.SSL.OPENSSL_VERSION_NUMBER < 0x10100000:
|
||||||
|
# Older versions of libssl don't know about OCSP Must Staple
|
||||||
|
oms_ext.extend([ext for ext in extensions if ext.get_short_name() == b'UNDEF' and ext.get_data() == b'\x30\x03\x02\x01\x05'])
|
||||||
|
if oms_ext:
|
||||||
|
return True, bool(oms_ext[0].get_critical())
|
||||||
|
else:
|
||||||
|
return None, False
|
||||||
|
|
||||||
|
def _normalize_san(self, san):
|
||||||
|
if san.startswith('IP Address:'):
|
||||||
|
san = 'IP:' + san[len('IP Address:'):]
|
||||||
|
if san.startswith('IP:'):
|
||||||
|
ip = compat_ipaddress.ip_address(san[3:])
|
||||||
|
san = 'IP:{0}'.format(ip.compressed)
|
||||||
|
return san
|
||||||
|
|
||||||
|
def _get_subject_alt_name(self):
|
||||||
|
for extension_idx in range(0, self.cert.get_extension_count()):
|
||||||
|
extension = self.cert.get_extension(extension_idx)
|
||||||
|
if extension.get_short_name() == b'subjectAltName':
|
||||||
|
result = [self._normalize_san(altname.strip()) for altname in
|
||||||
|
to_text(extension, errors='surrogate_or_strict').split(', ')]
|
||||||
|
return result, bool(extension.get_critical())
|
||||||
|
return None, False
|
||||||
|
|
||||||
|
def _get_not_before(self):
|
||||||
|
time_string = to_native(self.cert.get_notBefore())
|
||||||
|
return datetime.datetime.strptime(time_string, "%Y%m%d%H%M%SZ")
|
||||||
|
|
||||||
|
def _get_not_after(self):
|
||||||
|
time_string = to_native(self.cert.get_notAfter())
|
||||||
|
return datetime.datetime.strptime(time_string, "%Y%m%d%H%M%SZ")
|
||||||
|
|
||||||
|
def _get_public_key(self, binary):
|
||||||
|
try:
|
||||||
|
return crypto.dump_publickey(
|
||||||
|
crypto.FILETYPE_ASN1 if binary else crypto.FILETYPE_PEM,
|
||||||
|
self.cert.get_pubkey()
|
||||||
|
)
|
||||||
|
except AttributeError:
|
||||||
|
try:
|
||||||
|
# pyOpenSSL < 16.0:
|
||||||
|
bio = crypto._new_mem_buf()
|
||||||
|
if binary:
|
||||||
|
rc = crypto._lib.i2d_PUBKEY_bio(bio, self.cert.get_pubkey()._pkey)
|
||||||
|
else:
|
||||||
|
rc = crypto._lib.PEM_write_bio_PUBKEY(bio, self.cert.get_pubkey()._pkey)
|
||||||
|
if rc != 1:
|
||||||
|
crypto._raise_current_error()
|
||||||
|
return crypto._bio_to_string(bio)
|
||||||
|
except AttributeError:
|
||||||
|
self.module.warn('Your pyOpenSSL version does not support dumping public keys. '
|
||||||
|
'Please upgrade to version 16.0 or newer, or use the cryptography backend.')
|
||||||
|
|
||||||
|
def _get_subject_key_identifier(self):
|
||||||
|
# Won't be implemented
|
||||||
|
return None
|
||||||
|
|
||||||
|
def _get_authority_key_identifier(self):
|
||||||
|
# Won't be implemented
|
||||||
|
return None, None, None
|
||||||
|
|
||||||
|
def _get_serial_number(self):
|
||||||
|
return self.cert.get_serial_number()
|
||||||
|
|
||||||
|
def _get_all_extensions(self):
|
||||||
|
return crypto_utils.pyopenssl_get_extensions_from_cert(self.cert)
|
||||||
|
|
||||||
|
def _get_ocsp_uri(self):
|
||||||
|
for i in range(self.cert.get_extension_count()):
|
||||||
|
ext = self.cert.get_extension(i)
|
||||||
|
if ext.get_short_name() == b'authorityInfoAccess':
|
||||||
|
v = str(ext)
|
||||||
|
m = re.search('^OCSP - URI:(.*)$', v, flags=re.MULTILINE)
|
||||||
|
if m:
|
||||||
|
return m.group(1)
|
||||||
|
return None
|
||||||
|
|
||||||
|
|
||||||
|
def main():
|
||||||
|
module = AnsibleModule(
|
||||||
|
argument_spec=dict(
|
||||||
|
path=dict(type='path'),
|
||||||
|
content=dict(type='str'),
|
||||||
|
valid_at=dict(type='dict'),
|
||||||
|
select_crypto_backend=dict(type='str', default='auto', choices=['auto', 'cryptography', 'pyopenssl']),
|
||||||
|
),
|
||||||
|
required_one_of=(
|
||||||
|
['path', 'content'],
|
||||||
|
),
|
||||||
|
mutually_exclusive=(
|
||||||
|
['path', 'content'],
|
||||||
|
),
|
||||||
|
supports_check_mode=True,
|
||||||
|
)
|
||||||
|
if module._name == 'community.crypto.openssl_certificate_info':
|
||||||
|
module.deprecate("The 'community.crypto.openssl_certificate_info' module has been renamed to 'community.crypto.x509_certificate_info'", version='2.14')
|
||||||
|
|
||||||
|
try:
|
||||||
|
if module.params['path'] is not None:
|
||||||
|
base_dir = os.path.dirname(module.params['path']) or '.'
|
||||||
|
if not os.path.isdir(base_dir):
|
||||||
|
module.fail_json(
|
||||||
|
name=base_dir,
|
||||||
|
msg='The directory %s does not exist or the file is not a directory' % base_dir
|
||||||
|
)
|
||||||
|
|
||||||
|
backend = module.params['select_crypto_backend']
|
||||||
|
if backend == 'auto':
|
||||||
|
# Detect what backend we can use
|
||||||
|
can_use_cryptography = CRYPTOGRAPHY_FOUND and CRYPTOGRAPHY_VERSION >= LooseVersion(MINIMAL_CRYPTOGRAPHY_VERSION)
|
||||||
|
can_use_pyopenssl = PYOPENSSL_FOUND and PYOPENSSL_VERSION >= LooseVersion(MINIMAL_PYOPENSSL_VERSION)
|
||||||
|
|
||||||
|
# If cryptography is available we'll use it
|
||||||
|
if can_use_cryptography:
|
||||||
|
backend = 'cryptography'
|
||||||
|
elif can_use_pyopenssl:
|
||||||
|
backend = 'pyopenssl'
|
||||||
|
|
||||||
|
# Fail if no backend has been found
|
||||||
|
if backend == 'auto':
|
||||||
|
module.fail_json(msg=("Can't detect any of the required Python libraries "
|
||||||
|
"cryptography (>= {0}) or PyOpenSSL (>= {1})").format(
|
||||||
|
MINIMAL_CRYPTOGRAPHY_VERSION,
|
||||||
|
MINIMAL_PYOPENSSL_VERSION))
|
||||||
|
|
||||||
|
if backend == 'pyopenssl':
|
||||||
|
if not PYOPENSSL_FOUND:
|
||||||
|
module.fail_json(msg=missing_required_lib('pyOpenSSL >= {0}'.format(MINIMAL_PYOPENSSL_VERSION)),
|
||||||
|
exception=PYOPENSSL_IMP_ERR)
|
||||||
|
try:
|
||||||
|
getattr(crypto.X509Req, 'get_extensions')
|
||||||
|
except AttributeError:
|
||||||
|
module.fail_json(msg='You need to have PyOpenSSL>=0.15')
|
||||||
|
|
||||||
|
module.deprecate('The module is using the PyOpenSSL backend. This backend has been deprecated', version='2.13')
|
||||||
|
certificate = CertificateInfoPyOpenSSL(module)
|
||||||
|
elif backend == 'cryptography':
|
||||||
|
if not CRYPTOGRAPHY_FOUND:
|
||||||
|
module.fail_json(msg=missing_required_lib('cryptography >= {0}'.format(MINIMAL_CRYPTOGRAPHY_VERSION)),
|
||||||
|
exception=CRYPTOGRAPHY_IMP_ERR)
|
||||||
|
certificate = CertificateInfoCryptography(module)
|
||||||
|
|
||||||
|
result = certificate.get_info()
|
||||||
|
module.exit_json(**result)
|
||||||
|
except crypto_utils.OpenSSLObjectError as exc:
|
||||||
|
module.fail_json(msg=to_native(exc))
|
||||||
|
|
||||||
|
|
||||||
|
if __name__ == "__main__":
|
||||||
|
main()
|
||||||
|
|
@ -372,35 +372,35 @@
|
||||||
register: cert_8_text
|
register: cert_8_text
|
||||||
# Dump certificate info
|
# Dump certificate info
|
||||||
- name: Dumping cert 1
|
- name: Dumping cert 1
|
||||||
openssl_certificate_info:
|
x509_certificate_info:
|
||||||
path: "{{ output_dir }}/cert-1.pem"
|
path: "{{ output_dir }}/cert-1.pem"
|
||||||
register: cert_1_info
|
register: cert_1_info
|
||||||
- name: Dumping cert 2
|
- name: Dumping cert 2
|
||||||
openssl_certificate_info:
|
x509_certificate_info:
|
||||||
path: "{{ output_dir }}/cert-2.pem"
|
path: "{{ output_dir }}/cert-2.pem"
|
||||||
register: cert_2_info
|
register: cert_2_info
|
||||||
- name: Dumping cert 3
|
- name: Dumping cert 3
|
||||||
openssl_certificate_info:
|
x509_certificate_info:
|
||||||
path: "{{ output_dir }}/cert-3.pem"
|
path: "{{ output_dir }}/cert-3.pem"
|
||||||
register: cert_3_info
|
register: cert_3_info
|
||||||
- name: Dumping cert 4
|
- name: Dumping cert 4
|
||||||
openssl_certificate_info:
|
x509_certificate_info:
|
||||||
path: "{{ output_dir }}/cert-4.pem"
|
path: "{{ output_dir }}/cert-4.pem"
|
||||||
register: cert_4_info
|
register: cert_4_info
|
||||||
- name: Dumping cert 5
|
- name: Dumping cert 5
|
||||||
openssl_certificate_info:
|
x509_certificate_info:
|
||||||
path: "{{ output_dir }}/cert-5.pem"
|
path: "{{ output_dir }}/cert-5.pem"
|
||||||
register: cert_5_info
|
register: cert_5_info
|
||||||
- name: Dumping cert 6
|
- name: Dumping cert 6
|
||||||
openssl_certificate_info:
|
x509_certificate_info:
|
||||||
path: "{{ output_dir }}/cert-6.pem"
|
path: "{{ output_dir }}/cert-6.pem"
|
||||||
register: cert_6_info
|
register: cert_6_info
|
||||||
- name: Dumping cert 7
|
- name: Dumping cert 7
|
||||||
openssl_certificate_info:
|
x509_certificate_info:
|
||||||
path: "{{ output_dir }}/cert-7.pem"
|
path: "{{ output_dir }}/cert-7.pem"
|
||||||
register: cert_7_info
|
register: cert_7_info
|
||||||
- name: Dumping cert 8
|
- name: Dumping cert 8
|
||||||
openssl_certificate_info:
|
x509_certificate_info:
|
||||||
path: "{{ output_dir }}/cert-8.pem"
|
path: "{{ output_dir }}/cert-8.pem"
|
||||||
register: cert_8_info
|
register: cert_8_info
|
||||||
## GET ACCOUNT ORDERS #########################################################################
|
## GET ACCOUNT ORDERS #########################################################################
|
||||||
|
|
|
||||||
|
|
@ -7,13 +7,13 @@
|
||||||
loop: "{{ query('nested', types, root_numbers) }}"
|
loop: "{{ query('nested', types, root_numbers) }}"
|
||||||
|
|
||||||
- name: Analyze root certificates
|
- name: Analyze root certificates
|
||||||
openssl_certificate_info:
|
x509_certificate_info:
|
||||||
path: "{{ output_dir }}/acme-root-{{ item }}.pem"
|
path: "{{ output_dir }}/acme-root-{{ item }}.pem"
|
||||||
loop: "{{ root_numbers }}"
|
loop: "{{ root_numbers }}"
|
||||||
register: acme_roots
|
register: acme_roots
|
||||||
|
|
||||||
- name: Analyze intermediate certificates
|
- name: Analyze intermediate certificates
|
||||||
openssl_certificate_info:
|
x509_certificate_info:
|
||||||
path: "{{ output_dir }}/acme-intermediate-{{ item }}.pem"
|
path: "{{ output_dir }}/acme-intermediate-{{ item }}.pem"
|
||||||
loop: "{{ root_numbers }}"
|
loop: "{{ root_numbers }}"
|
||||||
register: acme_intermediates
|
register: acme_intermediates
|
||||||
|
|
|
||||||
|
|
@ -24,7 +24,7 @@
|
||||||
privatekey_path: '{{ output_dir }}/ansible_pkey3.pem'
|
privatekey_path: '{{ output_dir }}/ansible_pkey3.pem'
|
||||||
commonName: www3.ansible.com
|
commonName: www3.ansible.com
|
||||||
- name: Generate certificate
|
- name: Generate certificate
|
||||||
openssl_certificate:
|
x509_certificate:
|
||||||
path: '{{ output_dir }}/{{ item.name }}.crt'
|
path: '{{ output_dir }}/{{ item.name }}.crt'
|
||||||
privatekey_path: '{{ output_dir }}/{{ item.pkey }}'
|
privatekey_path: '{{ output_dir }}/{{ item.pkey }}'
|
||||||
csr_path: '{{ output_dir }}/{{ item.name }}.csr'
|
csr_path: '{{ output_dir }}/{{ item.name }}.csr'
|
||||||
|
|
|
||||||
|
|
@ -31,7 +31,7 @@
|
||||||
useCommonNameForSAN: no
|
useCommonNameForSAN: no
|
||||||
|
|
||||||
- name: (Assertonly, {{select_crypto_backend}}) - Generate selfsigned certificate (no extensions)
|
- name: (Assertonly, {{select_crypto_backend}}) - Generate selfsigned certificate (no extensions)
|
||||||
openssl_certificate:
|
x509_certificate:
|
||||||
path: '{{ output_dir }}/cert_noext.pem'
|
path: '{{ output_dir }}/cert_noext.pem'
|
||||||
csr_path: '{{ output_dir }}/csr_noext.csr'
|
csr_path: '{{ output_dir }}/csr_noext.csr'
|
||||||
privatekey_path: '{{ output_dir }}/privatekey.pem'
|
privatekey_path: '{{ output_dir }}/privatekey.pem'
|
||||||
|
|
@ -40,7 +40,7 @@
|
||||||
select_crypto_backend: '{{ select_crypto_backend }}'
|
select_crypto_backend: '{{ select_crypto_backend }}'
|
||||||
|
|
||||||
- name: (Assertonly, {{select_crypto_backend}}) - Generate selfsigned certificate (with SANs)
|
- name: (Assertonly, {{select_crypto_backend}}) - Generate selfsigned certificate (with SANs)
|
||||||
openssl_certificate:
|
x509_certificate:
|
||||||
path: '{{ output_dir }}/cert_sans.pem'
|
path: '{{ output_dir }}/cert_sans.pem'
|
||||||
csr_path: '{{ output_dir }}/csr_sans.csr'
|
csr_path: '{{ output_dir }}/csr_sans.csr'
|
||||||
privatekey_path: '{{ output_dir }}/privatekey.pem'
|
privatekey_path: '{{ output_dir }}/privatekey.pem'
|
||||||
|
|
@ -49,7 +49,7 @@
|
||||||
select_crypto_backend: '{{ select_crypto_backend }}'
|
select_crypto_backend: '{{ select_crypto_backend }}'
|
||||||
|
|
||||||
- name: (Assertonly, {{select_crypto_backend}}) - Assert that subject_alt_name is there (should fail)
|
- name: (Assertonly, {{select_crypto_backend}}) - Assert that subject_alt_name is there (should fail)
|
||||||
openssl_certificate:
|
x509_certificate:
|
||||||
path: '{{ output_dir }}/cert_noext.pem'
|
path: '{{ output_dir }}/cert_noext.pem'
|
||||||
provider: assertonly
|
provider: assertonly
|
||||||
subject_alt_name:
|
subject_alt_name:
|
||||||
|
|
@ -59,7 +59,7 @@
|
||||||
register: extension_missing_san
|
register: extension_missing_san
|
||||||
|
|
||||||
- name: (Assertonly, {{select_crypto_backend}}) - Assert that subject_alt_name is there
|
- name: (Assertonly, {{select_crypto_backend}}) - Assert that subject_alt_name is there
|
||||||
openssl_certificate:
|
x509_certificate:
|
||||||
path: '{{ output_dir }}/cert_sans.pem'
|
path: '{{ output_dir }}/cert_sans.pem'
|
||||||
provider: assertonly
|
provider: assertonly
|
||||||
subject_alt_name:
|
subject_alt_name:
|
||||||
|
|
@ -70,7 +70,7 @@
|
||||||
register: extension_san
|
register: extension_san
|
||||||
|
|
||||||
- name: (Assertonly, {{select_crypto_backend}}) - Assert that subject_alt_name is there (strict)
|
- name: (Assertonly, {{select_crypto_backend}}) - Assert that subject_alt_name is there (strict)
|
||||||
openssl_certificate:
|
x509_certificate:
|
||||||
path: '{{ output_dir }}/cert_sans.pem'
|
path: '{{ output_dir }}/cert_sans.pem'
|
||||||
provider: assertonly
|
provider: assertonly
|
||||||
subject_alt_name:
|
subject_alt_name:
|
||||||
|
|
@ -82,7 +82,7 @@
|
||||||
register: extension_san_strict
|
register: extension_san_strict
|
||||||
|
|
||||||
- name: (Assertonly, {{select_crypto_backend}}) - Assert that key_usage is there (should fail)
|
- name: (Assertonly, {{select_crypto_backend}}) - Assert that key_usage is there (should fail)
|
||||||
openssl_certificate:
|
x509_certificate:
|
||||||
path: '{{ output_dir }}/cert_noext.pem'
|
path: '{{ output_dir }}/cert_noext.pem'
|
||||||
provider: assertonly
|
provider: assertonly
|
||||||
key_usage:
|
key_usage:
|
||||||
|
|
@ -92,7 +92,7 @@
|
||||||
register: extension_missing_ku
|
register: extension_missing_ku
|
||||||
|
|
||||||
- name: (Assertonly, {{select_crypto_backend}}) - Assert that extended_key_usage is there (should fail)
|
- name: (Assertonly, {{select_crypto_backend}}) - Assert that extended_key_usage is there (should fail)
|
||||||
openssl_certificate:
|
x509_certificate:
|
||||||
path: '{{ output_dir }}/cert_noext.pem'
|
path: '{{ output_dir }}/cert_noext.pem'
|
||||||
provider: assertonly
|
provider: assertonly
|
||||||
extended_key_usage:
|
extended_key_usage:
|
||||||
|
|
@ -113,7 +113,7 @@
|
||||||
- "'Found no extendedKeyUsage extension' in extension_missing_eku.msg"
|
- "'Found no extendedKeyUsage extension' in extension_missing_eku.msg"
|
||||||
|
|
||||||
- name: (Assertonly, {{select_crypto_backend}}) - Check private key passphrase fail 1
|
- name: (Assertonly, {{select_crypto_backend}}) - Check private key passphrase fail 1
|
||||||
openssl_certificate:
|
x509_certificate:
|
||||||
path: '{{ output_dir }}/cert_noext.pem'
|
path: '{{ output_dir }}/cert_noext.pem'
|
||||||
privatekey_path: '{{ output_dir }}/privatekey.pem'
|
privatekey_path: '{{ output_dir }}/privatekey.pem'
|
||||||
privatekey_passphrase: hunter2
|
privatekey_passphrase: hunter2
|
||||||
|
|
@ -123,7 +123,7 @@
|
||||||
register: passphrase_error_1
|
register: passphrase_error_1
|
||||||
|
|
||||||
- name: (Assertonly, {{select_crypto_backend}}) - Check private key passphrase fail 2
|
- name: (Assertonly, {{select_crypto_backend}}) - Check private key passphrase fail 2
|
||||||
openssl_certificate:
|
x509_certificate:
|
||||||
path: '{{ output_dir }}/cert_noext.pem'
|
path: '{{ output_dir }}/cert_noext.pem'
|
||||||
privatekey_path: '{{ output_dir }}/privatekeypw.pem'
|
privatekey_path: '{{ output_dir }}/privatekeypw.pem'
|
||||||
privatekey_passphrase: wrong_password
|
privatekey_passphrase: wrong_password
|
||||||
|
|
@ -133,7 +133,7 @@
|
||||||
register: passphrase_error_2
|
register: passphrase_error_2
|
||||||
|
|
||||||
- name: (Assertonly, {{select_crypto_backend}}) - Check private key passphrase fail 3
|
- name: (Assertonly, {{select_crypto_backend}}) - Check private key passphrase fail 3
|
||||||
openssl_certificate:
|
x509_certificate:
|
||||||
path: '{{ output_dir }}/cert_noext.pem'
|
path: '{{ output_dir }}/cert_noext.pem'
|
||||||
privatekey_path: '{{ output_dir }}/privatekeypw.pem'
|
privatekey_path: '{{ output_dir }}/privatekeypw.pem'
|
||||||
provider: assertonly
|
provider: assertonly
|
||||||
|
|
@ -11,7 +11,7 @@
|
||||||
commonName: www.example.com
|
commonName: www.example.com
|
||||||
|
|
||||||
- name: (Expired, {{select_crypto_backend}}) Generate expired selfsigned certificate
|
- name: (Expired, {{select_crypto_backend}}) Generate expired selfsigned certificate
|
||||||
openssl_certificate:
|
x509_certificate:
|
||||||
path: '{{ output_dir }}/has_expired_cert.pem'
|
path: '{{ output_dir }}/has_expired_cert.pem'
|
||||||
csr_path: '{{ output_dir }}/has_expired_csr.csr'
|
csr_path: '{{ output_dir }}/has_expired_csr.csr'
|
||||||
privatekey_path: '{{ output_dir }}/has_expired_privatekey.pem'
|
privatekey_path: '{{ output_dir }}/has_expired_privatekey.pem'
|
||||||
|
|
@ -27,7 +27,7 @@
|
||||||
when: select_crypto_backend == 'cryptography' # So we create it with 'command'
|
when: select_crypto_backend == 'cryptography' # So we create it with 'command'
|
||||||
|
|
||||||
- name: "(Expired) Check task fails because cert is expired (has_expired: false)"
|
- name: "(Expired) Check task fails because cert is expired (has_expired: false)"
|
||||||
openssl_certificate:
|
x509_certificate:
|
||||||
provider: assertonly
|
provider: assertonly
|
||||||
path: "{{ output_dir }}/has_expired_cert.pem"
|
path: "{{ output_dir }}/has_expired_cert.pem"
|
||||||
has_expired: false
|
has_expired: false
|
||||||
|
|
@ -40,7 +40,7 @@
|
||||||
that: expired_cert_check is failed
|
that: expired_cert_check is failed
|
||||||
|
|
||||||
- name: "(Expired) Check expired cert check is ignored (has_expired: true)"
|
- name: "(Expired) Check expired cert check is ignored (has_expired: true)"
|
||||||
openssl_certificate:
|
x509_certificate:
|
||||||
provider: assertonly
|
provider: assertonly
|
||||||
path: "{{ output_dir }}/has_expired_cert.pem"
|
path: "{{ output_dir }}/has_expired_cert.pem"
|
||||||
has_expired: true
|
has_expired: true
|
||||||
|
|
@ -34,7 +34,7 @@
|
||||||
basic_constraints_critical: yes
|
basic_constraints_critical: yes
|
||||||
|
|
||||||
- name: (OwnCA, {{select_crypto_backend}}) Generate selfsigned CA certificate
|
- name: (OwnCA, {{select_crypto_backend}}) Generate selfsigned CA certificate
|
||||||
openssl_certificate:
|
x509_certificate:
|
||||||
path: '{{ output_dir }}/ca_cert.pem'
|
path: '{{ output_dir }}/ca_cert.pem'
|
||||||
csr_path: '{{ output_dir }}/ca_csr.csr'
|
csr_path: '{{ output_dir }}/ca_csr.csr'
|
||||||
privatekey_path: '{{ output_dir }}/ca_privatekey.pem'
|
privatekey_path: '{{ output_dir }}/ca_privatekey.pem'
|
||||||
|
|
@ -43,7 +43,7 @@
|
||||||
select_crypto_backend: '{{ select_crypto_backend }}'
|
select_crypto_backend: '{{ select_crypto_backend }}'
|
||||||
|
|
||||||
- name: (OwnCA, {{select_crypto_backend}}) Generate selfsigned CA certificate (privatekey passphrase)
|
- name: (OwnCA, {{select_crypto_backend}}) Generate selfsigned CA certificate (privatekey passphrase)
|
||||||
openssl_certificate:
|
x509_certificate:
|
||||||
path: '{{ output_dir }}/ca_cert_pw.pem'
|
path: '{{ output_dir }}/ca_cert_pw.pem'
|
||||||
csr_path: '{{ output_dir }}/ca_csr_pw.csr'
|
csr_path: '{{ output_dir }}/ca_csr_pw.csr'
|
||||||
privatekey_path: '{{ output_dir }}/ca_privatekey_pw.pem'
|
privatekey_path: '{{ output_dir }}/ca_privatekey_pw.pem'
|
||||||
|
|
@ -53,7 +53,7 @@
|
||||||
select_crypto_backend: '{{ select_crypto_backend }}'
|
select_crypto_backend: '{{ select_crypto_backend }}'
|
||||||
|
|
||||||
- name: (OwnCA, {{select_crypto_backend}}) Generate ownca certificate
|
- name: (OwnCA, {{select_crypto_backend}}) Generate ownca certificate
|
||||||
openssl_certificate:
|
x509_certificate:
|
||||||
path: '{{ output_dir }}/ownca_cert.pem'
|
path: '{{ output_dir }}/ownca_cert.pem'
|
||||||
csr_path: '{{ output_dir }}/csr.csr'
|
csr_path: '{{ output_dir }}/csr.csr'
|
||||||
privatekey_path: '{{ output_dir }}/privatekey.pem'
|
privatekey_path: '{{ output_dir }}/privatekey.pem'
|
||||||
|
|
@ -66,7 +66,7 @@
|
||||||
register: ownca_certificate
|
register: ownca_certificate
|
||||||
|
|
||||||
- name: (OwnCA, {{select_crypto_backend}}) Generate ownca certificate (idempotent)
|
- name: (OwnCA, {{select_crypto_backend}}) Generate ownca certificate (idempotent)
|
||||||
openssl_certificate:
|
x509_certificate:
|
||||||
path: '{{ output_dir }}/ownca_cert.pem'
|
path: '{{ output_dir }}/ownca_cert.pem'
|
||||||
csr_path: '{{ output_dir }}/csr.csr'
|
csr_path: '{{ output_dir }}/csr.csr'
|
||||||
privatekey_path: '{{ output_dir }}/privatekey.pem'
|
privatekey_path: '{{ output_dir }}/privatekey.pem'
|
||||||
|
|
@ -79,7 +79,7 @@
|
||||||
register: ownca_certificate_idempotence
|
register: ownca_certificate_idempotence
|
||||||
|
|
||||||
- name: (OwnCA, {{select_crypto_backend}}) Generate ownca certificate (check mode)
|
- name: (OwnCA, {{select_crypto_backend}}) Generate ownca certificate (check mode)
|
||||||
openssl_certificate:
|
x509_certificate:
|
||||||
path: '{{ output_dir }}/ownca_cert.pem'
|
path: '{{ output_dir }}/ownca_cert.pem'
|
||||||
csr_path: '{{ output_dir }}/csr.csr'
|
csr_path: '{{ output_dir }}/csr.csr'
|
||||||
privatekey_path: '{{ output_dir }}/privatekey.pem'
|
privatekey_path: '{{ output_dir }}/privatekey.pem'
|
||||||
|
|
@ -91,7 +91,7 @@
|
||||||
check_mode: yes
|
check_mode: yes
|
||||||
|
|
||||||
- name: (OwnCA, {{select_crypto_backend}}) Check ownca certificate
|
- name: (OwnCA, {{select_crypto_backend}}) Check ownca certificate
|
||||||
openssl_certificate:
|
x509_certificate:
|
||||||
path: '{{ output_dir }}/ownca_cert.pem'
|
path: '{{ output_dir }}/ownca_cert.pem'
|
||||||
privatekey_path: '{{ output_dir }}/privatekey.pem'
|
privatekey_path: '{{ output_dir }}/privatekey.pem'
|
||||||
provider: assertonly
|
provider: assertonly
|
||||||
|
|
@ -107,7 +107,7 @@
|
||||||
select_crypto_backend: '{{ select_crypto_backend }}'
|
select_crypto_backend: '{{ select_crypto_backend }}'
|
||||||
|
|
||||||
- name: (OwnCA, {{select_crypto_backend}}) Generate ownca v2 certificate
|
- name: (OwnCA, {{select_crypto_backend}}) Generate ownca v2 certificate
|
||||||
openssl_certificate:
|
x509_certificate:
|
||||||
path: '{{ output_dir }}/ownca_cert_v2.pem'
|
path: '{{ output_dir }}/ownca_cert_v2.pem'
|
||||||
csr_path: '{{ output_dir }}/csr.csr'
|
csr_path: '{{ output_dir }}/csr.csr'
|
||||||
privatekey_path: '{{ output_dir }}/privatekey.pem'
|
privatekey_path: '{{ output_dir }}/privatekey.pem'
|
||||||
|
|
@ -121,7 +121,7 @@
|
||||||
ignore_errors: true
|
ignore_errors: true
|
||||||
|
|
||||||
- name: (OwnCA, {{select_crypto_backend}}) Generate ownca certificate2
|
- name: (OwnCA, {{select_crypto_backend}}) Generate ownca certificate2
|
||||||
openssl_certificate:
|
x509_certificate:
|
||||||
path: '{{ output_dir }}/ownca_cert2.pem'
|
path: '{{ output_dir }}/ownca_cert2.pem'
|
||||||
csr_path: '{{ output_dir }}/csr2.csr'
|
csr_path: '{{ output_dir }}/csr2.csr'
|
||||||
privatekey_path: '{{ output_dir }}/privatekey2.pem'
|
privatekey_path: '{{ output_dir }}/privatekey2.pem'
|
||||||
|
|
@ -132,7 +132,7 @@
|
||||||
select_crypto_backend: '{{ select_crypto_backend }}'
|
select_crypto_backend: '{{ select_crypto_backend }}'
|
||||||
|
|
||||||
- name: (OwnCA, {{select_crypto_backend}}) Check ownca certificate2
|
- name: (OwnCA, {{select_crypto_backend}}) Check ownca certificate2
|
||||||
openssl_certificate:
|
x509_certificate:
|
||||||
path: '{{ output_dir }}/ownca_cert2.pem'
|
path: '{{ output_dir }}/ownca_cert2.pem'
|
||||||
privatekey_path: '{{ output_dir }}/privatekey2.pem'
|
privatekey_path: '{{ output_dir }}/privatekey2.pem'
|
||||||
provider: assertonly
|
provider: assertonly
|
||||||
|
|
@ -160,7 +160,7 @@
|
||||||
select_crypto_backend: '{{ select_crypto_backend }}'
|
select_crypto_backend: '{{ select_crypto_backend }}'
|
||||||
|
|
||||||
- name: (OwnCA, {{select_crypto_backend}}) Create ownca certificate with notBefore and notAfter
|
- name: (OwnCA, {{select_crypto_backend}}) Create ownca certificate with notBefore and notAfter
|
||||||
openssl_certificate:
|
x509_certificate:
|
||||||
provider: ownca
|
provider: ownca
|
||||||
ownca_not_before: 20181023133742Z
|
ownca_not_before: 20181023133742Z
|
||||||
ownca_not_after: 20191023133742Z
|
ownca_not_after: 20191023133742Z
|
||||||
|
|
@ -172,7 +172,7 @@
|
||||||
select_crypto_backend: '{{ select_crypto_backend }}'
|
select_crypto_backend: '{{ select_crypto_backend }}'
|
||||||
|
|
||||||
- name: (OwnCA, {{select_crypto_backend}}) Create ownca certificate with relative notBefore and notAfter
|
- name: (OwnCA, {{select_crypto_backend}}) Create ownca certificate with relative notBefore and notAfter
|
||||||
openssl_certificate:
|
x509_certificate:
|
||||||
provider: ownca
|
provider: ownca
|
||||||
ownca_not_before: +1s
|
ownca_not_before: +1s
|
||||||
ownca_not_after: +52w
|
ownca_not_after: +52w
|
||||||
|
|
@ -184,7 +184,7 @@
|
||||||
select_crypto_backend: '{{ select_crypto_backend }}'
|
select_crypto_backend: '{{ select_crypto_backend }}'
|
||||||
|
|
||||||
- name: (OwnCA, {{select_crypto_backend}}) Generate ownca ECC certificate
|
- name: (OwnCA, {{select_crypto_backend}}) Generate ownca ECC certificate
|
||||||
openssl_certificate:
|
x509_certificate:
|
||||||
path: '{{ output_dir }}/ownca_cert_ecc.pem'
|
path: '{{ output_dir }}/ownca_cert_ecc.pem'
|
||||||
csr_path: '{{ output_dir }}/csr_ecc.csr'
|
csr_path: '{{ output_dir }}/csr_ecc.csr'
|
||||||
privatekey_path: '{{ output_dir }}/privatekey_ecc.pem'
|
privatekey_path: '{{ output_dir }}/privatekey_ecc.pem'
|
||||||
|
|
@ -196,7 +196,7 @@
|
||||||
register: ownca_certificate_ecc
|
register: ownca_certificate_ecc
|
||||||
|
|
||||||
- name: (OwnCA, {{select_crypto_backend}}) Generate selfsigned certificate (privatekey passphrase)
|
- name: (OwnCA, {{select_crypto_backend}}) Generate selfsigned certificate (privatekey passphrase)
|
||||||
openssl_certificate:
|
x509_certificate:
|
||||||
path: '{{ output_dir }}/ownca_cert_ecc_2.pem'
|
path: '{{ output_dir }}/ownca_cert_ecc_2.pem'
|
||||||
csr_path: '{{ output_dir }}/csr_ecc.csr'
|
csr_path: '{{ output_dir }}/csr_ecc.csr'
|
||||||
ownca_path: '{{ output_dir }}/ca_cert_pw.pem'
|
ownca_path: '{{ output_dir }}/ca_cert_pw.pem'
|
||||||
|
|
@ -208,7 +208,7 @@
|
||||||
register: selfsigned_certificate_passphrase
|
register: selfsigned_certificate_passphrase
|
||||||
|
|
||||||
- name: (OwnCA, {{select_crypto_backend}}) Generate ownca certificate (failed passphrase 1)
|
- name: (OwnCA, {{select_crypto_backend}}) Generate ownca certificate (failed passphrase 1)
|
||||||
openssl_certificate:
|
x509_certificate:
|
||||||
path: '{{ output_dir }}/ownca_cert_pw1.pem'
|
path: '{{ output_dir }}/ownca_cert_pw1.pem'
|
||||||
csr_path: '{{ output_dir }}/csr_ecc.csr'
|
csr_path: '{{ output_dir }}/csr_ecc.csr'
|
||||||
ownca_path: '{{ output_dir }}/ca_cert.pem'
|
ownca_path: '{{ output_dir }}/ca_cert.pem'
|
||||||
|
|
@ -221,7 +221,7 @@
|
||||||
register: passphrase_error_1
|
register: passphrase_error_1
|
||||||
|
|
||||||
- name: (OwnCA, {{select_crypto_backend}}) Generate ownca certificate (failed passphrase 2)
|
- name: (OwnCA, {{select_crypto_backend}}) Generate ownca certificate (failed passphrase 2)
|
||||||
openssl_certificate:
|
x509_certificate:
|
||||||
path: '{{ output_dir }}/ownca_cert_pw2.pem'
|
path: '{{ output_dir }}/ownca_cert_pw2.pem'
|
||||||
csr_path: '{{ output_dir }}/csr_ecc.csr'
|
csr_path: '{{ output_dir }}/csr_ecc.csr'
|
||||||
ownca_path: '{{ output_dir }}/ca_cert.pem'
|
ownca_path: '{{ output_dir }}/ca_cert.pem'
|
||||||
|
|
@ -234,7 +234,7 @@
|
||||||
register: passphrase_error_2
|
register: passphrase_error_2
|
||||||
|
|
||||||
- name: (OwnCA, {{select_crypto_backend}}) Generate ownca certificate (failed passphrase 3)
|
- name: (OwnCA, {{select_crypto_backend}}) Generate ownca certificate (failed passphrase 3)
|
||||||
openssl_certificate:
|
x509_certificate:
|
||||||
path: '{{ output_dir }}/ownca_cert_pw3.pem'
|
path: '{{ output_dir }}/ownca_cert_pw3.pem'
|
||||||
csr_path: '{{ output_dir }}/csr_ecc.csr'
|
csr_path: '{{ output_dir }}/csr_ecc.csr'
|
||||||
ownca_path: '{{ output_dir }}/ca_cert.pem'
|
ownca_path: '{{ output_dir }}/ca_cert.pem'
|
||||||
|
|
@ -250,7 +250,7 @@
|
||||||
dest: "{{ output_dir }}/ownca_broken.pem"
|
dest: "{{ output_dir }}/ownca_broken.pem"
|
||||||
content: "broken"
|
content: "broken"
|
||||||
- name: Regenerate broken cert
|
- name: Regenerate broken cert
|
||||||
openssl_certificate:
|
x509_certificate:
|
||||||
path: '{{ output_dir }}/ownca_broken.pem'
|
path: '{{ output_dir }}/ownca_broken.pem'
|
||||||
csr_path: '{{ output_dir }}/csr_ecc.csr'
|
csr_path: '{{ output_dir }}/csr_ecc.csr'
|
||||||
privatekey_path: '{{ output_dir }}/privatekey_ecc.pem'
|
privatekey_path: '{{ output_dir }}/privatekey_ecc.pem'
|
||||||
|
|
@ -261,7 +261,7 @@
|
||||||
register: ownca_broken
|
register: ownca_broken
|
||||||
|
|
||||||
- name: (OwnCA, {{select_crypto_backend}}) Backup test
|
- name: (OwnCA, {{select_crypto_backend}}) Backup test
|
||||||
openssl_certificate:
|
x509_certificate:
|
||||||
path: '{{ output_dir }}/ownca_cert_backup.pem'
|
path: '{{ output_dir }}/ownca_cert_backup.pem'
|
||||||
csr_path: '{{ output_dir }}/csr_ecc.csr'
|
csr_path: '{{ output_dir }}/csr_ecc.csr'
|
||||||
ownca_path: '{{ output_dir }}/ca_cert.pem'
|
ownca_path: '{{ output_dir }}/ca_cert.pem'
|
||||||
|
|
@ -272,7 +272,7 @@
|
||||||
select_crypto_backend: '{{ select_crypto_backend }}'
|
select_crypto_backend: '{{ select_crypto_backend }}'
|
||||||
register: ownca_backup_1
|
register: ownca_backup_1
|
||||||
- name: (OwnCA, {{select_crypto_backend}}) Backup test (idempotent)
|
- name: (OwnCA, {{select_crypto_backend}}) Backup test (idempotent)
|
||||||
openssl_certificate:
|
x509_certificate:
|
||||||
path: '{{ output_dir }}/ownca_cert_backup.pem'
|
path: '{{ output_dir }}/ownca_cert_backup.pem'
|
||||||
csr_path: '{{ output_dir }}/csr_ecc.csr'
|
csr_path: '{{ output_dir }}/csr_ecc.csr'
|
||||||
ownca_path: '{{ output_dir }}/ca_cert.pem'
|
ownca_path: '{{ output_dir }}/ca_cert.pem'
|
||||||
|
|
@ -283,7 +283,7 @@
|
||||||
select_crypto_backend: '{{ select_crypto_backend }}'
|
select_crypto_backend: '{{ select_crypto_backend }}'
|
||||||
register: ownca_backup_2
|
register: ownca_backup_2
|
||||||
- name: (OwnCA, {{select_crypto_backend}}) Backup test (change)
|
- name: (OwnCA, {{select_crypto_backend}}) Backup test (change)
|
||||||
openssl_certificate:
|
x509_certificate:
|
||||||
path: '{{ output_dir }}/ownca_cert_backup.pem'
|
path: '{{ output_dir }}/ownca_cert_backup.pem'
|
||||||
csr_path: '{{ output_dir }}/csr.csr'
|
csr_path: '{{ output_dir }}/csr.csr'
|
||||||
ownca_path: '{{ output_dir }}/ca_cert.pem'
|
ownca_path: '{{ output_dir }}/ca_cert.pem'
|
||||||
|
|
@ -294,7 +294,7 @@
|
||||||
select_crypto_backend: '{{ select_crypto_backend }}'
|
select_crypto_backend: '{{ select_crypto_backend }}'
|
||||||
register: ownca_backup_3
|
register: ownca_backup_3
|
||||||
- name: (OwnCA, {{select_crypto_backend}}) Backup test (remove)
|
- name: (OwnCA, {{select_crypto_backend}}) Backup test (remove)
|
||||||
openssl_certificate:
|
x509_certificate:
|
||||||
path: '{{ output_dir }}/ownca_cert_backup.pem'
|
path: '{{ output_dir }}/ownca_cert_backup.pem'
|
||||||
state: absent
|
state: absent
|
||||||
provider: ownca
|
provider: ownca
|
||||||
|
|
@ -302,7 +302,7 @@
|
||||||
select_crypto_backend: '{{ select_crypto_backend }}'
|
select_crypto_backend: '{{ select_crypto_backend }}'
|
||||||
register: ownca_backup_4
|
register: ownca_backup_4
|
||||||
- name: (OwnCA, {{select_crypto_backend}}) Backup test (remove, idempotent)
|
- name: (OwnCA, {{select_crypto_backend}}) Backup test (remove, idempotent)
|
||||||
openssl_certificate:
|
x509_certificate:
|
||||||
path: '{{ output_dir }}/ownca_cert_backup.pem'
|
path: '{{ output_dir }}/ownca_cert_backup.pem'
|
||||||
state: absent
|
state: absent
|
||||||
provider: ownca
|
provider: ownca
|
||||||
|
|
@ -311,7 +311,7 @@
|
||||||
register: ownca_backup_5
|
register: ownca_backup_5
|
||||||
|
|
||||||
- name: (OwnCA, {{select_crypto_backend}}) Create subject key identifier
|
- name: (OwnCA, {{select_crypto_backend}}) Create subject key identifier
|
||||||
openssl_certificate:
|
x509_certificate:
|
||||||
path: '{{ output_dir }}/ownca_cert_ski.pem'
|
path: '{{ output_dir }}/ownca_cert_ski.pem'
|
||||||
csr_path: '{{ output_dir }}/csr_ecc.csr'
|
csr_path: '{{ output_dir }}/csr_ecc.csr'
|
||||||
ownca_path: '{{ output_dir }}/ca_cert.pem'
|
ownca_path: '{{ output_dir }}/ca_cert.pem'
|
||||||
|
|
@ -324,7 +324,7 @@
|
||||||
register: ownca_subject_key_identifier_1
|
register: ownca_subject_key_identifier_1
|
||||||
|
|
||||||
- name: (OwnCA, {{select_crypto_backend}}) Create subject key identifier (idempotency)
|
- name: (OwnCA, {{select_crypto_backend}}) Create subject key identifier (idempotency)
|
||||||
openssl_certificate:
|
x509_certificate:
|
||||||
path: '{{ output_dir }}/ownca_cert_ski.pem'
|
path: '{{ output_dir }}/ownca_cert_ski.pem'
|
||||||
csr_path: '{{ output_dir }}/csr_ecc.csr'
|
csr_path: '{{ output_dir }}/csr_ecc.csr'
|
||||||
ownca_path: '{{ output_dir }}/ca_cert.pem'
|
ownca_path: '{{ output_dir }}/ca_cert.pem'
|
||||||
|
|
@ -337,7 +337,7 @@
|
||||||
register: ownca_subject_key_identifier_2
|
register: ownca_subject_key_identifier_2
|
||||||
|
|
||||||
- name: (OwnCA, {{select_crypto_backend}}) Create subject key identifier (remove)
|
- name: (OwnCA, {{select_crypto_backend}}) Create subject key identifier (remove)
|
||||||
openssl_certificate:
|
x509_certificate:
|
||||||
path: '{{ output_dir }}/ownca_cert_ski.pem'
|
path: '{{ output_dir }}/ownca_cert_ski.pem'
|
||||||
csr_path: '{{ output_dir }}/csr_ecc.csr'
|
csr_path: '{{ output_dir }}/csr_ecc.csr'
|
||||||
ownca_path: '{{ output_dir }}/ca_cert.pem'
|
ownca_path: '{{ output_dir }}/ca_cert.pem'
|
||||||
|
|
@ -350,7 +350,7 @@
|
||||||
register: ownca_subject_key_identifier_3
|
register: ownca_subject_key_identifier_3
|
||||||
|
|
||||||
- name: (OwnCA, {{select_crypto_backend}}) Create subject key identifier (remove idempotency)
|
- name: (OwnCA, {{select_crypto_backend}}) Create subject key identifier (remove idempotency)
|
||||||
openssl_certificate:
|
x509_certificate:
|
||||||
path: '{{ output_dir }}/ownca_cert_ski.pem'
|
path: '{{ output_dir }}/ownca_cert_ski.pem'
|
||||||
csr_path: '{{ output_dir }}/csr_ecc.csr'
|
csr_path: '{{ output_dir }}/csr_ecc.csr'
|
||||||
ownca_path: '{{ output_dir }}/ca_cert.pem'
|
ownca_path: '{{ output_dir }}/ca_cert.pem'
|
||||||
|
|
@ -363,7 +363,7 @@
|
||||||
register: ownca_subject_key_identifier_4
|
register: ownca_subject_key_identifier_4
|
||||||
|
|
||||||
- name: (OwnCA, {{select_crypto_backend}}) Create subject key identifier (re-enable)
|
- name: (OwnCA, {{select_crypto_backend}}) Create subject key identifier (re-enable)
|
||||||
openssl_certificate:
|
x509_certificate:
|
||||||
path: '{{ output_dir }}/ownca_cert_ski.pem'
|
path: '{{ output_dir }}/ownca_cert_ski.pem'
|
||||||
csr_path: '{{ output_dir }}/csr_ecc.csr'
|
csr_path: '{{ output_dir }}/csr_ecc.csr'
|
||||||
ownca_path: '{{ output_dir }}/ca_cert.pem'
|
ownca_path: '{{ output_dir }}/ca_cert.pem'
|
||||||
|
|
@ -376,7 +376,7 @@
|
||||||
register: ownca_subject_key_identifier_5
|
register: ownca_subject_key_identifier_5
|
||||||
|
|
||||||
- name: (OwnCA, {{select_crypto_backend}}) Create authority key identifier
|
- name: (OwnCA, {{select_crypto_backend}}) Create authority key identifier
|
||||||
openssl_certificate:
|
x509_certificate:
|
||||||
path: '{{ output_dir }}/ownca_cert_aki.pem'
|
path: '{{ output_dir }}/ownca_cert_aki.pem'
|
||||||
csr_path: '{{ output_dir }}/csr_ecc.csr'
|
csr_path: '{{ output_dir }}/csr_ecc.csr'
|
||||||
ownca_path: '{{ output_dir }}/ca_cert.pem'
|
ownca_path: '{{ output_dir }}/ca_cert.pem'
|
||||||
|
|
@ -389,7 +389,7 @@
|
||||||
register: ownca_authority_key_identifier_1
|
register: ownca_authority_key_identifier_1
|
||||||
|
|
||||||
- name: (OwnCA, {{select_crypto_backend}}) Create authority key identifier (idempotency)
|
- name: (OwnCA, {{select_crypto_backend}}) Create authority key identifier (idempotency)
|
||||||
openssl_certificate:
|
x509_certificate:
|
||||||
path: '{{ output_dir }}/ownca_cert_aki.pem'
|
path: '{{ output_dir }}/ownca_cert_aki.pem'
|
||||||
csr_path: '{{ output_dir }}/csr_ecc.csr'
|
csr_path: '{{ output_dir }}/csr_ecc.csr'
|
||||||
ownca_path: '{{ output_dir }}/ca_cert.pem'
|
ownca_path: '{{ output_dir }}/ca_cert.pem'
|
||||||
|
|
@ -402,7 +402,7 @@
|
||||||
register: ownca_authority_key_identifier_2
|
register: ownca_authority_key_identifier_2
|
||||||
|
|
||||||
- name: (OwnCA, {{select_crypto_backend}}) Create authority key identifier (remove)
|
- name: (OwnCA, {{select_crypto_backend}}) Create authority key identifier (remove)
|
||||||
openssl_certificate:
|
x509_certificate:
|
||||||
path: '{{ output_dir }}/ownca_cert_aki.pem'
|
path: '{{ output_dir }}/ownca_cert_aki.pem'
|
||||||
csr_path: '{{ output_dir }}/csr_ecc.csr'
|
csr_path: '{{ output_dir }}/csr_ecc.csr'
|
||||||
ownca_path: '{{ output_dir }}/ca_cert.pem'
|
ownca_path: '{{ output_dir }}/ca_cert.pem'
|
||||||
|
|
@ -415,7 +415,7 @@
|
||||||
register: ownca_authority_key_identifier_3
|
register: ownca_authority_key_identifier_3
|
||||||
|
|
||||||
- name: (OwnCA, {{select_crypto_backend}}) Create authority key identifier (remove idempotency)
|
- name: (OwnCA, {{select_crypto_backend}}) Create authority key identifier (remove idempotency)
|
||||||
openssl_certificate:
|
x509_certificate:
|
||||||
path: '{{ output_dir }}/ownca_cert_aki.pem'
|
path: '{{ output_dir }}/ownca_cert_aki.pem'
|
||||||
csr_path: '{{ output_dir }}/csr_ecc.csr'
|
csr_path: '{{ output_dir }}/csr_ecc.csr'
|
||||||
ownca_path: '{{ output_dir }}/ca_cert.pem'
|
ownca_path: '{{ output_dir }}/ca_cert.pem'
|
||||||
|
|
@ -428,7 +428,7 @@
|
||||||
register: ownca_authority_key_identifier_4
|
register: ownca_authority_key_identifier_4
|
||||||
|
|
||||||
- name: (OwnCA, {{select_crypto_backend}}) Create authority key identifier (re-add)
|
- name: (OwnCA, {{select_crypto_backend}}) Create authority key identifier (re-add)
|
||||||
openssl_certificate:
|
x509_certificate:
|
||||||
path: '{{ output_dir }}/ownca_cert_aki.pem'
|
path: '{{ output_dir }}/ownca_cert_aki.pem'
|
||||||
csr_path: '{{ output_dir }}/csr_ecc.csr'
|
csr_path: '{{ output_dir }}/csr_ecc.csr'
|
||||||
ownca_path: '{{ output_dir }}/ca_cert.pem'
|
ownca_path: '{{ output_dir }}/ca_cert.pem'
|
||||||
|
|
@ -469,7 +469,7 @@
|
||||||
ignore_errors: yes
|
ignore_errors: yes
|
||||||
|
|
||||||
- name: (OwnCA, {{select_crypto_backend}}) Generate ownca certificate
|
- name: (OwnCA, {{select_crypto_backend}}) Generate ownca certificate
|
||||||
openssl_certificate:
|
x509_certificate:
|
||||||
path: '{{ output_dir }}/ownca_cert_{{ item }}.pem'
|
path: '{{ output_dir }}/ownca_cert_{{ item }}.pem'
|
||||||
csr_path: '{{ output_dir }}/csr_{{ item }}.csr'
|
csr_path: '{{ output_dir }}/csr_{{ item }}.csr'
|
||||||
ownca_path: '{{ output_dir }}/ca_cert.pem'
|
ownca_path: '{{ output_dir }}/ca_cert.pem'
|
||||||
|
|
@ -484,7 +484,7 @@
|
||||||
ignore_errors: yes
|
ignore_errors: yes
|
||||||
|
|
||||||
- name: (OwnCA, {{select_crypto_backend}}) Generate ownca certificate (idempotent)
|
- name: (OwnCA, {{select_crypto_backend}}) Generate ownca certificate (idempotent)
|
||||||
openssl_certificate:
|
x509_certificate:
|
||||||
path: '{{ output_dir }}/ownca_cert_{{ item }}.pem'
|
path: '{{ output_dir }}/ownca_cert_{{ item }}.pem'
|
||||||
csr_path: '{{ output_dir }}/csr_{{ item }}.csr'
|
csr_path: '{{ output_dir }}/csr_{{ item }}.csr'
|
||||||
ownca_path: '{{ output_dir }}/ca_cert.pem'
|
ownca_path: '{{ output_dir }}/ca_cert.pem'
|
||||||
|
|
@ -529,7 +529,7 @@
|
||||||
ignore_errors: yes
|
ignore_errors: yes
|
||||||
|
|
||||||
- name: (OwnCA, {{select_crypto_backend}}) Generate selfsigned CA certificate
|
- name: (OwnCA, {{select_crypto_backend}}) Generate selfsigned CA certificate
|
||||||
openssl_certificate:
|
x509_certificate:
|
||||||
path: '{{ output_dir }}/ca_cert_{{ item }}.pem'
|
path: '{{ output_dir }}/ca_cert_{{ item }}.pem'
|
||||||
csr_path: '{{ output_dir }}/ca_csr_{{ item }}.csr'
|
csr_path: '{{ output_dir }}/ca_csr_{{ item }}.csr'
|
||||||
privatekey_path: '{{ output_dir }}/ca_privatekey_{{ item }}.pem'
|
privatekey_path: '{{ output_dir }}/ca_privatekey_{{ item }}.pem'
|
||||||
|
|
@ -542,7 +542,7 @@
|
||||||
ignore_errors: yes
|
ignore_errors: yes
|
||||||
|
|
||||||
- name: (OwnCA, {{select_crypto_backend}}) Generate ownca certificate
|
- name: (OwnCA, {{select_crypto_backend}}) Generate ownca certificate
|
||||||
openssl_certificate:
|
x509_certificate:
|
||||||
path: '{{ output_dir }}/ownca_cert_{{ item }}_2.pem'
|
path: '{{ output_dir }}/ownca_cert_{{ item }}_2.pem'
|
||||||
csr_path: '{{ output_dir }}/csr.csr'
|
csr_path: '{{ output_dir }}/csr.csr'
|
||||||
ownca_path: '{{ output_dir }}/ca_cert_{{ item }}.pem'
|
ownca_path: '{{ output_dir }}/ca_cert_{{ item }}.pem'
|
||||||
|
|
@ -558,7 +558,7 @@
|
||||||
ignore_errors: yes
|
ignore_errors: yes
|
||||||
|
|
||||||
- name: (OwnCA, {{select_crypto_backend}}) Generate ownca certificate (idempotent)
|
- name: (OwnCA, {{select_crypto_backend}}) Generate ownca certificate (idempotent)
|
||||||
openssl_certificate:
|
x509_certificate:
|
||||||
path: '{{ output_dir }}/ownca_cert_{{ item }}_2.pem'
|
path: '{{ output_dir }}/ownca_cert_{{ item }}_2.pem'
|
||||||
csr_path: '{{ output_dir }}/csr.csr'
|
csr_path: '{{ output_dir }}/csr.csr'
|
||||||
ownca_path: '{{ output_dir }}/ca_cert_{{ item }}.pem'
|
ownca_path: '{{ output_dir }}/ca_cert_{{ item }}.pem'
|
||||||
|
|
@ -9,7 +9,7 @@
|
||||||
privatekey_path: '{{ output_dir }}/removal_privatekey.pem'
|
privatekey_path: '{{ output_dir }}/removal_privatekey.pem'
|
||||||
|
|
||||||
- name: (Removal, {{select_crypto_backend}}) Generate selfsigned certificate
|
- name: (Removal, {{select_crypto_backend}}) Generate selfsigned certificate
|
||||||
openssl_certificate:
|
x509_certificate:
|
||||||
path: '{{ output_dir }}/removal_cert.pem'
|
path: '{{ output_dir }}/removal_cert.pem'
|
||||||
csr_path: '{{ output_dir }}/removal_csr.csr'
|
csr_path: '{{ output_dir }}/removal_csr.csr'
|
||||||
privatekey_path: '{{ output_dir }}/removal_privatekey.pem'
|
privatekey_path: '{{ output_dir }}/removal_privatekey.pem'
|
||||||
|
|
@ -23,7 +23,7 @@
|
||||||
register: removal_1_prestat
|
register: removal_1_prestat
|
||||||
|
|
||||||
- name: "(Removal, {{select_crypto_backend}}) Remove certificate"
|
- name: "(Removal, {{select_crypto_backend}}) Remove certificate"
|
||||||
openssl_certificate:
|
x509_certificate:
|
||||||
path: "{{ output_dir }}/removal_cert.pem"
|
path: "{{ output_dir }}/removal_cert.pem"
|
||||||
state: absent
|
state: absent
|
||||||
select_crypto_backend: '{{ select_crypto_backend }}'
|
select_crypto_backend: '{{ select_crypto_backend }}'
|
||||||
|
|
@ -36,7 +36,7 @@
|
||||||
register: removal_1_poststat
|
register: removal_1_poststat
|
||||||
|
|
||||||
- name: "(Removal, {{select_crypto_backend}}) Remove certificate (idempotent)"
|
- name: "(Removal, {{select_crypto_backend}}) Remove certificate (idempotent)"
|
||||||
openssl_certificate:
|
x509_certificate:
|
||||||
path: "{{ output_dir }}/removal_cert.pem"
|
path: "{{ output_dir }}/removal_cert.pem"
|
||||||
state: absent
|
state: absent
|
||||||
select_crypto_backend: '{{ select_crypto_backend }}'
|
select_crypto_backend: '{{ select_crypto_backend }}'
|
||||||
|
|
@ -25,7 +25,7 @@
|
||||||
commonName: www.example.org
|
commonName: www.example.org
|
||||||
|
|
||||||
- name: (Selfsigned, {{select_crypto_backend}}) Generate selfsigned certificate
|
- name: (Selfsigned, {{select_crypto_backend}}) Generate selfsigned certificate
|
||||||
openssl_certificate:
|
x509_certificate:
|
||||||
path: '{{ output_dir }}/cert.pem'
|
path: '{{ output_dir }}/cert.pem'
|
||||||
csr_path: '{{ output_dir }}/csr.csr'
|
csr_path: '{{ output_dir }}/csr.csr'
|
||||||
privatekey_path: '{{ output_dir }}/privatekey.pem'
|
privatekey_path: '{{ output_dir }}/privatekey.pem'
|
||||||
|
|
@ -36,7 +36,7 @@
|
||||||
register: selfsigned_certificate
|
register: selfsigned_certificate
|
||||||
|
|
||||||
- name: (Selfsigned, {{select_crypto_backend}}) Generate selfsigned certificate - idempotency
|
- name: (Selfsigned, {{select_crypto_backend}}) Generate selfsigned certificate - idempotency
|
||||||
openssl_certificate:
|
x509_certificate:
|
||||||
path: '{{ output_dir }}/cert.pem'
|
path: '{{ output_dir }}/cert.pem'
|
||||||
csr_path: '{{ output_dir }}/csr.csr'
|
csr_path: '{{ output_dir }}/csr.csr'
|
||||||
privatekey_path: '{{ output_dir }}/privatekey.pem'
|
privatekey_path: '{{ output_dir }}/privatekey.pem'
|
||||||
|
|
@ -47,7 +47,7 @@
|
||||||
register: selfsigned_certificate_idempotence
|
register: selfsigned_certificate_idempotence
|
||||||
|
|
||||||
- name: (Selfsigned, {{select_crypto_backend}}) Generate selfsigned certificate (check mode)
|
- name: (Selfsigned, {{select_crypto_backend}}) Generate selfsigned certificate (check mode)
|
||||||
openssl_certificate:
|
x509_certificate:
|
||||||
path: '{{ output_dir }}/cert.pem'
|
path: '{{ output_dir }}/cert.pem'
|
||||||
csr_path: '{{ output_dir }}/csr.csr'
|
csr_path: '{{ output_dir }}/csr.csr'
|
||||||
privatekey_path: '{{ output_dir }}/privatekey.pem'
|
privatekey_path: '{{ output_dir }}/privatekey.pem'
|
||||||
|
|
@ -57,7 +57,7 @@
|
||||||
check_mode: yes
|
check_mode: yes
|
||||||
|
|
||||||
- name: (Selfsigned, {{select_crypto_backend}}) Generate selfsigned certificate (check mode, other CSR)
|
- name: (Selfsigned, {{select_crypto_backend}}) Generate selfsigned certificate (check mode, other CSR)
|
||||||
openssl_certificate:
|
x509_certificate:
|
||||||
path: '{{ output_dir }}/cert.pem'
|
path: '{{ output_dir }}/cert.pem'
|
||||||
csr_path: '{{ output_dir }}/csr_minimal_change.csr'
|
csr_path: '{{ output_dir }}/csr_minimal_change.csr'
|
||||||
privatekey_path: '{{ output_dir }}/privatekey.pem'
|
privatekey_path: '{{ output_dir }}/privatekey.pem'
|
||||||
|
|
@ -68,7 +68,7 @@
|
||||||
register: selfsigned_certificate_csr_minimal_change
|
register: selfsigned_certificate_csr_minimal_change
|
||||||
|
|
||||||
- name: (Selfsigned, {{select_crypto_backend}}) Check selfsigned certificate
|
- name: (Selfsigned, {{select_crypto_backend}}) Check selfsigned certificate
|
||||||
openssl_certificate:
|
x509_certificate:
|
||||||
path: '{{ output_dir }}/cert.pem'
|
path: '{{ output_dir }}/cert.pem'
|
||||||
privatekey_path: '{{ output_dir }}/privatekey.pem'
|
privatekey_path: '{{ output_dir }}/privatekey.pem'
|
||||||
provider: assertonly
|
provider: assertonly
|
||||||
|
|
@ -82,7 +82,7 @@
|
||||||
select_crypto_backend: '{{ select_crypto_backend }}'
|
select_crypto_backend: '{{ select_crypto_backend }}'
|
||||||
|
|
||||||
- name: (Selfsigned, {{select_crypto_backend}}) Generate selfsigned v2 certificate
|
- name: (Selfsigned, {{select_crypto_backend}}) Generate selfsigned v2 certificate
|
||||||
openssl_certificate:
|
x509_certificate:
|
||||||
path: '{{ output_dir }}/cert_v2.pem'
|
path: '{{ output_dir }}/cert_v2.pem'
|
||||||
csr_path: '{{ output_dir }}/csr.csr'
|
csr_path: '{{ output_dir }}/csr.csr'
|
||||||
privatekey_path: '{{ output_dir }}/privatekey.pem'
|
privatekey_path: '{{ output_dir }}/privatekey.pem'
|
||||||
|
|
@ -117,7 +117,7 @@
|
||||||
- biometricInfo
|
- biometricInfo
|
||||||
|
|
||||||
- name: (Selfsigned, {{select_crypto_backend}}) Generate selfsigned certificate2
|
- name: (Selfsigned, {{select_crypto_backend}}) Generate selfsigned certificate2
|
||||||
openssl_certificate:
|
x509_certificate:
|
||||||
path: '{{ output_dir }}/cert2.pem'
|
path: '{{ output_dir }}/cert2.pem'
|
||||||
csr_path: '{{ output_dir }}/csr2.csr'
|
csr_path: '{{ output_dir }}/csr2.csr'
|
||||||
privatekey_path: '{{ output_dir }}/privatekey2.pem'
|
privatekey_path: '{{ output_dir }}/privatekey2.pem'
|
||||||
|
|
@ -126,7 +126,7 @@
|
||||||
select_crypto_backend: '{{ select_crypto_backend }}'
|
select_crypto_backend: '{{ select_crypto_backend }}'
|
||||||
|
|
||||||
- name: (Selfsigned, {{select_crypto_backend}}) Check selfsigned certificate2
|
- name: (Selfsigned, {{select_crypto_backend}}) Check selfsigned certificate2
|
||||||
openssl_certificate:
|
x509_certificate:
|
||||||
path: '{{ output_dir }}/cert2.pem'
|
path: '{{ output_dir }}/cert2.pem'
|
||||||
privatekey_path: '{{ output_dir }}/privatekey2.pem'
|
privatekey_path: '{{ output_dir }}/privatekey2.pem'
|
||||||
provider: assertonly
|
provider: assertonly
|
||||||
|
|
@ -163,7 +163,7 @@
|
||||||
path: "{{ output_dir }}/csr3.pem"
|
path: "{{ output_dir }}/csr3.pem"
|
||||||
|
|
||||||
- name: (Selfsigned, {{select_crypto_backend}}) Create certificate3 with notBefore and notAfter
|
- name: (Selfsigned, {{select_crypto_backend}}) Create certificate3 with notBefore and notAfter
|
||||||
openssl_certificate:
|
x509_certificate:
|
||||||
provider: selfsigned
|
provider: selfsigned
|
||||||
selfsigned_not_before: 20181023133742Z
|
selfsigned_not_before: 20181023133742Z
|
||||||
selfsigned_not_after: 20191023133742Z
|
selfsigned_not_after: 20191023133742Z
|
||||||
|
|
@ -187,7 +187,7 @@
|
||||||
commonName: www.example.com
|
commonName: www.example.com
|
||||||
|
|
||||||
- name: (Selfsigned, {{select_crypto_backend}}) Generate selfsigned certificate
|
- name: (Selfsigned, {{select_crypto_backend}}) Generate selfsigned certificate
|
||||||
openssl_certificate:
|
x509_certificate:
|
||||||
path: '{{ output_dir }}/cert_ecc.pem'
|
path: '{{ output_dir }}/cert_ecc.pem'
|
||||||
csr_path: '{{ output_dir }}/csr_ecc.csr'
|
csr_path: '{{ output_dir }}/csr_ecc.csr'
|
||||||
privatekey_path: '{{ output_dir }}/privatekey_ecc.pem'
|
privatekey_path: '{{ output_dir }}/privatekey_ecc.pem'
|
||||||
|
|
@ -205,7 +205,7 @@
|
||||||
commonName: www.example.com
|
commonName: www.example.com
|
||||||
|
|
||||||
- name: (Selfsigned, {{select_crypto_backend}}) Generate selfsigned certificate (privatekey passphrase)
|
- name: (Selfsigned, {{select_crypto_backend}}) Generate selfsigned certificate (privatekey passphrase)
|
||||||
openssl_certificate:
|
x509_certificate:
|
||||||
path: '{{ output_dir }}/cert_pass.pem'
|
path: '{{ output_dir }}/cert_pass.pem'
|
||||||
csr_path: '{{ output_dir }}/csr_pass.csr'
|
csr_path: '{{ output_dir }}/csr_pass.csr'
|
||||||
privatekey_path: '{{ output_dir }}/privatekeypw.pem'
|
privatekey_path: '{{ output_dir }}/privatekeypw.pem'
|
||||||
|
|
@ -216,7 +216,7 @@
|
||||||
register: selfsigned_certificate_passphrase
|
register: selfsigned_certificate_passphrase
|
||||||
|
|
||||||
- name: (Selfsigned, {{select_crypto_backend}}) Generate selfsigned certificate (failed passphrase 1)
|
- name: (Selfsigned, {{select_crypto_backend}}) Generate selfsigned certificate (failed passphrase 1)
|
||||||
openssl_certificate:
|
x509_certificate:
|
||||||
path: '{{ output_dir }}/cert_pw1.pem'
|
path: '{{ output_dir }}/cert_pw1.pem'
|
||||||
csr_path: '{{ output_dir }}/csr_ecc.csr'
|
csr_path: '{{ output_dir }}/csr_ecc.csr'
|
||||||
privatekey_path: '{{ output_dir }}/privatekey.pem'
|
privatekey_path: '{{ output_dir }}/privatekey.pem'
|
||||||
|
|
@ -228,7 +228,7 @@
|
||||||
register: passphrase_error_1
|
register: passphrase_error_1
|
||||||
|
|
||||||
- name: (Selfsigned, {{select_crypto_backend}}) Generate selfsigned certificate (failed passphrase 2)
|
- name: (Selfsigned, {{select_crypto_backend}}) Generate selfsigned certificate (failed passphrase 2)
|
||||||
openssl_certificate:
|
x509_certificate:
|
||||||
path: '{{ output_dir }}/cert_pw2.pem'
|
path: '{{ output_dir }}/cert_pw2.pem'
|
||||||
csr_path: '{{ output_dir }}/csr_ecc.csr'
|
csr_path: '{{ output_dir }}/csr_ecc.csr'
|
||||||
privatekey_path: '{{ output_dir }}/privatekeypw.pem'
|
privatekey_path: '{{ output_dir }}/privatekeypw.pem'
|
||||||
|
|
@ -240,7 +240,7 @@
|
||||||
register: passphrase_error_2
|
register: passphrase_error_2
|
||||||
|
|
||||||
- name: (Selfsigned, {{select_crypto_backend}}) Generate selfsigned certificate (failed passphrase 3)
|
- name: (Selfsigned, {{select_crypto_backend}}) Generate selfsigned certificate (failed passphrase 3)
|
||||||
openssl_certificate:
|
x509_certificate:
|
||||||
path: '{{ output_dir }}/cert_pw3.pem'
|
path: '{{ output_dir }}/cert_pw3.pem'
|
||||||
csr_path: '{{ output_dir }}/csr_ecc.csr'
|
csr_path: '{{ output_dir }}/csr_ecc.csr'
|
||||||
privatekey_path: '{{ output_dir }}/privatekeypw.pem'
|
privatekey_path: '{{ output_dir }}/privatekeypw.pem'
|
||||||
|
|
@ -255,7 +255,7 @@
|
||||||
dest: "{{ output_dir }}/cert_broken.pem"
|
dest: "{{ output_dir }}/cert_broken.pem"
|
||||||
content: "broken"
|
content: "broken"
|
||||||
- name: Regenerate broken cert
|
- name: Regenerate broken cert
|
||||||
openssl_certificate:
|
x509_certificate:
|
||||||
path: '{{ output_dir }}/cert_broken.pem'
|
path: '{{ output_dir }}/cert_broken.pem'
|
||||||
csr_path: '{{ output_dir }}/csr_ecc.csr'
|
csr_path: '{{ output_dir }}/csr_ecc.csr'
|
||||||
privatekey_path: '{{ output_dir }}/privatekey_ecc.pem'
|
privatekey_path: '{{ output_dir }}/privatekey_ecc.pem'
|
||||||
|
|
@ -264,7 +264,7 @@
|
||||||
register: selfsigned_broken
|
register: selfsigned_broken
|
||||||
|
|
||||||
- name: (Selfsigned, {{select_crypto_backend}}) Backup test
|
- name: (Selfsigned, {{select_crypto_backend}}) Backup test
|
||||||
openssl_certificate:
|
x509_certificate:
|
||||||
path: '{{ output_dir }}/selfsigned_cert_backup.pem'
|
path: '{{ output_dir }}/selfsigned_cert_backup.pem'
|
||||||
csr_path: '{{ output_dir }}/csr_ecc.csr'
|
csr_path: '{{ output_dir }}/csr_ecc.csr'
|
||||||
privatekey_path: '{{ output_dir }}/privatekey_ecc.pem'
|
privatekey_path: '{{ output_dir }}/privatekey_ecc.pem'
|
||||||
|
|
@ -274,7 +274,7 @@
|
||||||
select_crypto_backend: '{{ select_crypto_backend }}'
|
select_crypto_backend: '{{ select_crypto_backend }}'
|
||||||
register: selfsigned_backup_1
|
register: selfsigned_backup_1
|
||||||
- name: (Selfsigned, {{select_crypto_backend}}) Backup test (idempotent)
|
- name: (Selfsigned, {{select_crypto_backend}}) Backup test (idempotent)
|
||||||
openssl_certificate:
|
x509_certificate:
|
||||||
path: '{{ output_dir }}/selfsigned_cert_backup.pem'
|
path: '{{ output_dir }}/selfsigned_cert_backup.pem'
|
||||||
csr_path: '{{ output_dir }}/csr_ecc.csr'
|
csr_path: '{{ output_dir }}/csr_ecc.csr'
|
||||||
privatekey_path: '{{ output_dir }}/privatekey_ecc.pem'
|
privatekey_path: '{{ output_dir }}/privatekey_ecc.pem'
|
||||||
|
|
@ -284,7 +284,7 @@
|
||||||
select_crypto_backend: '{{ select_crypto_backend }}'
|
select_crypto_backend: '{{ select_crypto_backend }}'
|
||||||
register: selfsigned_backup_2
|
register: selfsigned_backup_2
|
||||||
- name: (Selfsigned, {{select_crypto_backend}}) Backup test (change)
|
- name: (Selfsigned, {{select_crypto_backend}}) Backup test (change)
|
||||||
openssl_certificate:
|
x509_certificate:
|
||||||
path: '{{ output_dir }}/selfsigned_cert_backup.pem'
|
path: '{{ output_dir }}/selfsigned_cert_backup.pem'
|
||||||
csr_path: '{{ output_dir }}/csr.csr'
|
csr_path: '{{ output_dir }}/csr.csr'
|
||||||
privatekey_path: '{{ output_dir }}/privatekey.pem'
|
privatekey_path: '{{ output_dir }}/privatekey.pem'
|
||||||
|
|
@ -294,7 +294,7 @@
|
||||||
select_crypto_backend: '{{ select_crypto_backend }}'
|
select_crypto_backend: '{{ select_crypto_backend }}'
|
||||||
register: selfsigned_backup_3
|
register: selfsigned_backup_3
|
||||||
- name: (Selfsigned, {{select_crypto_backend}}) Backup test (remove)
|
- name: (Selfsigned, {{select_crypto_backend}}) Backup test (remove)
|
||||||
openssl_certificate:
|
x509_certificate:
|
||||||
path: '{{ output_dir }}/selfsigned_cert_backup.pem'
|
path: '{{ output_dir }}/selfsigned_cert_backup.pem'
|
||||||
state: absent
|
state: absent
|
||||||
provider: selfsigned
|
provider: selfsigned
|
||||||
|
|
@ -302,7 +302,7 @@
|
||||||
select_crypto_backend: '{{ select_crypto_backend }}'
|
select_crypto_backend: '{{ select_crypto_backend }}'
|
||||||
register: selfsigned_backup_4
|
register: selfsigned_backup_4
|
||||||
- name: (Selfsigned, {{select_crypto_backend}}) Backup test (remove, idempotent)
|
- name: (Selfsigned, {{select_crypto_backend}}) Backup test (remove, idempotent)
|
||||||
openssl_certificate:
|
x509_certificate:
|
||||||
path: '{{ output_dir }}/selfsigned_cert_backup.pem'
|
path: '{{ output_dir }}/selfsigned_cert_backup.pem'
|
||||||
state: absent
|
state: absent
|
||||||
provider: selfsigned
|
provider: selfsigned
|
||||||
|
|
@ -311,7 +311,7 @@
|
||||||
register: selfsigned_backup_5
|
register: selfsigned_backup_5
|
||||||
|
|
||||||
- name: (Selfsigned, {{select_crypto_backend}}) Create subject key identifier test
|
- name: (Selfsigned, {{select_crypto_backend}}) Create subject key identifier test
|
||||||
openssl_certificate:
|
x509_certificate:
|
||||||
path: '{{ output_dir }}/selfsigned_cert_ski.pem'
|
path: '{{ output_dir }}/selfsigned_cert_ski.pem'
|
||||||
csr_path: '{{ output_dir }}/csr_ecc.csr'
|
csr_path: '{{ output_dir }}/csr_ecc.csr'
|
||||||
privatekey_path: '{{ output_dir }}/privatekey_ecc.pem'
|
privatekey_path: '{{ output_dir }}/privatekey_ecc.pem'
|
||||||
|
|
@ -323,7 +323,7 @@
|
||||||
register: selfsigned_subject_key_identifier_1
|
register: selfsigned_subject_key_identifier_1
|
||||||
|
|
||||||
- name: (Selfsigned, {{select_crypto_backend}}) Create subject key identifier test (idempotency)
|
- name: (Selfsigned, {{select_crypto_backend}}) Create subject key identifier test (idempotency)
|
||||||
openssl_certificate:
|
x509_certificate:
|
||||||
path: '{{ output_dir }}/selfsigned_cert_ski.pem'
|
path: '{{ output_dir }}/selfsigned_cert_ski.pem'
|
||||||
csr_path: '{{ output_dir }}/csr_ecc.csr'
|
csr_path: '{{ output_dir }}/csr_ecc.csr'
|
||||||
privatekey_path: '{{ output_dir }}/privatekey_ecc.pem'
|
privatekey_path: '{{ output_dir }}/privatekey_ecc.pem'
|
||||||
|
|
@ -335,7 +335,7 @@
|
||||||
register: selfsigned_subject_key_identifier_2
|
register: selfsigned_subject_key_identifier_2
|
||||||
|
|
||||||
- name: (Selfsigned, {{select_crypto_backend}}) Create subject key identifier test (remove)
|
- name: (Selfsigned, {{select_crypto_backend}}) Create subject key identifier test (remove)
|
||||||
openssl_certificate:
|
x509_certificate:
|
||||||
path: '{{ output_dir }}/selfsigned_cert_ski.pem'
|
path: '{{ output_dir }}/selfsigned_cert_ski.pem'
|
||||||
csr_path: '{{ output_dir }}/csr_ecc.csr'
|
csr_path: '{{ output_dir }}/csr_ecc.csr'
|
||||||
privatekey_path: '{{ output_dir }}/privatekey_ecc.pem'
|
privatekey_path: '{{ output_dir }}/privatekey_ecc.pem'
|
||||||
|
|
@ -347,7 +347,7 @@
|
||||||
register: selfsigned_subject_key_identifier_3
|
register: selfsigned_subject_key_identifier_3
|
||||||
|
|
||||||
- name: (Selfsigned, {{select_crypto_backend}}) Create subject key identifier test (remove idempotency)
|
- name: (Selfsigned, {{select_crypto_backend}}) Create subject key identifier test (remove idempotency)
|
||||||
openssl_certificate:
|
x509_certificate:
|
||||||
path: '{{ output_dir }}/selfsigned_cert_ski.pem'
|
path: '{{ output_dir }}/selfsigned_cert_ski.pem'
|
||||||
csr_path: '{{ output_dir }}/csr_ecc.csr'
|
csr_path: '{{ output_dir }}/csr_ecc.csr'
|
||||||
privatekey_path: '{{ output_dir }}/privatekey_ecc.pem'
|
privatekey_path: '{{ output_dir }}/privatekey_ecc.pem'
|
||||||
|
|
@ -359,7 +359,7 @@
|
||||||
register: selfsigned_subject_key_identifier_4
|
register: selfsigned_subject_key_identifier_4
|
||||||
|
|
||||||
- name: (Selfsigned, {{select_crypto_backend}}) Create subject key identifier test (re-enable)
|
- name: (Selfsigned, {{select_crypto_backend}}) Create subject key identifier test (re-enable)
|
||||||
openssl_certificate:
|
x509_certificate:
|
||||||
path: '{{ output_dir }}/selfsigned_cert_ski.pem'
|
path: '{{ output_dir }}/selfsigned_cert_ski.pem'
|
||||||
csr_path: '{{ output_dir }}/csr_ecc.csr'
|
csr_path: '{{ output_dir }}/csr_ecc.csr'
|
||||||
privatekey_path: '{{ output_dir }}/privatekey_ecc.pem'
|
privatekey_path: '{{ output_dir }}/privatekey_ecc.pem'
|
||||||
|
|
@ -399,7 +399,7 @@
|
||||||
ignore_errors: yes
|
ignore_errors: yes
|
||||||
|
|
||||||
- name: (Selfsigned, {{select_crypto_backend}}) Generate selfsigned certificate
|
- name: (Selfsigned, {{select_crypto_backend}}) Generate selfsigned certificate
|
||||||
openssl_certificate:
|
x509_certificate:
|
||||||
path: '{{ output_dir }}/cert_{{ item }}.pem'
|
path: '{{ output_dir }}/cert_{{ item }}.pem'
|
||||||
csr_path: '{{ output_dir }}/csr_{{ item }}.csr'
|
csr_path: '{{ output_dir }}/csr_{{ item }}.csr'
|
||||||
privatekey_path: '{{ output_dir }}/privatekey_{{ item }}.pem'
|
privatekey_path: '{{ output_dir }}/privatekey_{{ item }}.pem'
|
||||||
|
|
@ -413,7 +413,7 @@
|
||||||
ignore_errors: yes
|
ignore_errors: yes
|
||||||
|
|
||||||
- name: (Selfsigned, {{select_crypto_backend}}) Generate selfsigned certificate - idempotency
|
- name: (Selfsigned, {{select_crypto_backend}}) Generate selfsigned certificate - idempotency
|
||||||
openssl_certificate:
|
x509_certificate:
|
||||||
path: '{{ output_dir }}/cert_{{ item }}.pem'
|
path: '{{ output_dir }}/cert_{{ item }}.pem'
|
||||||
csr_path: '{{ output_dir }}/csr_{{ item }}.csr'
|
csr_path: '{{ output_dir }}/csr_{{ item }}.csr'
|
||||||
privatekey_path: '{{ output_dir }}/privatekey_{{ item }}.pem'
|
privatekey_path: '{{ output_dir }}/privatekey_{{ item }}.pem'
|
||||||
|
|
@ -3,7 +3,7 @@
|
||||||
msg: "Executing tests with backend {{ select_crypto_backend }}"
|
msg: "Executing tests with backend {{ select_crypto_backend }}"
|
||||||
|
|
||||||
- name: ({{select_crypto_backend}}) Get certificate info
|
- name: ({{select_crypto_backend}}) Get certificate info
|
||||||
openssl_certificate_info:
|
x509_certificate_info:
|
||||||
path: '{{ output_dir }}/cert_1.pem'
|
path: '{{ output_dir }}/cert_1.pem'
|
||||||
select_crypto_backend: '{{ select_crypto_backend }}'
|
select_crypto_backend: '{{ select_crypto_backend }}'
|
||||||
register: result
|
register: result
|
||||||
|
|
@ -36,7 +36,7 @@
|
||||||
info_results: "{{ info_results + [result] }}"
|
info_results: "{{ info_results + [result] }}"
|
||||||
|
|
||||||
- name: ({{select_crypto_backend}}) Get certificate info directly
|
- name: ({{select_crypto_backend}}) Get certificate info directly
|
||||||
openssl_certificate_info:
|
x509_certificate_info:
|
||||||
content: '{{ lookup("file", output_dir ~ "/cert_1.pem") }}'
|
content: '{{ lookup("file", output_dir ~ "/cert_1.pem") }}'
|
||||||
select_crypto_backend: '{{ select_crypto_backend }}'
|
select_crypto_backend: '{{ select_crypto_backend }}'
|
||||||
register: result_direct
|
register: result_direct
|
||||||
|
|
@ -47,7 +47,7 @@
|
||||||
- result == result_direct
|
- result == result_direct
|
||||||
|
|
||||||
- name: ({{select_crypto_backend}}) Get certificate info
|
- name: ({{select_crypto_backend}}) Get certificate info
|
||||||
openssl_certificate_info:
|
x509_certificate_info:
|
||||||
path: '{{ output_dir }}/cert_2.pem'
|
path: '{{ output_dir }}/cert_2.pem'
|
||||||
select_crypto_backend: '{{ select_crypto_backend }}'
|
select_crypto_backend: '{{ select_crypto_backend }}'
|
||||||
valid_at:
|
valid_at:
|
||||||
|
|
@ -66,7 +66,7 @@
|
||||||
info_results: "{{ info_results + [result] }}"
|
info_results: "{{ info_results + [result] }}"
|
||||||
|
|
||||||
- name: ({{select_crypto_backend}}) Get certificate info
|
- name: ({{select_crypto_backend}}) Get certificate info
|
||||||
openssl_certificate_info:
|
x509_certificate_info:
|
||||||
path: '{{ output_dir }}/cert_3.pem'
|
path: '{{ output_dir }}/cert_3.pem'
|
||||||
select_crypto_backend: '{{ select_crypto_backend }}'
|
select_crypto_backend: '{{ select_crypto_backend }}'
|
||||||
register: result
|
register: result
|
||||||
|
|
@ -88,7 +88,7 @@
|
||||||
info_results: "{{ info_results + [result] }}"
|
info_results: "{{ info_results + [result] }}"
|
||||||
|
|
||||||
- name: ({{select_crypto_backend}}) Get certificate info
|
- name: ({{select_crypto_backend}}) Get certificate info
|
||||||
openssl_certificate_info:
|
x509_certificate_info:
|
||||||
path: '{{ output_dir }}/cert_4.pem'
|
path: '{{ output_dir }}/cert_4.pem'
|
||||||
select_crypto_backend: '{{ select_crypto_backend }}'
|
select_crypto_backend: '{{ select_crypto_backend }}'
|
||||||
register: result
|
register: result
|
||||||
|
|
@ -106,7 +106,7 @@
|
||||||
info_results: "{{ info_results + [result] }}"
|
info_results: "{{ info_results + [result] }}"
|
||||||
|
|
||||||
- name: ({{select_crypto_backend}}) Get certificate info for packaged cert 1
|
- name: ({{select_crypto_backend}}) Get certificate info for packaged cert 1
|
||||||
openssl_certificate_info:
|
x509_certificate_info:
|
||||||
path: '{{ role_path }}/files/cert1.pem'
|
path: '{{ role_path }}/files/cert1.pem'
|
||||||
select_crypto_backend: '{{ select_crypto_backend }}'
|
select_crypto_backend: '{{ select_crypto_backend }}'
|
||||||
register: result
|
register: result
|
||||||
|
|
@ -113,7 +113,7 @@
|
||||||
authority_key_identifier: '{{ "44:55:66:77" if cryptography_version.stdout is version("1.3", ">=") else omit }}'
|
authority_key_identifier: '{{ "44:55:66:77" if cryptography_version.stdout is version("1.3", ">=") else omit }}'
|
||||||
|
|
||||||
- name: Generate selfsigned certificates
|
- name: Generate selfsigned certificates
|
||||||
openssl_certificate:
|
x509_certificate:
|
||||||
path: '{{ output_dir }}/cert_{{ item }}.pem'
|
path: '{{ output_dir }}/cert_{{ item }}.pem'
|
||||||
csr_path: '{{ output_dir }}/csr_{{ item }}.csr'
|
csr_path: '{{ output_dir }}/csr_{{ item }}.csr'
|
||||||
privatekey_path: '{{ output_dir }}/privatekey.pem'
|
privatekey_path: '{{ output_dir }}/privatekey.pem'
|
||||||
|
|
@ -42,7 +42,7 @@
|
||||||
loop: "{{ certificates }}"
|
loop: "{{ certificates }}"
|
||||||
|
|
||||||
- name: Generate CA certificates
|
- name: Generate CA certificates
|
||||||
openssl_certificate:
|
x509_certificate:
|
||||||
path: '{{ output_dir }}/{{ item.name }}.pem'
|
path: '{{ output_dir }}/{{ item.name }}.pem'
|
||||||
csr_path: '{{ output_dir }}/{{ item.name }}.csr'
|
csr_path: '{{ output_dir }}/{{ item.name }}.csr'
|
||||||
privatekey_path: '{{ output_dir }}/{{ item.name }}.key'
|
privatekey_path: '{{ output_dir }}/{{ item.name }}.key'
|
||||||
|
|
@ -51,7 +51,7 @@
|
||||||
when: item.is_ca | default(false)
|
when: item.is_ca | default(false)
|
||||||
|
|
||||||
- name: Generate other certificates
|
- name: Generate other certificates
|
||||||
openssl_certificate:
|
x509_certificate:
|
||||||
path: '{{ output_dir }}/{{ item.name }}.pem'
|
path: '{{ output_dir }}/{{ item.name }}.pem'
|
||||||
csr_path: '{{ output_dir }}/{{ item.name }}.csr'
|
csr_path: '{{ output_dir }}/{{ item.name }}.csr'
|
||||||
provider: ownca
|
provider: ownca
|
||||||
|
|
@ -61,7 +61,7 @@
|
||||||
when: not (item.is_ca | default(false))
|
when: not (item.is_ca | default(false))
|
||||||
|
|
||||||
- name: Get certificate infos
|
- name: Get certificate infos
|
||||||
openssl_certificate_info:
|
x509_certificate_info:
|
||||||
path: '{{ output_dir }}/{{ item }}.pem'
|
path: '{{ output_dir }}/{{ item }}.pem'
|
||||||
loop:
|
loop:
|
||||||
- cert-1
|
- cert-1
|
||||||
|
|
|
||||||
|
|
@ -6,9 +6,9 @@ plugins/modules/acme_certificate.py validate-modules:return-syntax-error
|
||||||
plugins/modules/certificate_complete_chain.py validate-modules:return-syntax-error
|
plugins/modules/certificate_complete_chain.py validate-modules:return-syntax-error
|
||||||
plugins/modules/get_certificate.py validate-modules:return-syntax-error
|
plugins/modules/get_certificate.py validate-modules:return-syntax-error
|
||||||
plugins/modules/openssh_cert.py validate-modules:return-syntax-error
|
plugins/modules/openssh_cert.py validate-modules:return-syntax-error
|
||||||
plugins/modules/openssl_certificate_info.py validate-modules:return-syntax-error
|
|
||||||
plugins/modules/openssl_csr.py validate-modules:return-syntax-error
|
plugins/modules/openssl_csr.py validate-modules:return-syntax-error
|
||||||
plugins/modules/openssl_csr_info.py validate-modules:return-syntax-error
|
plugins/modules/openssl_csr_info.py validate-modules:return-syntax-error
|
||||||
|
plugins/modules/x509_certificate_info.py validate-modules:return-syntax-error
|
||||||
plugins/modules/x509_crl.py validate-modules:return-syntax-error
|
plugins/modules/x509_crl.py validate-modules:return-syntax-error
|
||||||
plugins/modules/x509_crl_info.py validate-modules:return-syntax-error
|
plugins/modules/x509_crl_info.py validate-modules:return-syntax-error
|
||||||
tests/unit/mock/path.py future-import-boilerplate
|
tests/unit/mock/path.py future-import-boilerplate
|
||||||
|
|
|
||||||
Loading…
Reference in New Issue