* Provide error information.
* Add helper function for order creation retrying.
* Improve existing documentation.
* Document 'replaces' return value.
* Add order_creation_error_strategy and order_creation_max_retries options.
* Add changelog fragment.
* Fix authz deactivation for finalizing step.
* Fix profile handling on order creation.
* Improve existing tests.
* Add ARI and profile tests.
* Warn when 'replaces' is removed when retrying to create an order.
* Fix error reporting for OpenSSL backend: raise BackendExceptions instead of directly failing the module.
* Add treat_parsing_error_as_non_existing option and existing and parsable return values.
* lookup lowercase domain names when verifying authorizations to prevent failure when CSR has mixed-case names
Signed-off-by: Lyas Spiehler <lspiehler@gmail.com>
* remove .lower() method
* make authorizations keys lowercase
Signed-off-by: Lyas Spiehler <lspiehler@gmail.com>
* use lowercase keys for authorizations dict
Signed-off-by: Lyas Spiehler <lspiehler@gmail.com>
* use new normalize_combined_identifier function to normalize identifiers
* include two blank lines after functions to pass tests
* Update plugins/module_utils/acme/challenges.py
Co-authored-by: Felix Fontein <felix@fontein.de>
* add changelog fragment
Signed-off-by: Lyas Spiehler <lspiehler@gmail.com>
* Update changelogs/fragments/803-fix-authorization-failure-with-mixed-case-sans.yml
Co-authored-by: Felix Fontein <felix@fontein.de>
---------
Signed-off-by: Lyas Spiehler <lspiehler@gmail.com>
Co-authored-by: Felix Fontein <felix@fontein.de>
Revert "Fix documentation. (#751)"
Revert "ACME modules: simplify code, refactor argspec handling code, move csr/csr_content to own docs fragment (#750)"
Revert "Refactor and extend argument spec helper, use for ACME modules (#749)"
Revert "Avoid exception if certificate has no AKI in acme_certificate. (#748)"
Revert "ACME: improve acme_certificate docs, include cert_id in acme_certificate_renewal_info return value (#747)"
Revert "Add acme_certificate_renewal_info module (#746)"
Revert "Refactor time code, add tests, fix bug when parsing absolute timestamps that omit seconds (#745)"
Revert "Add tests for acme_certificate_deactivate_authz module. (#744)"
Revert "Create acme_certificate_deactivate_authz module (#741)"
Revert "acme_certificate: allow to request renewal of a certificate according to ARI (#739)"
Revert "Implement basic acme_ari_info module. (#732)"
Revert "Add function for retrieval of ARI information. (#738)"
Revert "acme module utils: add functions for parsing Retry-After header values and computation of ARI certificate IDs (#737)"
Revert "Implement certificate information retrieval code in the ACME backends. (#736)"
Revert "Split up the default acme docs fragment to allow modules ot not need account data. (#735)"
This reverts commits 5e59c5261e, aa82575a78,
f3c9cb7a8a, f82b335916, 553ab45f46,
59606d48ad, 0a15be1017, 9501a28a93,
d906914737, 33d278ad8f, 6d4fc589ae,
9614b09f7a, af5f4b57f8, c6fbe58382,
and afe7f7522c.
* Fix time idempotence.
* Lint and add changelog fragment.
* Add tests.
* Make sure 'ignore_timestamps: false' is passed for time idempotence tests; pass right private key for OwnCA tests
* Use community.dns.quote_txt filter instead of regex replace to quote TXT entry value.
* Fix documentation of acme_certificate's challenge_data return value.
* Also return cert_id from acme_certificate_renewal_info module.
* The cert ID cannot be computed if the certificate has no AKI.
This happens with older Pebble versions, which are used when
testing against older ansible-core/-base/Ansible versions.
* Fix AKI extraction for older OpenSSL versions.
* Allow to provide cert_info object to get_renewal_info().
* Add acme_certificate_renewal_info module.
* Allow to provide value for 'now'.
* Actually append msg_append.
* Fix bug in module timestamp param parsing, and add tests.
* Fix quick_is_not_prime() for small primes. Add some tests.
* Fix return value of convert_int_to_bytes(0, 0) on Python 2.
* Add some more test cases.
* Simplify the changelog and point out that these errors only happen for cases not happening in regular use.
* Use timezone aware functionality when using cryptography >= 42.0.0.
* Adjust OpenSSH certificate code to avoid functions deprecated in Python 3.12.
* Strip timezone info from isoformat() output.
* InvalidityDate.invalidity_date currently has no _utc variant.
* Check return code on ssh(-keygen) invocations.
* openssh_cert: only check for errors if certificate should be present and module is not in check mode.
* Handle rc check for _get_private_key().
* Add changelog fragment.
* Only pass -o for comment updating when necessary.
* Now fails if comment cannot be updated.
This was silently ignored in the past.
* Avoid failing operation.
* Add gpg_fingerprint lookup.
* Work around problems on some CI targets.
* Use get_bin_path to find the gpg executable. Document that we need it.
* Improve and test error handling.
* Refactor (potentially) common code to module_utils and plugin_utils.
This will be useful to create a filter version of this, and further lookups, filters, and modules.
* Do not create a keyring when there isn't one.
* Fixups.
* Fix description.
* More fixes for lookup.
* Also add a gpg_fingerprint filter.
* Improve formulation.
Co-authored-by: Sandra McCann <samccann@redhat.com>
---------
Co-authored-by: Sandra McCann <samccann@redhat.com>
* Added support for DER format
* Updated description
* Adjusted description
The content of the certificate cannot be in DER format due to an input encoding problem in the Ansible module, but it works fine when reading the certificate from a file
* Update support.py
* Added der_support_enabled flag for DER-format support
* Added changelog fragment for #603
* Fixed typo
* Fixed missing import
* Resolved issues found by static code analysis
* Update plugins/module_utils/crypto/support.py
Committed suggested change
Co-authored-by: Felix Fontein <felix@fontein.de>
* Apply suggestions from code review
Co-authored-by: Felix Fontein <felix@fontein.de>
---------
Co-authored-by: Felix Fontein <felix@fontein.de>
Felix Fontein
Lyas Spiehler
Marcin Słowikowski