From 334ebc6035757fab98a7366f1cacf35d15d6e098 Mon Sep 17 00:00:00 2001 From: felixfontein Date: Sun, 1 Jan 2023 09:21:40 +0000 Subject: [PATCH] deploy: 095434a4c18feab71db8afc2298eb46c542e6ae2 --- branch/main/acme_account_info_module.html | 52 ++-- branch/main/acme_account_module.html | 48 ++-- branch/main/acme_certificate_module.html | 248 +++++++++--------- .../main/acme_certificate_revoke_module.html | 16 +- .../acme_challenge_cert_helper_module.html | 72 ++--- branch/main/acme_inspect_module.html | 176 ++++++------- .../certificate_complete_chain_module.html | 60 ++--- branch/main/crypto_info_module.html | 14 +- branch/main/docsite/guide_ownca.html | 210 +++++++-------- branch/main/docsite/guide_selfsigned.html | 58 ++-- branch/main/ecs_certificate_module.html | 214 +++++++-------- branch/main/ecs_domain_module.html | 72 ++--- branch/main/get_certificate_module.html | 38 +-- branch/main/luks_device_module.html | 164 ++++++------ branch/main/openssh_cert_module.html | 118 ++++----- branch/main/openssh_keypair_module.html | 38 +-- branch/main/openssl_csr_info_filter.html | 8 +- branch/main/openssl_csr_info_module.html | 24 +- branch/main/openssl_csr_module.html | 164 ++++++------ branch/main/openssl_csr_pipe_module.html | 36 +-- branch/main/openssl_dhparam_module.html | 22 +- branch/main/openssl_pkcs12_module.html | 122 ++++----- .../openssl_privatekey_convert_module.html | 12 +- .../main/openssl_privatekey_info_filter.html | 8 +- .../main/openssl_privatekey_info_module.html | 20 +- branch/main/openssl_privatekey_module.html | 40 +-- .../main/openssl_privatekey_pipe_module.html | 50 ++-- .../main/openssl_publickey_info_filter.html | 8 +- .../main/openssl_publickey_info_module.html | 28 +- branch/main/openssl_publickey_module.html | 54 ++-- .../main/openssl_signature_info_module.html | 30 +-- branch/main/openssl_signature_module.html | 30 +-- branch/main/split_pem_filter.html | 10 +- branch/main/x509_certificate_info_filter.html | 8 +- branch/main/x509_certificate_info_module.html | 60 ++--- branch/main/x509_certificate_module.html | 198 +++++++------- branch/main/x509_certificate_pipe_module.html | 104 ++++---- branch/main/x509_crl_info_filter.html | 8 +- branch/main/x509_crl_info_module.html | 24 +- branch/main/x509_crl_module.html | 38 +-- 40 files changed, 1352 insertions(+), 1352 deletions(-) diff --git a/branch/main/acme_account_info_module.html b/branch/main/acme_account_info_module.html index 28ea96ab..367987bc 100644 --- a/branch/main/acme_account_info_module.html +++ b/branch/main/acme_account_info_module.html @@ -395,33 +395,33 @@ see

Examples

-
- name: Check whether an account with the given account key exists
-  community.crypto.acme_account_info:
-    account_key_src: /etc/pki/cert/private/account.key
-  register: account_data
-- name: Verify that account exists
-  assert:
-    that:
-      - account_data.exists
-- name: Print account URI
-  ansible.builtin.debug:
-    var: account_data.account_uri
-- name: Print account contacts
-  ansible.builtin.debug:
-    var: account_data.account.contact
+
- name: Check whether an account with the given account key exists
+  community.crypto.acme_account_info:
+    account_key_src: /etc/pki/cert/private/account.key
+  register: account_data
+- name: Verify that account exists
+  assert:
+    that:
+      - account_data.exists
+- name: Print account URI
+  ansible.builtin.debug:
+    var: account_data.account_uri
+- name: Print account contacts
+  ansible.builtin.debug:
+    var: account_data.account.contact
 
-- name: Check whether the account exists and is accessible with the given account key
-  acme_account_info:
-    account_key_content: "{{ acme_account_key }}"
-    account_uri: "{{ acme_account_uri }}"
-  register: account_data
-- name: Verify that account exists
-  assert:
-    that:
-      - account_data.exists
-- name: Print account contacts
-  ansible.builtin.debug:
-    var: account_data.account.contact
+- name: Check whether the account exists and is accessible with the given account key
+  acme_account_info:
+    account_key_content: "{{ acme_account_key }}"
+    account_uri: "{{ acme_account_uri }}"
+  register: account_data
+- name: Verify that account exists
+  assert:
+    that:
+      - account_data.exists
+- name: Print account contacts
+  ansible.builtin.debug:
+    var: account_data.account.contact
 

 

 
diff --git a/branch/main/acme_account_module.html b/branch/main/acme_account_module.html
index 0ac07244..e6b9c2b2 100644
--- a/branch/main/acme_account_module.html
+++ b/branch/main/acme_account_module.html
@@ -503,33 +503,33 @@ see 
 
Examples

-
- name: Make sure account exists and has given contacts. We agree to TOS.
-  community.crypto.acme_account:
-    account_key_src: /etc/pki/cert/private/account.key
-    state: present
-    terms_agreed: true
-    contact:
-    - mailto:me@example.com
-    - mailto:myself@example.org
+
- name: Make sure account exists and has given contacts. We agree to TOS.
+  community.crypto.acme_account:
+    account_key_src: /etc/pki/cert/private/account.key
+    state: present
+    terms_agreed: true
+    contact:
+    - mailto:me@example.com
+    - mailto:myself@example.org
 
-- name: Make sure account has given email address. Do not create account if it does not exist
-  community.crypto.acme_account:
-    account_key_src: /etc/pki/cert/private/account.key
-    state: present
-    allow_creation: false
-    contact:
-    - mailto:me@example.com
+- name: Make sure account has given email address. Do not create account if it does not exist
+  community.crypto.acme_account:
+    account_key_src: /etc/pki/cert/private/account.key
+    state: present
+    allow_creation: false
+    contact:
+    - mailto:me@example.com
 
-- name: Change account's key to the one stored in the variable new_account_key
-  community.crypto.acme_account:
-    account_key_src: /etc/pki/cert/private/account.key
-    new_account_key_content: '{{ new_account_key }}'
-    state: changed_key
+- name: Change account's key to the one stored in the variable new_account_key
+  community.crypto.acme_account:
+    account_key_src: /etc/pki/cert/private/account.key
+    new_account_key_content: '{{ new_account_key }}'
+    state: changed_key
 
-- name: Delete account (we have to use the new key)
-  community.crypto.acme_account:
-    account_key_content: '{{ new_account_key }}'
-    state: absent
+- name: Delete account (we have to use the new key)
+  community.crypto.acme_account:
+    account_key_content: '{{ new_account_key }}'
+    state: absent
 

 

 
diff --git a/branch/main/acme_certificate_module.html b/branch/main/acme_certificate_module.html
index c2ea01e8..93545b75 100644
--- a/branch/main/acme_certificate_module.html
+++ b/branch/main/acme_certificate_module.html
@@ -645,140 +645,140 @@ see 
 
Examples

-
### Example with HTTP challenge ###
+
### Example with HTTP challenge ###
 
-- name: Create a challenge for sample.com using a account key from a variable.
-  community.crypto.acme_certificate:
-    account_key_content: "{{ account_private_key }}"
-    csr: /etc/pki/cert/csr/sample.com.csr
-    dest: /etc/httpd/ssl/sample.com.crt
-  register: sample_com_challenge
+- name: Create a challenge for sample.com using a account key from a variable.
+  community.crypto.acme_certificate:
+    account_key_content: "{{ account_private_key }}"
+    csr: /etc/pki/cert/csr/sample.com.csr
+    dest: /etc/httpd/ssl/sample.com.crt
+  register: sample_com_challenge
 
-# Alternative first step:
-- name: Create a challenge for sample.com using a account key from hashi vault.
-  community.crypto.acme_certificate:
-    account_key_content: "{{ lookup('hashi_vault', 'secret=secret/account_private_key:value') }}"
-    csr: /etc/pki/cert/csr/sample.com.csr
-    fullchain_dest: /etc/httpd/ssl/sample.com-fullchain.crt
-  register: sample_com_challenge
+# Alternative first step:
+- name: Create a challenge for sample.com using a account key from hashi vault.
+  community.crypto.acme_certificate:
+    account_key_content: "{{ lookup('hashi_vault', 'secret=secret/account_private_key:value') }}"
+    csr: /etc/pki/cert/csr/sample.com.csr
+    fullchain_dest: /etc/httpd/ssl/sample.com-fullchain.crt
+  register: sample_com_challenge
 
-# Alternative first step:
-- name: Create a challenge for sample.com using a account key file.
-  community.crypto.acme_certificate:
-    account_key_src: /etc/pki/cert/private/account.key
-    csr_content: "{{ lookup('file', '/etc/pki/cert/csr/sample.com.csr') }}"
-    dest: /etc/httpd/ssl/sample.com.crt
-    fullchain_dest: /etc/httpd/ssl/sample.com-fullchain.crt
-  register: sample_com_challenge
+# Alternative first step:
+- name: Create a challenge for sample.com using a account key file.
+  community.crypto.acme_certificate:
+    account_key_src: /etc/pki/cert/private/account.key
+    csr_content: "{{ lookup('file', '/etc/pki/cert/csr/sample.com.csr') }}"
+    dest: /etc/httpd/ssl/sample.com.crt
+    fullchain_dest: /etc/httpd/ssl/sample.com-fullchain.crt
+  register: sample_com_challenge
 
-# perform the necessary steps to fulfill the challenge
-# for example:
-#
-# - copy:
-#     dest: /var/www/html/{{ sample_com_challenge['challenge_data']['sample.com']['http-01']['resource'] }}
-#     content: "{{ sample_com_challenge['challenge_data']['sample.com']['http-01']['resource_value'] }}"
-#   when: sample_com_challenge is changed and 'sample.com' in sample_com_challenge['challenge_data']
-#
-# Alternative way:
-#
-# - copy:
-#     dest: /var/www/{{ item.key }}/{{ item.value['http-01']['resource'] }}
-#     content: "{{ item.value['http-01']['resource_value'] }}"
-#   loop: "{{ sample_com_challenge.challenge_data | dict2items }}"
-#   when: sample_com_challenge is changed
+# perform the necessary steps to fulfill the challenge
+# for example:
+#
+# - copy:
+#     dest: /var/www/html/{{ sample_com_challenge['challenge_data']['sample.com']['http-01']['resource'] }}
+#     content: "{{ sample_com_challenge['challenge_data']['sample.com']['http-01']['resource_value'] }}"
+#   when: sample_com_challenge is changed and 'sample.com' in sample_com_challenge['challenge_data']
+#
+# Alternative way:
+#
+# - copy:
+#     dest: /var/www/{{ item.key }}/{{ item.value['http-01']['resource'] }}
+#     content: "{{ item.value['http-01']['resource_value'] }}"
+#   loop: "{{ sample_com_challenge.challenge_data | dict2items }}"
+#   when: sample_com_challenge is changed
 
-- name: Let the challenge be validated and retrieve the cert and intermediate certificate
-  community.crypto.acme_certificate:
-    account_key_src: /etc/pki/cert/private/account.key
-    csr: /etc/pki/cert/csr/sample.com.csr
-    dest: /etc/httpd/ssl/sample.com.crt
-    fullchain_dest: /etc/httpd/ssl/sample.com-fullchain.crt
-    chain_dest: /etc/httpd/ssl/sample.com-intermediate.crt
-    data: "{{ sample_com_challenge }}"
+- name: Let the challenge be validated and retrieve the cert and intermediate certificate
+  community.crypto.acme_certificate:
+    account_key_src: /etc/pki/cert/private/account.key
+    csr: /etc/pki/cert/csr/sample.com.csr
+    dest: /etc/httpd/ssl/sample.com.crt
+    fullchain_dest: /etc/httpd/ssl/sample.com-fullchain.crt
+    chain_dest: /etc/httpd/ssl/sample.com-intermediate.crt
+    data: "{{ sample_com_challenge }}"
 
-### Example with DNS challenge against production ACME server ###
+### Example with DNS challenge against production ACME server ###
 
-- name: Create a challenge for sample.com using a account key file.
-  community.crypto.acme_certificate:
-    account_key_src: /etc/pki/cert/private/account.key
-    account_email: myself@sample.com
-    src: /etc/pki/cert/csr/sample.com.csr
-    cert: /etc/httpd/ssl/sample.com.crt
-    challenge: dns-01
-    acme_directory: https://acme-v01.api.letsencrypt.org/directory
-    # Renew if the certificate is at least 30 days old
-    remaining_days: 60
-  register: sample_com_challenge
+- name: Create a challenge for sample.com using a account key file.
+  community.crypto.acme_certificate:
+    account_key_src: /etc/pki/cert/private/account.key
+    account_email: myself@sample.com
+    src: /etc/pki/cert/csr/sample.com.csr
+    cert: /etc/httpd/ssl/sample.com.crt
+    challenge: dns-01
+    acme_directory: https://acme-v01.api.letsencrypt.org/directory
+    # Renew if the certificate is at least 30 days old
+    remaining_days: 60
+  register: sample_com_challenge
 
-# perform the necessary steps to fulfill the challenge
-# for example:
-#
-# - community.aws.route53:
-#     zone: sample.com
-#     record: "{{ sample_com_challenge.challenge_data['sample.com']['dns-01'].record }}"
-#     type: TXT
-#     ttl: 60
-#     state: present
-#     wait: true
-#     # Note: route53 requires TXT entries to be enclosed in quotes
-#     value: "{{ sample_com_challenge.challenge_data['sample.com']['dns-01'].resource_value | regex_replace('^(.*)$', '\"\\1\"') }}"
-#   when: sample_com_challenge is changed and 'sample.com' in sample_com_challenge.challenge_data
-#
-# Alternative way:
-#
-# - community.aws.route53:
-#     zone: sample.com
-#     record: "{{ item.key }}"
-#     type: TXT
-#     ttl: 60
-#     state: present
-#     wait: true
-#     # Note: item.value is a list of TXT entries, and route53
-#     # requires every entry to be enclosed in quotes
-#     value: "{{ item.value | map('regex_replace', '^(.*)$', '\"\\1\"' ) | list }}"
-#   loop: "{{ sample_com_challenge.challenge_data_dns | dict2items }}"
-#   when: sample_com_challenge is changed
+# perform the necessary steps to fulfill the challenge
+# for example:
+#
+# - community.aws.route53:
+#     zone: sample.com
+#     record: "{{ sample_com_challenge.challenge_data['sample.com']['dns-01'].record }}"
+#     type: TXT
+#     ttl: 60
+#     state: present
+#     wait: true
+#     # Note: route53 requires TXT entries to be enclosed in quotes
+#     value: "{{ sample_com_challenge.challenge_data['sample.com']['dns-01'].resource_value | regex_replace('^(.*)$', '\"\\1\"') }}"
+#   when: sample_com_challenge is changed and 'sample.com' in sample_com_challenge.challenge_data
+#
+# Alternative way:
+#
+# - community.aws.route53:
+#     zone: sample.com
+#     record: "{{ item.key }}"
+#     type: TXT
+#     ttl: 60
+#     state: present
+#     wait: true
+#     # Note: item.value is a list of TXT entries, and route53
+#     # requires every entry to be enclosed in quotes
+#     value: "{{ item.value | map('regex_replace', '^(.*)$', '\"\\1\"' ) | list }}"
+#   loop: "{{ sample_com_challenge.challenge_data_dns | dict2items }}"
+#   when: sample_com_challenge is changed
 
-- name: Let the challenge be validated and retrieve the cert and intermediate certificate
-  community.crypto.acme_certificate:
-    account_key_src: /etc/pki/cert/private/account.key
-    account_email: myself@sample.com
-    src: /etc/pki/cert/csr/sample.com.csr
-    cert: /etc/httpd/ssl/sample.com.crt
-    fullchain: /etc/httpd/ssl/sample.com-fullchain.crt
-    chain: /etc/httpd/ssl/sample.com-intermediate.crt
-    challenge: dns-01
-    acme_directory: https://acme-v01.api.letsencrypt.org/directory
-    remaining_days: 60
-    data: "{{ sample_com_challenge }}"
-  when: sample_com_challenge is changed
+- name: Let the challenge be validated and retrieve the cert and intermediate certificate
+  community.crypto.acme_certificate:
+    account_key_src: /etc/pki/cert/private/account.key
+    account_email: myself@sample.com
+    src: /etc/pki/cert/csr/sample.com.csr
+    cert: /etc/httpd/ssl/sample.com.crt
+    fullchain: /etc/httpd/ssl/sample.com-fullchain.crt
+    chain: /etc/httpd/ssl/sample.com-intermediate.crt
+    challenge: dns-01
+    acme_directory: https://acme-v01.api.letsencrypt.org/directory
+    remaining_days: 60
+    data: "{{ sample_com_challenge }}"
+  when: sample_com_challenge is changed
 
-# Alternative second step:
-- name: Let the challenge be validated and retrieve the cert and intermediate certificate
-  community.crypto.acme_certificate:
-    account_key_src: /etc/pki/cert/private/account.key
-    account_email: myself@sample.com
-    src: /etc/pki/cert/csr/sample.com.csr
-    cert: /etc/httpd/ssl/sample.com.crt
-    fullchain: /etc/httpd/ssl/sample.com-fullchain.crt
-    chain: /etc/httpd/ssl/sample.com-intermediate.crt
-    challenge: tls-alpn-01
-    remaining_days: 60
-    data: "{{ sample_com_challenge }}"
-    # We use Let's Encrypt's ACME v2 endpoint
-    acme_directory: https://acme-v02.api.letsencrypt.org/directory
-    acme_version: 2
-    # The following makes sure that if a chain with /CN=DST Root CA X3 in its issuer is provided
-    # as an alternative, it will be selected. These are the roots cross-signed by IdenTrust.
-    # As long as Let's Encrypt provides alternate chains with the cross-signed root(s) when
-    # switching to their own ISRG Root X1 root, this will use the chain ending with a cross-signed
-    # root. This chain is more compatible with older TLS clients.
-    select_chain:
-      - test_certificates: last
-        issuer:
-          CN: DST Root CA X3
-          O: Digital Signature Trust Co.
-  when: sample_com_challenge is changed
+# Alternative second step:
+- name: Let the challenge be validated and retrieve the cert and intermediate certificate
+  community.crypto.acme_certificate:
+    account_key_src: /etc/pki/cert/private/account.key
+    account_email: myself@sample.com
+    src: /etc/pki/cert/csr/sample.com.csr
+    cert: /etc/httpd/ssl/sample.com.crt
+    fullchain: /etc/httpd/ssl/sample.com-fullchain.crt
+    chain: /etc/httpd/ssl/sample.com-intermediate.crt
+    challenge: tls-alpn-01
+    remaining_days: 60
+    data: "{{ sample_com_challenge }}"
+    # We use Let's Encrypt's ACME v2 endpoint
+    acme_directory: https://acme-v02.api.letsencrypt.org/directory
+    acme_version: 2
+    # The following makes sure that if a chain with /CN=DST Root CA X3 in its issuer is provided
+    # as an alternative, it will be selected. These are the roots cross-signed by IdenTrust.
+    # As long as Let's Encrypt provides alternate chains with the cross-signed root(s) when
+    # switching to their own ISRG Root X1 root, this will use the chain ending with a cross-signed
+    # root. This chain is more compatible with older TLS clients.
+    select_chain:
+      - test_certificates: last
+        issuer:
+          CN: DST Root CA X3
+          O: Digital Signature Trust Co.
+  when: sample_com_challenge is changed
 

 

 
diff --git a/branch/main/acme_certificate_revoke_module.html b/branch/main/acme_certificate_revoke_module.html
index 0739319d..a735f6a4 100644
--- a/branch/main/acme_certificate_revoke_module.html
+++ b/branch/main/acme_certificate_revoke_module.html
@@ -419,15 +419,15 @@ see 
 
Examples

-
- name: Revoke certificate with account key
-  community.crypto.acme_certificate_revoke:
-    account_key_src: /etc/pki/cert/private/account.key
-    certificate: /etc/httpd/ssl/sample.com.crt
+
- name: Revoke certificate with account key
+  community.crypto.acme_certificate_revoke:
+    account_key_src: /etc/pki/cert/private/account.key
+    certificate: /etc/httpd/ssl/sample.com.crt
 
-- name: Revoke certificate with certificate's private key
-  community.crypto.acme_certificate_revoke:
-    private_key_src: /etc/httpd/ssl/sample.com.key
-    certificate: /etc/httpd/ssl/sample.com.crt
+- name: Revoke certificate with certificate's private key
+  community.crypto.acme_certificate_revoke:
+    private_key_src: /etc/httpd/ssl/sample.com.key
+    certificate: /etc/httpd/ssl/sample.com.crt
 

 

 

diff --git a/branch/main/acme_challenge_cert_helper_module.html b/branch/main/acme_challenge_cert_helper_module.html
index 5d492f34..933e4c0f 100644
--- a/branch/main/acme_challenge_cert_helper_module.html
+++ b/branch/main/acme_challenge_cert_helper_module.html
@@ -293,45 +293,45 @@ see 
 
Examples

-
- name: Create challenges for a given CRT for sample.com
-  community.crypto.acme_certificate:
-    account_key_src: /etc/pki/cert/private/account.key
-    challenge: tls-alpn-01
-    csr: /etc/pki/cert/csr/sample.com.csr
-    dest: /etc/httpd/ssl/sample.com.crt
-  register: sample_com_challenge
+
- name: Create challenges for a given CRT for sample.com
+  community.crypto.acme_certificate:
+    account_key_src: /etc/pki/cert/private/account.key
+    challenge: tls-alpn-01
+    csr: /etc/pki/cert/csr/sample.com.csr
+    dest: /etc/httpd/ssl/sample.com.crt
+  register: sample_com_challenge
 
-- name: Create certificates for challenges
-  community.crypto.acme_challenge_cert_helper:
-    challenge: tls-alpn-01
-    challenge_data: "{{ item.value['tls-alpn-01'] }}"
-    private_key_src: /etc/pki/cert/key/sample.com.key
-  loop: "{{ sample_com_challenge.challenge_data | dictsort }}"
-  register: sample_com_challenge_certs
+- name: Create certificates for challenges
+  community.crypto.acme_challenge_cert_helper:
+    challenge: tls-alpn-01
+    challenge_data: "{{ item.value['tls-alpn-01'] }}"
+    private_key_src: /etc/pki/cert/key/sample.com.key
+  loop: "{{ sample_com_challenge.challenge_data | dictsort }}"
+  register: sample_com_challenge_certs
 
-- name: Install challenge certificates
-  # We need to set up HTTPS such that for the domain,
-  # regular_certificate is delivered for regular connections,
-  # except if ALPN selects the "acme-tls/1"; then, the
-  # challenge_certificate must be delivered.
-  # This can for example be achieved with very new versions
-  # of NGINX; search for ssl_preread and
-  # ssl_preread_alpn_protocols for information on how to
-  # route by ALPN protocol.
-  ...:
-    domain: "{{ item.domain }}"
-    challenge_certificate: "{{ item.challenge_certificate }}"
-    regular_certificate: "{{ item.regular_certificate }}"
-    private_key: /etc/pki/cert/key/sample.com.key
-  loop: "{{ sample_com_challenge_certs.results }}"
+- name: Install challenge certificates
+  # We need to set up HTTPS such that for the domain,
+  # regular_certificate is delivered for regular connections,
+  # except if ALPN selects the "acme-tls/1"; then, the
+  # challenge_certificate must be delivered.
+  # This can for example be achieved with very new versions
+  # of NGINX; search for ssl_preread and
+  # ssl_preread_alpn_protocols for information on how to
+  # route by ALPN protocol.
+  ...:
+    domain: "{{ item.domain }}"
+    challenge_certificate: "{{ item.challenge_certificate }}"
+    regular_certificate: "{{ item.regular_certificate }}"
+    private_key: /etc/pki/cert/key/sample.com.key
+  loop: "{{ sample_com_challenge_certs.results }}"
 
-- name: Create certificate for a given CSR for sample.com
-  community.crypto.acme_certificate:
-    account_key_src: /etc/pki/cert/private/account.key
-    challenge: tls-alpn-01
-    csr: /etc/pki/cert/csr/sample.com.csr
-    dest: /etc/httpd/ssl/sample.com.crt
-    data: "{{ sample_com_challenge }}"
+- name: Create certificate for a given CSR for sample.com
+  community.crypto.acme_certificate:
+    account_key_src: /etc/pki/cert/private/account.key
+    challenge: tls-alpn-01
+    csr: /etc/pki/cert/csr/sample.com.csr
+    dest: /etc/httpd/ssl/sample.com.crt
+    data: "{{ sample_com_challenge }}"
 

 

 

diff --git a/branch/main/acme_inspect_module.html b/branch/main/acme_inspect_module.html
index 328c60d8..5952d65a 100644
--- a/branch/main/acme_inspect_module.html
+++ b/branch/main/acme_inspect_module.html
@@ -424,103 +424,103 @@ see 
 
Examples

-
- name: Get directory
-  community.crypto.acme_inspect:
-    acme_directory: https://acme-staging-v02.api.letsencrypt.org/directory
-    acme_version: 2
-    method: directory-only
-  register: directory
+
- name: Get directory
+  community.crypto.acme_inspect:
+    acme_directory: https://acme-staging-v02.api.letsencrypt.org/directory
+    acme_version: 2
+    method: directory-only
+  register: directory
 
-- name: Create an account
-  community.crypto.acme_inspect:
-    acme_directory: https://acme-staging-v02.api.letsencrypt.org/directory
-    acme_version: 2
-    account_key_src: /etc/pki/cert/private/account.key
-    url: "{{ directory.newAccount}}"
-    method: post
-    content: '{"termsOfServiceAgreed":true}'
-  register: account_creation
-  # account_creation.headers.location contains the account URI
-  # if creation was successful
+- name: Create an account
+  community.crypto.acme_inspect:
+    acme_directory: https://acme-staging-v02.api.letsencrypt.org/directory
+    acme_version: 2
+    account_key_src: /etc/pki/cert/private/account.key
+    url: "{{ directory.newAccount}}"
+    method: post
+    content: '{"termsOfServiceAgreed":true}'
+  register: account_creation
+  # account_creation.headers.location contains the account URI
+  # if creation was successful
 
-- name: Get account information
-  community.crypto.acme_inspect:
-    acme_directory: https://acme-staging-v02.api.letsencrypt.org/directory
-    acme_version: 2
-    account_key_src: /etc/pki/cert/private/account.key
-    account_uri: "{{ account_creation.headers.location }}"
-    url: "{{ account_creation.headers.location }}"
-    method: get
+- name: Get account information
+  community.crypto.acme_inspect:
+    acme_directory: https://acme-staging-v02.api.letsencrypt.org/directory
+    acme_version: 2
+    account_key_src: /etc/pki/cert/private/account.key
+    account_uri: "{{ account_creation.headers.location }}"
+    url: "{{ account_creation.headers.location }}"
+    method: get
 
-- name: Update account contacts
-  community.crypto.acme_inspect:
-    acme_directory: https://acme-staging-v02.api.letsencrypt.org/directory
-    acme_version: 2
-    account_key_src: /etc/pki/cert/private/account.key
-    account_uri: "{{ account_creation.headers.location }}"
-    url: "{{ account_creation.headers.location }}"
-    method: post
-    content: '{{ account_info | to_json }}'
-  vars:
-    account_info:
-      # For valid values, see
-      # https://tools.ietf.org/html/rfc8555#section-7.3
-      contact:
-      - mailto:me@example.com
+- name: Update account contacts
+  community.crypto.acme_inspect:
+    acme_directory: https://acme-staging-v02.api.letsencrypt.org/directory
+    acme_version: 2
+    account_key_src: /etc/pki/cert/private/account.key
+    account_uri: "{{ account_creation.headers.location }}"
+    url: "{{ account_creation.headers.location }}"
+    method: post
+    content: '{{ account_info | to_json }}'
+  vars:
+    account_info:
+      # For valid values, see
+      # https://tools.ietf.org/html/rfc8555#section-7.3
+      contact:
+      - mailto:me@example.com
 
-- name: Create certificate order
-  community.crypto.acme_certificate:
-    acme_directory: https://acme-staging-v02.api.letsencrypt.org/directory
-    acme_version: 2
-    account_key_src: /etc/pki/cert/private/account.key
-    account_uri: "{{ account_creation.headers.location }}"
-    csr: /etc/pki/cert/csr/sample.com.csr
-    fullchain_dest: /etc/httpd/ssl/sample.com-fullchain.crt
-    challenge: http-01
-  register: certificate_request
+- name: Create certificate order
+  community.crypto.acme_certificate:
+    acme_directory: https://acme-staging-v02.api.letsencrypt.org/directory
+    acme_version: 2
+    account_key_src: /etc/pki/cert/private/account.key
+    account_uri: "{{ account_creation.headers.location }}"
+    csr: /etc/pki/cert/csr/sample.com.csr
+    fullchain_dest: /etc/httpd/ssl/sample.com-fullchain.crt
+    challenge: http-01
+  register: certificate_request
 
-# Assume something went wrong. certificate_request.order_uri contains
-# the order URI.
+# Assume something went wrong. certificate_request.order_uri contains
+# the order URI.
 
-- name: Get order information
-  community.crypto.acme_inspect:
-    acme_directory: https://acme-staging-v02.api.letsencrypt.org/directory
-    acme_version: 2
-    account_key_src: /etc/pki/cert/private/account.key
-    account_uri: "{{ account_creation.headers.location }}"
-    url: "{{ certificate_request.order_uri }}"
-    method: get
-  register: order
+- name: Get order information
+  community.crypto.acme_inspect:
+    acme_directory: https://acme-staging-v02.api.letsencrypt.org/directory
+    acme_version: 2
+    account_key_src: /etc/pki/cert/private/account.key
+    account_uri: "{{ account_creation.headers.location }}"
+    url: "{{ certificate_request.order_uri }}"
+    method: get
+  register: order
 
-- name: Get first authz for order
-  community.crypto.acme_inspect:
-    acme_directory: https://acme-staging-v02.api.letsencrypt.org/directory
-    acme_version: 2
-    account_key_src: /etc/pki/cert/private/account.key
-    account_uri: "{{ account_creation.headers.location }}"
-    url: "{{ order.output_json.authorizations[0] }}"
-    method: get
-  register: authz
+- name: Get first authz for order
+  community.crypto.acme_inspect:
+    acme_directory: https://acme-staging-v02.api.letsencrypt.org/directory
+    acme_version: 2
+    account_key_src: /etc/pki/cert/private/account.key
+    account_uri: "{{ account_creation.headers.location }}"
+    url: "{{ order.output_json.authorizations[0] }}"
+    method: get
+  register: authz
 
-- name: Get HTTP-01 challenge for authz
-  community.crypto.acme_inspect:
-    acme_directory: https://acme-staging-v02.api.letsencrypt.org/directory
-    acme_version: 2
-    account_key_src: /etc/pki/cert/private/account.key
-    account_uri: "{{ account_creation.headers.location }}"
-    url: "{{ authz.output_json.challenges | selectattr('type', 'equalto', 'http-01') }}"
-    method: get
-  register: http01challenge
+- name: Get HTTP-01 challenge for authz
+  community.crypto.acme_inspect:
+    acme_directory: https://acme-staging-v02.api.letsencrypt.org/directory
+    acme_version: 2
+    account_key_src: /etc/pki/cert/private/account.key
+    account_uri: "{{ account_creation.headers.location }}"
+    url: "{{ authz.output_json.challenges | selectattr('type', 'equalto', 'http-01') }}"
+    method: get
+  register: http01challenge
 
-- name: Activate HTTP-01 challenge manually
-  community.crypto.acme_inspect:
-    acme_directory: https://acme-staging-v02.api.letsencrypt.org/directory
-    acme_version: 2
-    account_key_src: /etc/pki/cert/private/account.key
-    account_uri: "{{ account_creation.headers.location }}"
-    url: "{{ http01challenge.url }}"
-    method: post
-    content: '{}'
+- name: Activate HTTP-01 challenge manually
+  community.crypto.acme_inspect:
+    acme_directory: https://acme-staging-v02.api.letsencrypt.org/directory
+    acme_version: 2
+    account_key_src: /etc/pki/cert/private/account.key
+    account_uri: "{{ account_creation.headers.location }}"
+    url: "{{ http01challenge.url }}"
+    method: post
+    content: '{}'
 

 

 
diff --git a/branch/main/certificate_complete_chain_module.html b/branch/main/certificate_complete_chain_module.html
index 3d998f41..c4dcd4b9 100644
--- a/branch/main/certificate_complete_chain_module.html
+++ b/branch/main/certificate_complete_chain_module.html
@@ -267,37 +267,37 @@ see 
 
Examples

-
# Given a leaf certificate for www.ansible.com and one or more intermediate
-# certificates, finds the associated root certificate.
-- name: Find root certificate
-  community.crypto.certificate_complete_chain:
-    input_chain: "{{ lookup('file', '/etc/ssl/csr/www.ansible.com-fullchain.pem') }}"
-    root_certificates:
-    - /etc/ca-certificates/
-  register: www_ansible_com
-- name: Write root certificate to disk
-  copy:
-    dest: /etc/ssl/csr/www.ansible.com-root.pem
-    content: "{{ www_ansible_com.root }}"
+
# Given a leaf certificate for www.ansible.com and one or more intermediate
+# certificates, finds the associated root certificate.
+- name: Find root certificate
+  community.crypto.certificate_complete_chain:
+    input_chain: "{{ lookup('file', '/etc/ssl/csr/www.ansible.com-fullchain.pem') }}"
+    root_certificates:
+    - /etc/ca-certificates/
+  register: www_ansible_com
+- name: Write root certificate to disk
+  copy:
+    dest: /etc/ssl/csr/www.ansible.com-root.pem
+    content: "{{ www_ansible_com.root }}"
 
-# Given a leaf certificate for www.ansible.com, and a list of intermediate
-# certificates, finds the associated root certificate.
-- name: Find root certificate
-  community.crypto.certificate_complete_chain:
-    input_chain: "{{ lookup('file', '/etc/ssl/csr/www.ansible.com.pem') }}"
-    intermediate_certificates:
-    - /etc/ssl/csr/www.ansible.com-chain.pem
-    root_certificates:
-    - /etc/ca-certificates/
-  register: www_ansible_com
-- name: Write complete chain to disk
-  copy:
-    dest: /etc/ssl/csr/www.ansible.com-completechain.pem
-    content: "{{ ''.join(www_ansible_com.complete_chain) }}"
-- name: Write root chain (intermediates and root) to disk
-  copy:
-    dest: /etc/ssl/csr/www.ansible.com-rootchain.pem
-    content: "{{ ''.join(www_ansible_com.chain) }}"
+# Given a leaf certificate for www.ansible.com, and a list of intermediate
+# certificates, finds the associated root certificate.
+- name: Find root certificate
+  community.crypto.certificate_complete_chain:
+    input_chain: "{{ lookup('file', '/etc/ssl/csr/www.ansible.com.pem') }}"
+    intermediate_certificates:
+    - /etc/ssl/csr/www.ansible.com-chain.pem
+    root_certificates:
+    - /etc/ca-certificates/
+  register: www_ansible_com
+- name: Write complete chain to disk
+  copy:
+    dest: /etc/ssl/csr/www.ansible.com-completechain.pem
+    content: "{{ ''.join(www_ansible_com.complete_chain) }}"
+- name: Write root chain (intermediates and root) to disk
+  copy:
+    dest: /etc/ssl/csr/www.ansible.com-rootchain.pem
+    content: "{{ ''.join(www_ansible_com.chain) }}"
 

 

 
diff --git a/branch/main/crypto_info_module.html b/branch/main/crypto_info_module.html
index 40cabb91..3f148a58 100644
--- a/branch/main/crypto_info_module.html
+++ b/branch/main/crypto_info_module.html
@@ -213,14 +213,14 @@
 
 

 
Examples

-
- name: Retrieve information
-  community.crypto.crypto_info:
-    account_key_src: /etc/pki/cert/private/account.key
-  register: crypto_information
+
- name: Retrieve information
+  community.crypto.crypto_info:
+    account_key_src: /etc/pki/cert/private/account.key
+  register: crypto_information
 
-- name: Show retrieved information
-  ansible.builtin.debug:
-    var: crypto_information
+- name: Show retrieved information
+  ansible.builtin.debug:
+    var: crypto_information
 

 

 

diff --git a/branch/main/docsite/guide_ownca.html b/branch/main/docsite/guide_ownca.html
index abbaf124..0b36f36c 100644
--- a/branch/main/docsite/guide_ownca.html
+++ b/branch/main/docsite/guide_ownca.html
@@ -156,32 +156,32 @@
 
Set up the CA

 
Any certificate can be used as a CA certificate. You can create a self-signed certificate (see How to create self-signed certificates), use another CA certificate to sign a new certificate (using the instructions below for signing a certificate), ask (and pay) a commercial CA to sign your CA certificate, etc.

 
The following instructions show how to set up a simple self-signed CA certificate.

-
- name: Create private key with password protection
-  community.crypto.openssl_privatekey:
-    path: /path/to/ca-certificate.key
-    passphrase: "{{ secret_ca_passphrase }}"
+
- name: Create private key with password protection
+  community.crypto.openssl_privatekey:
+    path: /path/to/ca-certificate.key
+    passphrase: "{{ secret_ca_passphrase }}"
 
-- name: Create certificate signing request (CSR) for CA certificate
-  community.crypto.openssl_csr_pipe:
-    privatekey_path: /path/to/ca-certificate.key
-    privatekey_passphrase: "{{ secret_ca_passphrase }}"
-    common_name: Ansible CA
-    use_common_name_for_san: false  # since we do not specify SANs, don't use CN as a SAN
-    basic_constraints:
-      - 'CA:TRUE'
-    basic_constraints_critical: true
-    key_usage:
-      - keyCertSign
-    key_usage_critical: true
-  register: ca_csr
+- name: Create certificate signing request (CSR) for CA certificate
+  community.crypto.openssl_csr_pipe:
+    privatekey_path: /path/to/ca-certificate.key
+    privatekey_passphrase: "{{ secret_ca_passphrase }}"
+    common_name: Ansible CA
+    use_common_name_for_san: false  # since we do not specify SANs, don't use CN as a SAN
+    basic_constraints:
+      - 'CA:TRUE'
+    basic_constraints_critical: true
+    key_usage:
+      - keyCertSign
+    key_usage_critical: true
+  register: ca_csr
 
-- name: Create self-signed CA certificate from CSR
-  community.crypto.x509_certificate:
-    path: /path/to/ca-certificate.pem
-    csr_content: "{{ ca_csr.csr }}"
-    privatekey_path: /path/to/ca-certificate.key
-    privatekey_passphrase: "{{ secret_ca_passphrase }}"
-    provider: selfsigned
+- name: Create self-signed CA certificate from CSR
+  community.crypto.x509_certificate:
+    path: /path/to/ca-certificate.pem
+    csr_content: "{{ ca_csr.csr }}"
+    privatekey_path: /path/to/ca-certificate.key
+    privatekey_passphrase: "{{ secret_ca_passphrase }}"
+    provider: selfsigned
 

 

 
@@ -189,98 +189,98 @@
 
Use the CA to sign a certificate

 
To sign a certificate, you must pass a CSR to the community.crypto.x509_certificate module or community.crypto.x509_certificate_pipe module.

 
In the following example, we assume that the certificate to sign (including its private key) are on server_1, while our CA certificate is on server_2. We do not want any key material to leave each respective server.

-
- name: Create private key for new certificate on server_1
-  community.crypto.openssl_privatekey:
-    path: /path/to/certificate.key
-  delegate_to: server_1
-  run_once: true
+
- name: Create private key for new certificate on server_1
+  community.crypto.openssl_privatekey:
+    path: /path/to/certificate.key
+  delegate_to: server_1
+  run_once: true
 
-- name: Create certificate signing request (CSR) for new certificate
-  community.crypto.openssl_csr_pipe:
-    privatekey_path: /path/to/certificate.key
-    subject_alt_name:
-      - "DNS:ansible.com"
-      - "DNS:www.ansible.com"
-      - "DNS:docs.ansible.com"
-  delegate_to: server_1
-  run_once: true
-  register: csr
+- name: Create certificate signing request (CSR) for new certificate
+  community.crypto.openssl_csr_pipe:
+    privatekey_path: /path/to/certificate.key
+    subject_alt_name:
+      - "DNS:ansible.com"
+      - "DNS:www.ansible.com"
+      - "DNS:docs.ansible.com"
+  delegate_to: server_1
+  run_once: true
+  register: csr
 
-- name: Sign certificate with our CA
-  community.crypto.x509_certificate_pipe:
-    csr_content: "{{ csr.csr }}"
-    provider: ownca
-    ownca_path: /path/to/ca-certificate.pem
-    ownca_privatekey_path: /path/to/ca-certificate.key
-    ownca_privatekey_passphrase: "{{ secret_ca_passphrase }}"
-    ownca_not_after: +365d  # valid for one year
-    ownca_not_before: "-1d"  # valid since yesterday
-  delegate_to: server_2
-  run_once: true
-  register: certificate
+- name: Sign certificate with our CA
+  community.crypto.x509_certificate_pipe:
+    csr_content: "{{ csr.csr }}"
+    provider: ownca
+    ownca_path: /path/to/ca-certificate.pem
+    ownca_privatekey_path: /path/to/ca-certificate.key
+    ownca_privatekey_passphrase: "{{ secret_ca_passphrase }}"
+    ownca_not_after: +365d  # valid for one year
+    ownca_not_before: "-1d"  # valid since yesterday
+  delegate_to: server_2
+  run_once: true
+  register: certificate
 
-- name: Write certificate file on server_1
-  copy:
-    dest: /path/to/certificate.pem
-    content: "{{ certificate.certificate }}"
-  delegate_to: server_1
-  run_once: true
+- name: Write certificate file on server_1
+  copy:
+    dest: /path/to/certificate.pem
+    content: "{{ certificate.certificate }}"
+  delegate_to: server_1
+  run_once: true
 

 

 
Please note that the above procedure is not idempotent. The following extended example reads the existing certificate from server_1 (if exists) and provides it to the community.crypto.x509_certificate_pipe module, and only writes the result back if it was changed:

-
- name: Create private key for new certificate on server_1
-  community.crypto.openssl_privatekey:
-    path: /path/to/certificate.key
-  delegate_to: server_1
-  run_once: true
+
- name: Create private key for new certificate on server_1
+  community.crypto.openssl_privatekey:
+    path: /path/to/certificate.key
+  delegate_to: server_1
+  run_once: true
 
-- name: Create certificate signing request (CSR) for new certificate
-  community.crypto.openssl_csr_pipe:
-    privatekey_path: /path/to/certificate.key
-    subject_alt_name:
-      - "DNS:ansible.com"
-      - "DNS:www.ansible.com"
-      - "DNS:docs.ansible.com"
-  delegate_to: server_1
-  run_once: true
-  register: csr
+- name: Create certificate signing request (CSR) for new certificate
+  community.crypto.openssl_csr_pipe:
+    privatekey_path: /path/to/certificate.key
+    subject_alt_name:
+      - "DNS:ansible.com"
+      - "DNS:www.ansible.com"
+      - "DNS:docs.ansible.com"
+  delegate_to: server_1
+  run_once: true
+  register: csr
 
-- name: Check whether certificate exists
-  stat:
-    path: /path/to/certificate.pem
-  delegate_to: server_1
-  run_once: true
-  register: certificate_exists
+- name: Check whether certificate exists
+  stat:
+    path: /path/to/certificate.pem
+  delegate_to: server_1
+  run_once: true
+  register: certificate_exists
 
-- name: Read existing certificate if exists
-  slurp:
-    src: /path/to/certificate.pem
-  when: certificate_exists.stat.exists
-  delegate_to: server_1
-  run_once: true
-  register: certificate
+- name: Read existing certificate if exists
+  slurp:
+    src: /path/to/certificate.pem
+  when: certificate_exists.stat.exists
+  delegate_to: server_1
+  run_once: true
+  register: certificate
 
-- name: Sign certificate with our CA
-  community.crypto.x509_certificate_pipe:
-    content: "{{ (certificate.content | b64decode) if certificate_exists.stat.exists else omit }}"
-    csr_content: "{{ csr.csr }}"
-    provider: ownca
-    ownca_path: /path/to/ca-certificate.pem
-    ownca_privatekey_path: /path/to/ca-certificate.key
-    ownca_privatekey_passphrase: "{{ secret_ca_passphrase }}"
-    ownca_not_after: +365d  # valid for one year
-    ownca_not_before: "-1d"  # valid since yesterday
-  delegate_to: server_2
-  run_once: true
-  register: certificate
+- name: Sign certificate with our CA
+  community.crypto.x509_certificate_pipe:
+    content: "{{ (certificate.content | b64decode) if certificate_exists.stat.exists else omit }}"
+    csr_content: "{{ csr.csr }}"
+    provider: ownca
+    ownca_path: /path/to/ca-certificate.pem
+    ownca_privatekey_path: /path/to/ca-certificate.key
+    ownca_privatekey_passphrase: "{{ secret_ca_passphrase }}"
+    ownca_not_after: +365d  # valid for one year
+    ownca_not_before: "-1d"  # valid since yesterday
+  delegate_to: server_2
+  run_once: true
+  register: certificate
 
-- name: Write certificate file on server_1
-  copy:
-    dest: /path/to/certificate.pem
-    content: "{{ certificate.certificate }}"
-  delegate_to: server_1
-  run_once: true
-  when: certificate is changed
+- name: Write certificate file on server_1
+  copy:
+    dest: /path/to/certificate.pem
+    content: "{{ certificate.certificate }}"
+  delegate_to: server_1
+  run_once: true
+  when: certificate is changed
 

 

 
diff --git a/branch/main/docsite/guide_selfsigned.html b/branch/main/docsite/guide_selfsigned.html
index f0a09ab0..d68f63b0 100644
--- a/branch/main/docsite/guide_selfsigned.html
+++ b/branch/main/docsite/guide_selfsigned.html
@@ -148,47 +148,47 @@
 
How to create self-signed certificates

 
The community.crypto collection offers multiple modules that create private keys, certificate signing requests, and certificates. This guide shows how to create self-signed certificates.

 
For creating any kind of certificate, you always have to start with a private key. You can use the community.crypto.openssl_privatekey module to create a private key. If you only specify path, the default parameters will be used. This will result in a 4096 bit RSA private key:

-
- name: Create private key (RSA, 4096 bits)
-  community.crypto.openssl_privatekey:
-    path: /path/to/certificate.key
+
- name: Create private key (RSA, 4096 bits)
+  community.crypto.openssl_privatekey:
+    path: /path/to/certificate.key
 

 

 
You can specify type to select another key type, size to select a different key size (only available for RSA and DSA keys), or passphrase if you want to store the key password-protected:

-
- name: Create private key (X25519) with password protection
-  community.crypto.openssl_privatekey:
-    path: /path/to/certificate.key
-    type: X25519
-    passphrase: changeme
+
- name: Create private key (X25519) with password protection
+  community.crypto.openssl_privatekey:
+    path: /path/to/certificate.key
+    type: X25519
+    passphrase: changeme
 

 

 
To create a very simple self-signed certificate with no specific information, you can proceed directly with the community.crypto.x509_certificate module:

-
- name: Create simple self-signed certificate
-  community.crypto.x509_certificate:
-    path: /path/to/certificate.pem
-    privatekey_path: /path/to/certificate.key
-    provider: selfsigned
+
- name: Create simple self-signed certificate
+  community.crypto.x509_certificate:
+    path: /path/to/certificate.pem
+    privatekey_path: /path/to/certificate.key
+    provider: selfsigned
 

 

 
(If you used passphrase for the private key, you have to provide privatekey_passphrase.)

 
You can use selfsigned_not_after to define when the certificate expires (default: in roughly 10 years), and selfsigned_not_before to define from when the certificate is valid (default: now).

 
To define further properties of the certificate, like the subject, Subject Alternative Names (SANs), key usages, name constraints, etc., you need to first create a Certificate Signing Request (CSR) and provide it to the community.crypto.x509_certificate module. If you do not need the CSR file, you can use the community.crypto.openssl_csr_pipe module as in the example below. (To store it to disk, use the community.crypto.openssl_csr module instead.)

-
- name: Create certificate signing request (CSR) for self-signed certificate
-  community.crypto.openssl_csr_pipe:
-    privatekey_path: /path/to/certificate.key
-    common_name: ansible.com
-    organization_name: Ansible, Inc.
-    subject_alt_name:
-      - "DNS:ansible.com"
-      - "DNS:www.ansible.com"
-      - "DNS:docs.ansible.com"
-  register: csr
+
- name: Create certificate signing request (CSR) for self-signed certificate
+  community.crypto.openssl_csr_pipe:
+    privatekey_path: /path/to/certificate.key
+    common_name: ansible.com
+    organization_name: Ansible, Inc.
+    subject_alt_name:
+      - "DNS:ansible.com"
+      - "DNS:www.ansible.com"
+      - "DNS:docs.ansible.com"
+  register: csr
 
-- name: Create self-signed certificate from CSR
-  community.crypto.x509_certificate:
-    path: /path/to/certificate.pem
-    csr_content: "{{ csr.csr }}"
-    privatekey_path: /path/to/certificate.key
-    provider: selfsigned
+- name: Create self-signed certificate from CSR
+  community.crypto.x509_certificate:
+    path: /path/to/certificate.pem
+    csr_content: "{{ csr.csr }}"
+    privatekey_path: /path/to/certificate.key
+    provider: selfsigned
 

 

 
diff --git a/branch/main/ecs_certificate_module.html b/branch/main/ecs_certificate_module.html
index a21c5e74..3623dfbf 100644
--- a/branch/main/ecs_certificate_module.html
+++ b/branch/main/ecs_certificate_module.html
@@ -836,118 +836,118 @@ see 
 
Examples

-
- name: Request a new certificate from Entrust with bare minimum parameters.
-        Will request a new certificate if current one is valid but within 30
-        days of expiry. If replacing an existing file in path, will back it up.
-  community.crypto.ecs_certificate:
-    backup: true
-    path: /etc/ssl/crt/ansible.com.crt
-    full_chain_path: /etc/ssl/crt/ansible.com.chain.crt
-    csr: /etc/ssl/csr/ansible.com.csr
-    cert_type: EV_SSL
-    requester_name: Jo Doe
-    requester_email: jdoe@ansible.com
-    requester_phone: 555-555-5555
-    entrust_api_user: apiusername
-    entrust_api_key: a^lv*32!cd9LnT
-    entrust_api_client_cert_path: /etc/ssl/entrust/ecs-client.crt
-    entrust_api_client_cert_key_path: /etc/ssl/entrust/ecs-client.key
+
- name: Request a new certificate from Entrust with bare minimum parameters.
+        Will request a new certificate if current one is valid but within 30
+        days of expiry. If replacing an existing file in path, will back it up.
+  community.crypto.ecs_certificate:
+    backup: true
+    path: /etc/ssl/crt/ansible.com.crt
+    full_chain_path: /etc/ssl/crt/ansible.com.chain.crt
+    csr: /etc/ssl/csr/ansible.com.csr
+    cert_type: EV_SSL
+    requester_name: Jo Doe
+    requester_email: jdoe@ansible.com
+    requester_phone: 555-555-5555
+    entrust_api_user: apiusername
+    entrust_api_key: a^lv*32!cd9LnT
+    entrust_api_client_cert_path: /etc/ssl/entrust/ecs-client.crt
+    entrust_api_client_cert_key_path: /etc/ssl/entrust/ecs-client.key
 
-- name: If there is no certificate present in path, request a new certificate
-        of type EV_SSL. Otherwise, if there is an Entrust managed certificate
-        in path and it is within 63 days of expiration, request a renew of that
-        certificate.
-  community.crypto.ecs_certificate:
-    path: /etc/ssl/crt/ansible.com.crt
-    csr: /etc/ssl/csr/ansible.com.csr
-    cert_type: EV_SSL
-    cert_expiry: '2020-08-20'
-    request_type: renew
-    remaining_days: 63
-    requester_name: Jo Doe
-    requester_email: jdoe@ansible.com
-    requester_phone: 555-555-5555
-    entrust_api_user: apiusername
-    entrust_api_key: a^lv*32!cd9LnT
-    entrust_api_client_cert_path: /etc/ssl/entrust/ecs-client.crt
-    entrust_api_client_cert_key_path: /etc/ssl/entrust/ecs-client.key
+- name: If there is no certificate present in path, request a new certificate
+        of type EV_SSL. Otherwise, if there is an Entrust managed certificate
+        in path and it is within 63 days of expiration, request a renew of that
+        certificate.
+  community.crypto.ecs_certificate:
+    path: /etc/ssl/crt/ansible.com.crt
+    csr: /etc/ssl/csr/ansible.com.csr
+    cert_type: EV_SSL
+    cert_expiry: '2020-08-20'
+    request_type: renew
+    remaining_days: 63
+    requester_name: Jo Doe
+    requester_email: jdoe@ansible.com
+    requester_phone: 555-555-5555
+    entrust_api_user: apiusername
+    entrust_api_key: a^lv*32!cd9LnT
+    entrust_api_client_cert_path: /etc/ssl/entrust/ecs-client.crt
+    entrust_api_client_cert_key_path: /etc/ssl/entrust/ecs-client.key
 
-- name: If there is no certificate present in path, download certificate
-        specified by tracking_id if it is still valid. Otherwise, if the
-        certificate is within 79 days of expiration, request a renew of that
-        certificate and save it in path. This can be used to "migrate" a
-        certificate to be Ansible managed.
-  community.crypto.ecs_certificate:
-    path: /etc/ssl/crt/ansible.com.crt
-    csr: /etc/ssl/csr/ansible.com.csr
-    tracking_id: 2378915
-    request_type: renew
-    remaining_days: 79
-    entrust_api_user: apiusername
-    entrust_api_key: a^lv*32!cd9LnT
-    entrust_api_client_cert_path: /etc/ssl/entrust/ecs-client.crt
-    entrust_api_client_cert_key_path: /etc/ssl/entrust/ecs-client.key
+- name: If there is no certificate present in path, download certificate
+        specified by tracking_id if it is still valid. Otherwise, if the
+        certificate is within 79 days of expiration, request a renew of that
+        certificate and save it in path. This can be used to "migrate" a
+        certificate to be Ansible managed.
+  community.crypto.ecs_certificate:
+    path: /etc/ssl/crt/ansible.com.crt
+    csr: /etc/ssl/csr/ansible.com.csr
+    tracking_id: 2378915
+    request_type: renew
+    remaining_days: 79
+    entrust_api_user: apiusername
+    entrust_api_key: a^lv*32!cd9LnT
+    entrust_api_client_cert_path: /etc/ssl/entrust/ecs-client.crt
+    entrust_api_client_cert_key_path: /etc/ssl/entrust/ecs-client.key
 
-- name: Force a reissue of the certificate specified by tracking_id.
-  community.crypto.ecs_certificate:
-    path: /etc/ssl/crt/ansible.com.crt
-    force: true
-    tracking_id: 2378915
-    request_type: reissue
-    entrust_api_user: apiusername
-    entrust_api_key: a^lv*32!cd9LnT
-    entrust_api_client_cert_path: /etc/ssl/entrust/ecs-client.crt
-    entrust_api_client_cert_key_path: /etc/ssl/entrust/ecs-client.key
+- name: Force a reissue of the certificate specified by tracking_id.
+  community.crypto.ecs_certificate:
+    path: /etc/ssl/crt/ansible.com.crt
+    force: true
+    tracking_id: 2378915
+    request_type: reissue
+    entrust_api_user: apiusername
+    entrust_api_key: a^lv*32!cd9LnT
+    entrust_api_client_cert_path: /etc/ssl/entrust/ecs-client.crt
+    entrust_api_client_cert_key_path: /etc/ssl/entrust/ecs-client.key
 
-- name: Request a new certificate with an alternative client. Note that the
-        issued certificate will have it's Subject Distinguished Name use the
-        organization details associated with that client, rather than what is
-        in the CSR.
-  community.crypto.ecs_certificate:
-    path: /etc/ssl/crt/ansible.com.crt
-    csr: /etc/ssl/csr/ansible.com.csr
-    client_id: 2
-    requester_name: Jo Doe
-    requester_email: jdoe@ansible.com
-    requester_phone: 555-555-5555
-    entrust_api_user: apiusername
-    entrust_api_key: a^lv*32!cd9LnT
-    entrust_api_client_cert_path: /etc/ssl/entrust/ecs-client.crt
-    entrust_api_client_cert_key_path: /etc/ssl/entrust/ecs-client.key
+- name: Request a new certificate with an alternative client. Note that the
+        issued certificate will have it's Subject Distinguished Name use the
+        organization details associated with that client, rather than what is
+        in the CSR.
+  community.crypto.ecs_certificate:
+    path: /etc/ssl/crt/ansible.com.crt
+    csr: /etc/ssl/csr/ansible.com.csr
+    client_id: 2
+    requester_name: Jo Doe
+    requester_email: jdoe@ansible.com
+    requester_phone: 555-555-5555
+    entrust_api_user: apiusername
+    entrust_api_key: a^lv*32!cd9LnT
+    entrust_api_client_cert_path: /etc/ssl/entrust/ecs-client.crt
+    entrust_api_client_cert_key_path: /etc/ssl/entrust/ecs-client.key
 
-- name: Request a new certificate with a number of CSR parameters overridden
-        and tracking information
-  community.crypto.ecs_certificate:
-    path: /etc/ssl/crt/ansible.com.crt
-    full_chain_path: /etc/ssl/crt/ansible.com.chain.crt
-    csr: /etc/ssl/csr/ansible.com.csr
-    subject_alt_name:
-      - ansible.testcertificates.com
-      - www.testcertificates.com
-    eku: SERVER_AND_CLIENT_AUTH
-    ct_log: true
-    org: Test Organization Inc.
-    ou:
-      - Administration
-    tracking_info: "Submitted via Ansible"
-    additional_emails:
-      - itsupport@testcertificates.com
-      - jsmith@ansible.com
-    custom_fields:
-      text1: Admin
-      text2: Invoice 25
-      number1: 342
-      date1: '2018-01-01'
-      email1: sales@ansible.testcertificates.com
-      dropdown1: red
-    cert_expiry: '2020-08-15'
-    requester_name: Jo Doe
-    requester_email: jdoe@ansible.com
-    requester_phone: 555-555-5555
-    entrust_api_user: apiusername
-    entrust_api_key: a^lv*32!cd9LnT
-    entrust_api_client_cert_path: /etc/ssl/entrust/ecs-client.crt
-    entrust_api_client_cert_key_path: /etc/ssl/entrust/ecs-client.key
+- name: Request a new certificate with a number of CSR parameters overridden
+        and tracking information
+  community.crypto.ecs_certificate:
+    path: /etc/ssl/crt/ansible.com.crt
+    full_chain_path: /etc/ssl/crt/ansible.com.chain.crt
+    csr: /etc/ssl/csr/ansible.com.csr
+    subject_alt_name:
+      - ansible.testcertificates.com
+      - www.testcertificates.com
+    eku: SERVER_AND_CLIENT_AUTH
+    ct_log: true
+    org: Test Organization Inc.
+    ou:
+      - Administration
+    tracking_info: "Submitted via Ansible"
+    additional_emails:
+      - itsupport@testcertificates.com
+      - jsmith@ansible.com
+    custom_fields:
+      text1: Admin
+      text2: Invoice 25
+      number1: 342
+      date1: '2018-01-01'
+      email1: sales@ansible.testcertificates.com
+      dropdown1: red
+    cert_expiry: '2020-08-15'
+    requester_name: Jo Doe
+    requester_email: jdoe@ansible.com
+    requester_phone: 555-555-5555
+    entrust_api_user: apiusername
+    entrust_api_key: a^lv*32!cd9LnT
+    entrust_api_client_cert_path: /etc/ssl/entrust/ecs-client.crt
+    entrust_api_client_cert_key_path: /etc/ssl/entrust/ecs-client.key
 

 

 
diff --git a/branch/main/ecs_domain_module.html b/branch/main/ecs_domain_module.html
index 2200a86c..6231092b 100644
--- a/branch/main/ecs_domain_module.html
+++ b/branch/main/ecs_domain_module.html
@@ -351,45 +351,45 @@ see 
 
Examples

-
- name: Request domain validation using email validation for client ID of 2.
-  community.crypto.ecs_domain:
-    domain_name: ansible.com
-    client_id: 2
-    verification_method: email
-    verification_email: admin@ansible.com
-    entrust_api_user: apiusername
-    entrust_api_key: a^lv*32!cd9LnT
-    entrust_api_client_cert_path: /etc/ssl/entrust/ecs-client.crt
-    entrust_api_client_cert_key_path: /etc/ssl/entrust/ecs-client.key
+
- name: Request domain validation using email validation for client ID of 2.
+  community.crypto.ecs_domain:
+    domain_name: ansible.com
+    client_id: 2
+    verification_method: email
+    verification_email: admin@ansible.com
+    entrust_api_user: apiusername
+    entrust_api_key: a^lv*32!cd9LnT
+    entrust_api_client_cert_path: /etc/ssl/entrust/ecs-client.crt
+    entrust_api_client_cert_key_path: /etc/ssl/entrust/ecs-client.key
 
-- name: Request domain validation using DNS. If domain is already valid,
-        request revalidation if expires within 90 days
-  community.crypto.ecs_domain:
-    domain_name: ansible.com
-    verification_method: dns
-    entrust_api_user: apiusername
-    entrust_api_key: a^lv*32!cd9LnT
-    entrust_api_client_cert_path: /etc/ssl/entrust/ecs-client.crt
-    entrust_api_client_cert_key_path: /etc/ssl/entrust/ecs-client.key
+- name: Request domain validation using DNS. If domain is already valid,
+        request revalidation if expires within 90 days
+  community.crypto.ecs_domain:
+    domain_name: ansible.com
+    verification_method: dns
+    entrust_api_user: apiusername
+    entrust_api_key: a^lv*32!cd9LnT
+    entrust_api_client_cert_path: /etc/ssl/entrust/ecs-client.crt
+    entrust_api_client_cert_key_path: /etc/ssl/entrust/ecs-client.key
 
-- name: Request domain validation using web server validation, and revalidate
-        if fewer than 60 days remaining of EV eligibility.
-  community.crypto.ecs_domain:
-    domain_name: ansible.com
-    verification_method: web_server
-    entrust_api_user: apiusername
-    entrust_api_key: a^lv*32!cd9LnT
-    entrust_api_client_cert_path: /etc/ssl/entrust/ecs-client.crt
-    entrust_api_client_cert_key_path: /etc/ssl/entrust/ecs-client.key
+- name: Request domain validation using web server validation, and revalidate
+        if fewer than 60 days remaining of EV eligibility.
+  community.crypto.ecs_domain:
+    domain_name: ansible.com
+    verification_method: web_server
+    entrust_api_user: apiusername
+    entrust_api_key: a^lv*32!cd9LnT
+    entrust_api_client_cert_path: /etc/ssl/entrust/ecs-client.crt
+    entrust_api_client_cert_key_path: /etc/ssl/entrust/ecs-client.key
 
-- name: Request domain validation using manual validation.
-  community.crypto.ecs_domain:
-    domain_name: ansible.com
-    verification_method: manual
-    entrust_api_user: apiusername
-    entrust_api_key: a^lv*32!cd9LnT
-    entrust_api_client_cert_path: /etc/ssl/entrust/ecs-client.crt
-    entrust_api_client_cert_key_path: /etc/ssl/entrust/ecs-client.key
+- name: Request domain validation using manual validation.
+  community.crypto.ecs_domain:
+    domain_name: ansible.com
+    verification_method: manual
+    entrust_api_user: apiusername
+    entrust_api_key: a^lv*32!cd9LnT
+    entrust_api_client_cert_path: /etc/ssl/entrust/ecs-client.crt
+    entrust_api_client_cert_key_path: /etc/ssl/entrust/ecs-client.key
 

 

 
diff --git a/branch/main/get_certificate_module.html b/branch/main/get_certificate_module.html
index 15c4f027..a68d5dd4 100644
--- a/branch/main/get_certificate_module.html
+++ b/branch/main/get_certificate_module.html
@@ -330,27 +330,27 @@ see 
 
Examples

-
- name: Get the cert from an RDP port
-  community.crypto.get_certificate:
-    host: "1.2.3.4"
-    port: 3389
-  delegate_to: localhost
-  run_once: true
-  register: cert
+
- name: Get the cert from an RDP port
+  community.crypto.get_certificate:
+    host: "1.2.3.4"
+    port: 3389
+  delegate_to: localhost
+  run_once: true
+  register: cert
 
-- name: Get a cert from an https port
-  community.crypto.get_certificate:
-    host: "www.google.com"
-    port: 443
-  delegate_to: localhost
-  run_once: true
-  register: cert
+- name: Get a cert from an https port
+  community.crypto.get_certificate:
+    host: "www.google.com"
+    port: 443
+  delegate_to: localhost
+  run_once: true
+  register: cert
 
-- name: How many days until cert expires
-  debug:
-    msg: "cert expires in: {{ expire_days }} days."
-  vars:
-    expire_days: "{{ (( cert.not_after | to_datetime('%Y%m%d%H%M%SZ')) - (ansible_date_time.iso8601 | to_datetime('%Y-%m-%dT%H:%M:%SZ')) ).days }}"
+- name: How many days until cert expires
+  debug:
+    msg: "cert expires in: {{ expire_days }} days."
+  vars:
+    expire_days: "{{ (( cert.not_after | to_datetime('%Y%m%d%H%M%SZ')) - (ansible_date_time.iso8601 | to_datetime('%Y-%m-%dT%H:%M:%SZ')) ).days }}"
 

 

 
diff --git a/branch/main/luks_device_module.html b/branch/main/luks_device_module.html
index a97a7fa0..b595d602 100644
--- a/branch/main/luks_device_module.html
+++ b/branch/main/luks_device_module.html
@@ -534,103 +534,103 @@ see 
 
Examples

-
- name: Create LUKS container (remains unchanged if it already exists)
-  community.crypto.luks_device:
-    device: "/dev/loop0"
-    state: "present"
-    keyfile: "/vault/keyfile"
+
- name: Create LUKS container (remains unchanged if it already exists)
+  community.crypto.luks_device:
+    device: "/dev/loop0"
+    state: "present"
+    keyfile: "/vault/keyfile"
 
-- name: Create LUKS container with a passphrase
-  community.crypto.luks_device:
-    device: "/dev/loop0"
-    state: "present"
-    passphrase: "foo"
+- name: Create LUKS container with a passphrase
+  community.crypto.luks_device:
+    device: "/dev/loop0"
+    state: "present"
+    passphrase: "foo"
 
-- name: Create LUKS container with specific encryption
-  community.crypto.luks_device:
-    device: "/dev/loop0"
-    state: "present"
-    cipher: "aes"
-    hash: "sha256"
+- name: Create LUKS container with specific encryption
+  community.crypto.luks_device:
+    device: "/dev/loop0"
+    state: "present"
+    cipher: "aes"
+    hash: "sha256"
 
-- name: (Create and) open the LUKS container; name it "mycrypt"
-  community.crypto.luks_device:
-    device: "/dev/loop0"
-    state: "opened"
-    name: "mycrypt"
-    keyfile: "/vault/keyfile"
+- name: (Create and) open the LUKS container; name it "mycrypt"
+  community.crypto.luks_device:
+    device: "/dev/loop0"
+    state: "opened"
+    name: "mycrypt"
+    keyfile: "/vault/keyfile"
 
-- name: Close the existing LUKS container "mycrypt"
-  community.crypto.luks_device:
-    state: "closed"
-    name: "mycrypt"
+- name: Close the existing LUKS container "mycrypt"
+  community.crypto.luks_device:
+    state: "closed"
+    name: "mycrypt"
 
-- name: Make sure LUKS container exists and is closed
-  community.crypto.luks_device:
-    device: "/dev/loop0"
-    state: "closed"
-    keyfile: "/vault/keyfile"
+- name: Make sure LUKS container exists and is closed
+  community.crypto.luks_device:
+    device: "/dev/loop0"
+    state: "closed"
+    keyfile: "/vault/keyfile"
 
-- name: Create container if it does not exist and add new key to it
-  community.crypto.luks_device:
-    device: "/dev/loop0"
-    state: "present"
-    keyfile: "/vault/keyfile"
-    new_keyfile: "/vault/keyfile2"
+- name: Create container if it does not exist and add new key to it
+  community.crypto.luks_device:
+    device: "/dev/loop0"
+    state: "present"
+    keyfile: "/vault/keyfile"
+    new_keyfile: "/vault/keyfile2"
 
-- name: Add new key to the LUKS container (container has to exist)
-  community.crypto.luks_device:
-    device: "/dev/loop0"
-    keyfile: "/vault/keyfile"
-    new_keyfile: "/vault/keyfile2"
+- name: Add new key to the LUKS container (container has to exist)
+  community.crypto.luks_device:
+    device: "/dev/loop0"
+    keyfile: "/vault/keyfile"
+    new_keyfile: "/vault/keyfile2"
 
-- name: Add new passphrase to the LUKS container
-  community.crypto.luks_device:
-    device: "/dev/loop0"
-    keyfile: "/vault/keyfile"
-    new_passphrase: "foo"
+- name: Add new passphrase to the LUKS container
+  community.crypto.luks_device:
+    device: "/dev/loop0"
+    keyfile: "/vault/keyfile"
+    new_passphrase: "foo"
 
-- name: Remove existing keyfile from the LUKS container
-  community.crypto.luks_device:
-    device: "/dev/loop0"
-    remove_keyfile: "/vault/keyfile2"
+- name: Remove existing keyfile from the LUKS container
+  community.crypto.luks_device:
+    device: "/dev/loop0"
+    remove_keyfile: "/vault/keyfile2"
 
-- name: Remove existing passphrase from the LUKS container
-  community.crypto.luks_device:
-    device: "/dev/loop0"
-    remove_passphrase: "foo"
+- name: Remove existing passphrase from the LUKS container
+  community.crypto.luks_device:
+    device: "/dev/loop0"
+    remove_passphrase: "foo"
 
-- name: Completely remove the LUKS container and its contents
-  community.crypto.luks_device:
-    device: "/dev/loop0"
-    state: "absent"
+- name: Completely remove the LUKS container and its contents
+  community.crypto.luks_device:
+    device: "/dev/loop0"
+    state: "absent"
 
-- name: Create a container with label
-  community.crypto.luks_device:
-    device: "/dev/loop0"
-    state: "present"
-    keyfile: "/vault/keyfile"
-    label: personalLabelName
+- name: Create a container with label
+  community.crypto.luks_device:
+    device: "/dev/loop0"
+    state: "present"
+    keyfile: "/vault/keyfile"
+    label: personalLabelName
 
-- name: Open the LUKS container based on label without device; name it "mycrypt"
-  community.crypto.luks_device:
-    label: "personalLabelName"
-    state: "opened"
-    name: "mycrypt"
-    keyfile: "/vault/keyfile"
+- name: Open the LUKS container based on label without device; name it "mycrypt"
+  community.crypto.luks_device:
+    label: "personalLabelName"
+    state: "opened"
+    name: "mycrypt"
+    keyfile: "/vault/keyfile"
 
-- name: Close container based on UUID
-  community.crypto.luks_device:
-    uuid: 03ecd578-fad4-4e6c-9348-842e3e8fa340
-    state: "closed"
-    name: "mycrypt"
+- name: Close container based on UUID
+  community.crypto.luks_device:
+    uuid: 03ecd578-fad4-4e6c-9348-842e3e8fa340
+    state: "closed"
+    name: "mycrypt"
 
-- name: Create a container using luks2 format
-  community.crypto.luks_device:
-    device: "/dev/loop0"
-    state: "present"
-    keyfile: "/vault/keyfile"
-    type: luks2
+- name: Create a container using luks2 format
+  community.crypto.luks_device:
+    device: "/dev/loop0"
+    state: "present"
+    keyfile: "/vault/keyfile"
+    type: luks2
 

 

 
diff --git a/branch/main/openssh_cert_module.html b/branch/main/openssh_cert_module.html
index e8fdbfc3..adff1a80 100644
--- a/branch/main/openssh_cert_module.html
+++ b/branch/main/openssh_cert_module.html
@@ -535,70 +535,70 @@ see 
 
Examples

-
- name: Generate an OpenSSH user certificate that is valid forever and for all users
-  community.crypto.openssh_cert:
-    type: user
-    signing_key: /path/to/private_key
-    public_key: /path/to/public_key.pub
-    path: /path/to/certificate
-    valid_from: always
-    valid_to: forever
+
- name: Generate an OpenSSH user certificate that is valid forever and for all users
+  community.crypto.openssh_cert:
+    type: user
+    signing_key: /path/to/private_key
+    public_key: /path/to/public_key.pub
+    path: /path/to/certificate
+    valid_from: always
+    valid_to: forever
 
-# Generate an OpenSSH host certificate that is valid for 32 weeks from now and will be regenerated
-# if it is valid for less than 2 weeks from the time the module is being run
-- name: Generate an OpenSSH host certificate with valid_from, valid_to and valid_at parameters
-  community.crypto.openssh_cert:
-    type: host
-    signing_key: /path/to/private_key
-    public_key: /path/to/public_key.pub
-    path: /path/to/certificate
-    valid_from: +0s
-    valid_to: +32w
-    valid_at: +2w
-    ignore_timestamps: true
+# Generate an OpenSSH host certificate that is valid for 32 weeks from now and will be regenerated
+# if it is valid for less than 2 weeks from the time the module is being run
+- name: Generate an OpenSSH host certificate with valid_from, valid_to and valid_at parameters
+  community.crypto.openssh_cert:
+    type: host
+    signing_key: /path/to/private_key
+    public_key: /path/to/public_key.pub
+    path: /path/to/certificate
+    valid_from: +0s
+    valid_to: +32w
+    valid_at: +2w
+    ignore_timestamps: true
 
-- name: Generate an OpenSSH host certificate that is valid forever and only for example.com and examplehost
-  community.crypto.openssh_cert:
-    type: host
-    signing_key: /path/to/private_key
-    public_key: /path/to/public_key.pub
-    path: /path/to/certificate
-    valid_from: always
-    valid_to: forever
-    principals:
-        - example.com
-        - examplehost
+- name: Generate an OpenSSH host certificate that is valid forever and only for example.com and examplehost
+  community.crypto.openssh_cert:
+    type: host
+    signing_key: /path/to/private_key
+    public_key: /path/to/public_key.pub
+    path: /path/to/certificate
+    valid_from: always
+    valid_to: forever
+    principals:
+        - example.com
+        - examplehost
 
-- name: Generate an OpenSSH host Certificate that is valid from 21.1.2001 to 21.1.2019
-  community.crypto.openssh_cert:
-    type: host
-    signing_key: /path/to/private_key
-    public_key: /path/to/public_key.pub
-    path: /path/to/certificate
-    valid_from: "2001-01-21"
-    valid_to: "2019-01-21"
+- name: Generate an OpenSSH host Certificate that is valid from 21.1.2001 to 21.1.2019
+  community.crypto.openssh_cert:
+    type: host
+    signing_key: /path/to/private_key
+    public_key: /path/to/public_key.pub
+    path: /path/to/certificate
+    valid_from: "2001-01-21"
+    valid_to: "2019-01-21"
 
-- name: Generate an OpenSSH user Certificate with clear and force-command option
-  community.crypto.openssh_cert:
-    type: user
-    signing_key: /path/to/private_key
-    public_key: /path/to/public_key.pub
-    path: /path/to/certificate
-    valid_from: always
-    valid_to: forever
-    options:
-        - "clear"
-        - "force-command=/tmp/bla/foo"
+- name: Generate an OpenSSH user Certificate with clear and force-command option
+  community.crypto.openssh_cert:
+    type: user
+    signing_key: /path/to/private_key
+    public_key: /path/to/public_key.pub
+    path: /path/to/certificate
+    valid_from: always
+    valid_to: forever
+    options:
+        - "clear"
+        - "force-command=/tmp/bla/foo"
 
-- name: Generate an OpenSSH user certificate using a PKCS#11 token
-  community.crypto.openssh_cert:
-    type: user
-    signing_key: /path/to/ca_public_key.pub
-    pkcs11_provider: libpkcs11.so
-    public_key: /path/to/public_key.pub
-    path: /path/to/certificate
-    valid_from: always
-    valid_to: forever
+- name: Generate an OpenSSH user certificate using a PKCS#11 token
+  community.crypto.openssh_cert:
+    type: user
+    signing_key: /path/to/ca_public_key.pub
+    pkcs11_provider: libpkcs11.so
+    public_key: /path/to/public_key.pub
+    path: /path/to/certificate
+    valid_from: always
+    valid_to: forever
 

 

 
diff --git a/branch/main/openssh_keypair_module.html b/branch/main/openssh_keypair_module.html
index d1cb9f61..ed5f0b58 100644
--- a/branch/main/openssh_keypair_module.html
+++ b/branch/main/openssh_keypair_module.html
@@ -473,29 +473,29 @@ see 
 
Examples

-
- name: Generate an OpenSSH keypair with the default values (4096 bits, rsa)
-  community.crypto.openssh_keypair:
-    path: /tmp/id_ssh_rsa
+
- name: Generate an OpenSSH keypair with the default values (4096 bits, rsa)
+  community.crypto.openssh_keypair:
+    path: /tmp/id_ssh_rsa
 
-- name: Generate an OpenSSH keypair with the default values (4096 bits, rsa) and encrypted private key
-  community.crypto.openssh_keypair:
-    path: /tmp/id_ssh_rsa
-    passphrase: super_secret_password
+- name: Generate an OpenSSH keypair with the default values (4096 bits, rsa) and encrypted private key
+  community.crypto.openssh_keypair:
+    path: /tmp/id_ssh_rsa
+    passphrase: super_secret_password
 
-- name: Generate an OpenSSH rsa keypair with a different size (2048 bits)
-  community.crypto.openssh_keypair:
-    path: /tmp/id_ssh_rsa
-    size: 2048
+- name: Generate an OpenSSH rsa keypair with a different size (2048 bits)
+  community.crypto.openssh_keypair:
+    path: /tmp/id_ssh_rsa
+    size: 2048
 
-- name: Force regenerate an OpenSSH keypair if it already exists
-  community.crypto.openssh_keypair:
-    path: /tmp/id_ssh_rsa
-    force: True
+- name: Force regenerate an OpenSSH keypair if it already exists
+  community.crypto.openssh_keypair:
+    path: /tmp/id_ssh_rsa
+    force: True
 
-- name: Generate an OpenSSH keypair with a different algorithm (dsa)
-  community.crypto.openssh_keypair:
-    path: /tmp/id_ssh_dsa
-    type: dsa
+- name: Generate an OpenSSH keypair with a different algorithm (dsa)
+  community.crypto.openssh_keypair:
+    path: /tmp/id_ssh_dsa
+    type: dsa
 

 

 
diff --git a/branch/main/openssl_csr_info_filter.html b/branch/main/openssl_csr_info_filter.html
index 35658889..b2708841 100644
--- a/branch/main/openssl_csr_info_filter.html
+++ b/branch/main/openssl_csr_info_filter.html
@@ -257,15 +257,15 @@ see 
 
Examples

-
- name: Show the Subject Alt Names of the CSR
-  ansible.builtin.debug:
-    msg: >-
+
- name: Show the Subject Alt Names of the CSR
+  ansible.builtin.debug:
+    msg: >-
       {{
         (
           lookup('ansible.builtin.file', '/path/to/cert.csr')
           | community.crypto.openssl_csr_info
         ).subject_alt_name | join(', ')
-      }}
+      }}
 

 

 
diff --git a/branch/main/openssl_csr_info_module.html b/branch/main/openssl_csr_info_module.html
index bafffc02..79436a7e 100644
--- a/branch/main/openssl_csr_info_module.html
+++ b/branch/main/openssl_csr_info_module.html
@@ -303,20 +303,20 @@ see 
 
Examples

-
- name: Generate an OpenSSL Certificate Signing Request
-  community.crypto.openssl_csr:
-    path: /etc/ssl/csr/www.ansible.com.csr
-    privatekey_path: /etc/ssl/private/ansible.com.pem
-    common_name: www.ansible.com
+
- name: Generate an OpenSSL Certificate Signing Request
+  community.crypto.openssl_csr:
+    path: /etc/ssl/csr/www.ansible.com.csr
+    privatekey_path: /etc/ssl/private/ansible.com.pem
+    common_name: www.ansible.com
 
-- name: Get information on the CSR
-  community.crypto.openssl_csr_info:
-    path: /etc/ssl/csr/www.ansible.com.csr
-  register: result
+- name: Get information on the CSR
+  community.crypto.openssl_csr_info:
+    path: /etc/ssl/csr/www.ansible.com.csr
+  register: result
 
-- name: Dump information
-  debug:
-    var: result
+- name: Dump information
+  debug:
+    var: result
 

 

 
diff --git a/branch/main/openssl_csr_module.html b/branch/main/openssl_csr_module.html
index ccd4fbd6..5aa3d482 100644
--- a/branch/main/openssl_csr_module.html
+++ b/branch/main/openssl_csr_module.html
@@ -863,98 +863,98 @@ see 
 
Examples

-
- name: Generate an OpenSSL Certificate Signing Request
-  community.crypto.openssl_csr:
-    path: /etc/ssl/csr/www.ansible.com.csr
-    privatekey_path: /etc/ssl/private/ansible.com.pem
-    common_name: www.ansible.com
+
- name: Generate an OpenSSL Certificate Signing Request
+  community.crypto.openssl_csr:
+    path: /etc/ssl/csr/www.ansible.com.csr
+    privatekey_path: /etc/ssl/private/ansible.com.pem
+    common_name: www.ansible.com
 
-- name: Generate an OpenSSL Certificate Signing Request with an inline key
-  community.crypto.openssl_csr:
-    path: /etc/ssl/csr/www.ansible.com.csr
-    privatekey_content: "{{ private_key_content }}"
-    common_name: www.ansible.com
+- name: Generate an OpenSSL Certificate Signing Request with an inline key
+  community.crypto.openssl_csr:
+    path: /etc/ssl/csr/www.ansible.com.csr
+    privatekey_content: "{{ private_key_content }}"
+    common_name: www.ansible.com
 
-- name: Generate an OpenSSL Certificate Signing Request with a passphrase protected private key
-  community.crypto.openssl_csr:
-    path: /etc/ssl/csr/www.ansible.com.csr
-    privatekey_path: /etc/ssl/private/ansible.com.pem
-    privatekey_passphrase: ansible
-    common_name: www.ansible.com
+- name: Generate an OpenSSL Certificate Signing Request with a passphrase protected private key
+  community.crypto.openssl_csr:
+    path: /etc/ssl/csr/www.ansible.com.csr
+    privatekey_path: /etc/ssl/private/ansible.com.pem
+    privatekey_passphrase: ansible
+    common_name: www.ansible.com
 
-- name: Generate an OpenSSL Certificate Signing Request with Subject information
-  community.crypto.openssl_csr:
-    path: /etc/ssl/csr/www.ansible.com.csr
-    privatekey_path: /etc/ssl/private/ansible.com.pem
-    country_name: FR
-    organization_name: Ansible
-    email_address: jdoe@ansible.com
-    common_name: www.ansible.com
+- name: Generate an OpenSSL Certificate Signing Request with Subject information
+  community.crypto.openssl_csr:
+    path: /etc/ssl/csr/www.ansible.com.csr
+    privatekey_path: /etc/ssl/private/ansible.com.pem
+    country_name: FR
+    organization_name: Ansible
+    email_address: jdoe@ansible.com
+    common_name: www.ansible.com
 
-- name: Generate an OpenSSL Certificate Signing Request with subjectAltName extension
-  community.crypto.openssl_csr:
-    path: /etc/ssl/csr/www.ansible.com.csr
-    privatekey_path: /etc/ssl/private/ansible.com.pem
-    subject_alt_name: 'DNS:www.ansible.com,DNS:m.ansible.com'
+- name: Generate an OpenSSL Certificate Signing Request with subjectAltName extension
+  community.crypto.openssl_csr:
+    path: /etc/ssl/csr/www.ansible.com.csr
+    privatekey_path: /etc/ssl/private/ansible.com.pem
+    subject_alt_name: 'DNS:www.ansible.com,DNS:m.ansible.com'
 
-- name: Generate an OpenSSL CSR with subjectAltName extension with dynamic list
-  community.crypto.openssl_csr:
-    path: /etc/ssl/csr/www.ansible.com.csr
-    privatekey_path: /etc/ssl/private/ansible.com.pem
-    subject_alt_name: "{{ item.value | map('regex_replace', '^', 'DNS:') | list }}"
-  with_dict:
-    dns_server:
-    - www.ansible.com
-    - m.ansible.com
+- name: Generate an OpenSSL CSR with subjectAltName extension with dynamic list
+  community.crypto.openssl_csr:
+    path: /etc/ssl/csr/www.ansible.com.csr
+    privatekey_path: /etc/ssl/private/ansible.com.pem
+    subject_alt_name: "{{ item.value | map('regex_replace', '^', 'DNS:') | list }}"
+  with_dict:
+    dns_server:
+    - www.ansible.com
+    - m.ansible.com
 
-- name: Force regenerate an OpenSSL Certificate Signing Request
-  community.crypto.openssl_csr:
-    path: /etc/ssl/csr/www.ansible.com.csr
-    privatekey_path: /etc/ssl/private/ansible.com.pem
-    force: true
-    common_name: www.ansible.com
+- name: Force regenerate an OpenSSL Certificate Signing Request
+  community.crypto.openssl_csr:
+    path: /etc/ssl/csr/www.ansible.com.csr
+    privatekey_path: /etc/ssl/private/ansible.com.pem
+    force: true
+    common_name: www.ansible.com
 
-- name: Generate an OpenSSL Certificate Signing Request with special key usages
-  community.crypto.openssl_csr:
-    path: /etc/ssl/csr/www.ansible.com.csr
-    privatekey_path: /etc/ssl/private/ansible.com.pem
-    common_name: www.ansible.com
-    key_usage:
-      - digitalSignature
-      - keyAgreement
-    extended_key_usage:
-      - clientAuth
+- name: Generate an OpenSSL Certificate Signing Request with special key usages
+  community.crypto.openssl_csr:
+    path: /etc/ssl/csr/www.ansible.com.csr
+    privatekey_path: /etc/ssl/private/ansible.com.pem
+    common_name: www.ansible.com
+    key_usage:
+      - digitalSignature
+      - keyAgreement
+    extended_key_usage:
+      - clientAuth
 
-- name: Generate an OpenSSL Certificate Signing Request with OCSP Must Staple
-  community.crypto.openssl_csr:
-    path: /etc/ssl/csr/www.ansible.com.csr
-    privatekey_path: /etc/ssl/private/ansible.com.pem
-    common_name: www.ansible.com
-    ocsp_must_staple: true
+- name: Generate an OpenSSL Certificate Signing Request with OCSP Must Staple
+  community.crypto.openssl_csr:
+    path: /etc/ssl/csr/www.ansible.com.csr
+    privatekey_path: /etc/ssl/private/ansible.com.pem
+    common_name: www.ansible.com
+    ocsp_must_staple: true
 
-- name: Generate an OpenSSL Certificate Signing Request for WinRM Certificate authentication
-  community.crypto.openssl_csr:
-    path: /etc/ssl/csr/winrm.auth.csr
-    privatekey_path: /etc/ssl/private/winrm.auth.pem
-    common_name: username
-    extended_key_usage:
-    - clientAuth
-    subject_alt_name: otherName:1.3.6.1.4.1.311.20.2.3;UTF8:username@localhost
+- name: Generate an OpenSSL Certificate Signing Request for WinRM Certificate authentication
+  community.crypto.openssl_csr:
+    path: /etc/ssl/csr/winrm.auth.csr
+    privatekey_path: /etc/ssl/private/winrm.auth.pem
+    common_name: username
+    extended_key_usage:
+    - clientAuth
+    subject_alt_name: otherName:1.3.6.1.4.1.311.20.2.3;UTF8:username@localhost
 
-- name: Generate an OpenSSL Certificate Signing Request with a CRL distribution point
-  community.crypto.openssl_csr:
-    path: /etc/ssl/csr/www.ansible.com.csr
-    privatekey_path: /etc/ssl/private/ansible.com.pem
-    common_name: www.ansible.com
-    crl_distribution_points:
-      - full_name:
-          - "URI:https://ca.example.com/revocations.crl"
-        crl_issuer:
-          - "URI:https://ca.example.com/"
-        reasons:
-          - key_compromise
-          - ca_compromise
-          - cessation_of_operation
+- name: Generate an OpenSSL Certificate Signing Request with a CRL distribution point
+  community.crypto.openssl_csr:
+    path: /etc/ssl/csr/www.ansible.com.csr
+    privatekey_path: /etc/ssl/private/ansible.com.pem
+    common_name: www.ansible.com
+    crl_distribution_points:
+      - full_name:
+          - "URI:https://ca.example.com/revocations.crl"
+        crl_issuer:
+          - "URI:https://ca.example.com/"
+        reasons:
+          - key_compromise
+          - ca_compromise
+          - cessation_of_operation
 

 

 
diff --git a/branch/main/openssl_csr_pipe_module.html b/branch/main/openssl_csr_pipe_module.html
index 8473a9f9..270b5d33 100644
--- a/branch/main/openssl_csr_pipe_module.html
+++ b/branch/main/openssl_csr_pipe_module.html
@@ -713,25 +713,25 @@ see 
 
Examples

-
- name: Generate an OpenSSL Certificate Signing Request
-  community.crypto.openssl_csr_pipe:
-    privatekey_path: /etc/ssl/private/ansible.com.pem
-    common_name: www.ansible.com
-  register: result
-- debug:
-    var: result.csr
+
- name: Generate an OpenSSL Certificate Signing Request
+  community.crypto.openssl_csr_pipe:
+    privatekey_path: /etc/ssl/private/ansible.com.pem
+    common_name: www.ansible.com
+  register: result
+- debug:
+    var: result.csr
 
-- name: Generate an OpenSSL Certificate Signing Request with an inline CSR
-  community.crypto.openssl_csr:
-    content: "{{ lookup('file', '/etc/ssl/csr/www.ansible.com.csr') }}"
-    privatekey_content: "{{ private_key_content }}"
-    common_name: www.ansible.com
-  register: result
-- name: Store CSR
-  ansible.builtin.copy:
-    dest: /etc/ssl/csr/www.ansible.com.csr
-    content: "{{ result.csr }}"
-  when: result is changed
+- name: Generate an OpenSSL Certificate Signing Request with an inline CSR
+  community.crypto.openssl_csr:
+    content: "{{ lookup('file', '/etc/ssl/csr/www.ansible.com.csr') }}"
+    privatekey_content: "{{ private_key_content }}"
+    common_name: www.ansible.com
+  register: result
+- name: Store CSR
+  ansible.builtin.copy:
+    dest: /etc/ssl/csr/www.ansible.com.csr
+    content: "{{ result.csr }}"
+  when: result is changed
 

 

 
diff --git a/branch/main/openssl_dhparam_module.html b/branch/main/openssl_dhparam_module.html
index f272b762..54fde5c2 100644
--- a/branch/main/openssl_dhparam_module.html
+++ b/branch/main/openssl_dhparam_module.html
@@ -437,19 +437,19 @@ see 
 
Examples

-
- name: Generate Diffie-Hellman parameters with the default size (4096 bits)
-  community.crypto.openssl_dhparam:
-    path: /etc/ssl/dhparams.pem
+
- name: Generate Diffie-Hellman parameters with the default size (4096 bits)
+  community.crypto.openssl_dhparam:
+    path: /etc/ssl/dhparams.pem
 
-- name: Generate DH Parameters with a different size (2048 bits)
-  community.crypto.openssl_dhparam:
-    path: /etc/ssl/dhparams.pem
-    size: 2048
+- name: Generate DH Parameters with a different size (2048 bits)
+  community.crypto.openssl_dhparam:
+    path: /etc/ssl/dhparams.pem
+    size: 2048
 
-- name: Force regenerate an DH parameters if they already exist
-  community.crypto.openssl_dhparam:
-    path: /etc/ssl/dhparams.pem
-    force: true
+- name: Force regenerate an DH parameters if they already exist
+  community.crypto.openssl_dhparam:
+    path: /etc/ssl/dhparams.pem
+    force: true
 

 

 
diff --git a/branch/main/openssl_pkcs12_module.html b/branch/main/openssl_pkcs12_module.html
index 6865f688..805b4039 100644
--- a/branch/main/openssl_pkcs12_module.html
+++ b/branch/main/openssl_pkcs12_module.html
@@ -552,72 +552,72 @@ see 
 
Examples

-
- name: Generate PKCS#12 file
-  community.crypto.openssl_pkcs12:
-    action: export
-    path: /opt/certs/ansible.p12
-    friendly_name: raclette
-    privatekey_path: /opt/certs/keys/key.pem
-    certificate_path: /opt/certs/cert.pem
-    other_certificates: /opt/certs/ca.pem
-    # Note that if /opt/certs/ca.pem contains multiple certificates,
-    # only the first one will be used. See the other_certificates_parse_all
-    # option for changing this behavior.
-    state: present
+
- name: Generate PKCS#12 file
+  community.crypto.openssl_pkcs12:
+    action: export
+    path: /opt/certs/ansible.p12
+    friendly_name: raclette
+    privatekey_path: /opt/certs/keys/key.pem
+    certificate_path: /opt/certs/cert.pem
+    other_certificates: /opt/certs/ca.pem
+    # Note that if /opt/certs/ca.pem contains multiple certificates,
+    # only the first one will be used. See the other_certificates_parse_all
+    # option for changing this behavior.
+    state: present
 
-- name: Generate PKCS#12 file
-  community.crypto.openssl_pkcs12:
-    action: export
-    path: /opt/certs/ansible.p12
-    friendly_name: raclette
-    privatekey_content: '{{ private_key_contents }}'
-    certificate_path: /opt/certs/cert.pem
-    other_certificates_parse_all: true
-    other_certificates:
-      - /opt/certs/ca_bundle.pem
-        # Since we set other_certificates_parse_all to true, all
-        # certificates in the CA bundle are included and not just
-        # the first one.
-      - /opt/certs/intermediate.pem
-        # In case this file has multiple certificates in it,
-        # all will be included as well.
-    state: present
+- name: Generate PKCS#12 file
+  community.crypto.openssl_pkcs12:
+    action: export
+    path: /opt/certs/ansible.p12
+    friendly_name: raclette
+    privatekey_content: '{{ private_key_contents }}'
+    certificate_path: /opt/certs/cert.pem
+    other_certificates_parse_all: true
+    other_certificates:
+      - /opt/certs/ca_bundle.pem
+        # Since we set other_certificates_parse_all to true, all
+        # certificates in the CA bundle are included and not just
+        # the first one.
+      - /opt/certs/intermediate.pem
+        # In case this file has multiple certificates in it,
+        # all will be included as well.
+    state: present
 
-- name: Change PKCS#12 file permission
-  community.crypto.openssl_pkcs12:
-    action: export
-    path: /opt/certs/ansible.p12
-    friendly_name: raclette
-    privatekey_path: /opt/certs/keys/key.pem
-    certificate_path: /opt/certs/cert.pem
-    other_certificates: /opt/certs/ca.pem
-    state: present
-    mode: '0600'
+- name: Change PKCS#12 file permission
+  community.crypto.openssl_pkcs12:
+    action: export
+    path: /opt/certs/ansible.p12
+    friendly_name: raclette
+    privatekey_path: /opt/certs/keys/key.pem
+    certificate_path: /opt/certs/cert.pem
+    other_certificates: /opt/certs/ca.pem
+    state: present
+    mode: '0600'
 
-- name: Regen PKCS#12 file
-  community.crypto.openssl_pkcs12:
-    action: export
-    src: /opt/certs/ansible.p12
-    path: /opt/certs/ansible.p12
-    friendly_name: raclette
-    privatekey_path: /opt/certs/keys/key.pem
-    certificate_path: /opt/certs/cert.pem
-    other_certificates: /opt/certs/ca.pem
-    state: present
-    mode: '0600'
-    force: true
+- name: Regen PKCS#12 file
+  community.crypto.openssl_pkcs12:
+    action: export
+    src: /opt/certs/ansible.p12
+    path: /opt/certs/ansible.p12
+    friendly_name: raclette
+    privatekey_path: /opt/certs/keys/key.pem
+    certificate_path: /opt/certs/cert.pem
+    other_certificates: /opt/certs/ca.pem
+    state: present
+    mode: '0600'
+    force: true
 
-- name: Dump/Parse PKCS#12 file
-  community.crypto.openssl_pkcs12:
-    action: parse
-    src: /opt/certs/ansible.p12
-    path: /opt/certs/ansible.pem
-    state: present
+- name: Dump/Parse PKCS#12 file
+  community.crypto.openssl_pkcs12:
+    action: parse
+    src: /opt/certs/ansible.p12
+    path: /opt/certs/ansible.pem
+    state: present
 
-- name: Remove PKCS#12 file
-  community.crypto.openssl_pkcs12:
-    path: /opt/certs/ansible.p12
-    state: absent
+- name: Remove PKCS#12 file
+  community.crypto.openssl_pkcs12:
+    path: /opt/certs/ansible.p12
+    state: absent
 

 

 
diff --git a/branch/main/openssl_privatekey_convert_module.html b/branch/main/openssl_privatekey_convert_module.html
index 7a40fbe8..c54bef32 100644
--- a/branch/main/openssl_privatekey_convert_module.html
+++ b/branch/main/openssl_privatekey_convert_module.html
@@ -413,12 +413,12 @@ see 
 
Examples

-
- name: Convert private key to PKCS8 format with passphrase
-  community.crypto.openssl_privatekey_convert:
-    src_path: /etc/ssl/private/ansible.com.pem
-    dest_path: /etc/ssl/private/ansible.com.key
-    dest_passphrase: '{{ private_key_passphrase }}'
-    format: pkcs8
+
- name: Convert private key to PKCS8 format with passphrase
+  community.crypto.openssl_privatekey_convert:
+    src_path: /etc/ssl/private/ansible.com.pem
+    dest_path: /etc/ssl/private/ansible.com.key
+    dest_passphrase: '{{ private_key_passphrase }}'
+    format: pkcs8
 

 

 
diff --git a/branch/main/openssl_privatekey_info_filter.html b/branch/main/openssl_privatekey_info_filter.html
index 93e70750..6683d593 100644
--- a/branch/main/openssl_privatekey_info_filter.html
+++ b/branch/main/openssl_privatekey_info_filter.html
@@ -278,15 +278,15 @@ see 
 
Examples

-
- name: Show the Subject Alt Names of the CSR
-  ansible.builtin.debug:
-    msg: >-
+
- name: Show the Subject Alt Names of the CSR
+  ansible.builtin.debug:
+    msg: >-
       {{
         (
           lookup('ansible.builtin.file', '/path/to/cert.csr')
           | community.crypto.openssl_privatekey_info
         ).subject_alt_name | join(', ')
-      }}
+      }}
 

 

 
diff --git a/branch/main/openssl_privatekey_info_module.html b/branch/main/openssl_privatekey_info_module.html
index 79fd54e6..39e59cbc 100644
--- a/branch/main/openssl_privatekey_info_module.html
+++ b/branch/main/openssl_privatekey_info_module.html
@@ -320,18 +320,18 @@ see 
 
Examples

-
- name: Generate an OpenSSL private key with the default values (4096 bits, RSA)
-  community.crypto.openssl_privatekey:
-    path: /etc/ssl/private/ansible.com.pem
+
- name: Generate an OpenSSL private key with the default values (4096 bits, RSA)
+  community.crypto.openssl_privatekey:
+    path: /etc/ssl/private/ansible.com.pem
 
-- name: Get information on generated key
-  community.crypto.openssl_privatekey_info:
-    path: /etc/ssl/private/ansible.com.pem
-  register: result
+- name: Get information on generated key
+  community.crypto.openssl_privatekey_info:
+    path: /etc/ssl/private/ansible.com.pem
+  register: result
 
-- name: Dump information
-  ansible.builtin.debug:
-    var: result
+- name: Dump information
+  ansible.builtin.debug:
+    var: result
 

 

 
diff --git a/branch/main/openssl_privatekey_module.html b/branch/main/openssl_privatekey_module.html
index 62dd53e7..0d861a91 100644
--- a/branch/main/openssl_privatekey_module.html
+++ b/branch/main/openssl_privatekey_module.html
@@ -565,30 +565,30 @@ see 
 
Examples

-
- name: Generate an OpenSSL private key with the default values (4096 bits, RSA)
-  community.crypto.openssl_privatekey:
-    path: /etc/ssl/private/ansible.com.pem
+
- name: Generate an OpenSSL private key with the default values (4096 bits, RSA)
+  community.crypto.openssl_privatekey:
+    path: /etc/ssl/private/ansible.com.pem
 
-- name: Generate an OpenSSL private key with the default values (4096 bits, RSA) and a passphrase
-  community.crypto.openssl_privatekey:
-    path: /etc/ssl/private/ansible.com.pem
-    passphrase: ansible
-    cipher: auto
+- name: Generate an OpenSSL private key with the default values (4096 bits, RSA) and a passphrase
+  community.crypto.openssl_privatekey:
+    path: /etc/ssl/private/ansible.com.pem
+    passphrase: ansible
+    cipher: auto
 
-- name: Generate an OpenSSL private key with a different size (2048 bits)
-  community.crypto.openssl_privatekey:
-    path: /etc/ssl/private/ansible.com.pem
-    size: 2048
+- name: Generate an OpenSSL private key with a different size (2048 bits)
+  community.crypto.openssl_privatekey:
+    path: /etc/ssl/private/ansible.com.pem
+    size: 2048
 
-- name: Force regenerate an OpenSSL private key if it already exists
-  community.crypto.openssl_privatekey:
-    path: /etc/ssl/private/ansible.com.pem
-    force: true
+- name: Force regenerate an OpenSSL private key if it already exists
+  community.crypto.openssl_privatekey:
+    path: /etc/ssl/private/ansible.com.pem
+    force: true
 
-- name: Generate an OpenSSL private key with a different algorithm (DSA)
-  community.crypto.openssl_privatekey:
-    path: /etc/ssl/private/ansible.com.pem
-    type: DSA
+- name: Generate an OpenSSL private key with a different algorithm (DSA)
+  community.crypto.openssl_privatekey:
+    path: /etc/ssl/private/ansible.com.pem
+    type: DSA
 

 

 
diff --git a/branch/main/openssl_privatekey_pipe_module.html b/branch/main/openssl_privatekey_pipe_module.html
index d33d3707..2ab41603 100644
--- a/branch/main/openssl_privatekey_pipe_module.html
+++ b/branch/main/openssl_privatekey_pipe_module.html
@@ -463,33 +463,33 @@ see 
 
Examples

-
- name: Generate an OpenSSL private key with the default values (4096 bits, RSA)
-  community.crypto.openssl_privatekey_pipe:
-    path: /etc/ssl/private/ansible.com.pem
-  register: output
-  no_log: true  # make sure that private key data is not accidentally revealed in logs!
-- name: Show generated key
-  debug:
-    msg: "{{ output.privatekey }}"
-  # DO NOT OUTPUT KEY MATERIAL TO CONSOLE OR LOGS IN PRODUCTION!
+
- name: Generate an OpenSSL private key with the default values (4096 bits, RSA)
+  community.crypto.openssl_privatekey_pipe:
+    path: /etc/ssl/private/ansible.com.pem
+  register: output
+  no_log: true  # make sure that private key data is not accidentally revealed in logs!
+- name: Show generated key
+  debug:
+    msg: "{{ output.privatekey }}"
+  # DO NOT OUTPUT KEY MATERIAL TO CONSOLE OR LOGS IN PRODUCTION!
 
-- block:
-    - name: Update sops-encrypted key with the community.sops collection
-      community.crypto.openssl_privatekey_pipe:
-        content: "{{ lookup('community.sops.sops', 'private_key.pem.sops') }}"
-        size: 2048
-      register: output
-      no_log: true  # make sure that private key data is not accidentally revealed in logs!
+- block:
+    - name: Update sops-encrypted key with the community.sops collection
+      community.crypto.openssl_privatekey_pipe:
+        content: "{{ lookup('community.sops.sops', 'private_key.pem.sops') }}"
+        size: 2048
+      register: output
+      no_log: true  # make sure that private key data is not accidentally revealed in logs!
 
-    - name: Update encrypted key when openssl_privatekey_pipe reported a change
-      community.sops.sops_encrypt:
-        path: private_key.pem.sops
-        content_text: "{{ output.privatekey }}"
-      when: output is changed
-  always:
-    - name: Make sure that output (which contains the private key) is overwritten
-      set_fact:
-        output: ''
+    - name: Update encrypted key when openssl_privatekey_pipe reported a change
+      community.sops.sops_encrypt:
+        path: private_key.pem.sops
+        content_text: "{{ output.privatekey }}"
+      when: output is changed
+  always:
+    - name: Make sure that output (which contains the private key) is overwritten
+      set_fact:
+        output: ''
 

 

 
diff --git a/branch/main/openssl_publickey_info_filter.html b/branch/main/openssl_publickey_info_filter.html
index 71440661..2ac56bba 100644
--- a/branch/main/openssl_publickey_info_filter.html
+++ b/branch/main/openssl_publickey_info_filter.html
@@ -214,15 +214,15 @@
 
 

 
Examples

-
- name: Show the type of a public key
-  ansible.builtin.debug:
-    msg: >-
+
- name: Show the type of a public key
+  ansible.builtin.debug:
+    msg: >-
       {{
         (
           lookup('ansible.builtin.file', '/path/to/public-key.pem')
           | community.crypto.openssl_publickey_info
         ).type
-      }}
+      }}
 

 

 

diff --git a/branch/main/openssl_publickey_info_module.html b/branch/main/openssl_publickey_info_module.html
index 36f4ffeb..c0f5c0cc 100644
--- a/branch/main/openssl_publickey_info_module.html
+++ b/branch/main/openssl_publickey_info_module.html
@@ -283,23 +283,23 @@ see 
 
Examples

-
- name: Generate an OpenSSL private key with the default values (4096 bits, RSA)
-  community.crypto.openssl_privatekey:
-    path: /etc/ssl/private/ansible.com.pem
+
- name: Generate an OpenSSL private key with the default values (4096 bits, RSA)
+  community.crypto.openssl_privatekey:
+    path: /etc/ssl/private/ansible.com.pem
 
-- name: Create public key from private key
-  community.crypto.openssl_publickey:
-    privatekey_path: /etc/ssl/private/ansible.com.pem
-    path: /etc/ssl/ansible.com.pub
+- name: Create public key from private key
+  community.crypto.openssl_publickey:
+    privatekey_path: /etc/ssl/private/ansible.com.pem
+    path: /etc/ssl/ansible.com.pub
 
-- name: Get information on public key
-  community.crypto.openssl_publickey_info:
-    path: /etc/ssl/ansible.com.pub
-  register: result
+- name: Get information on public key
+  community.crypto.openssl_publickey_info:
+    path: /etc/ssl/ansible.com.pub
+  register: result
 
-- name: Dump information
-  ansible.builtin.debug:
-    var: result
+- name: Dump information
+  ansible.builtin.debug:
+    var: result
 

 

 
diff --git a/branch/main/openssl_publickey_module.html b/branch/main/openssl_publickey_module.html
index b46e08a2..72331de8 100644
--- a/branch/main/openssl_publickey_module.html
+++ b/branch/main/openssl_publickey_module.html
@@ -467,38 +467,38 @@ see 
 
Examples

-
- name: Generate an OpenSSL public key in PEM format
-  community.crypto.openssl_publickey:
-    path: /etc/ssl/public/ansible.com.pem
-    privatekey_path: /etc/ssl/private/ansible.com.pem
+
- name: Generate an OpenSSL public key in PEM format
+  community.crypto.openssl_publickey:
+    path: /etc/ssl/public/ansible.com.pem
+    privatekey_path: /etc/ssl/private/ansible.com.pem
 
-- name: Generate an OpenSSL public key in PEM format from an inline key
-  community.crypto.openssl_publickey:
-    path: /etc/ssl/public/ansible.com.pem
-    privatekey_content: "{{ private_key_content }}"
+- name: Generate an OpenSSL public key in PEM format from an inline key
+  community.crypto.openssl_publickey:
+    path: /etc/ssl/public/ansible.com.pem
+    privatekey_content: "{{ private_key_content }}"
 
-- name: Generate an OpenSSL public key in OpenSSH v2 format
-  community.crypto.openssl_publickey:
-    path: /etc/ssl/public/ansible.com.pem
-    privatekey_path: /etc/ssl/private/ansible.com.pem
-    format: OpenSSH
+- name: Generate an OpenSSL public key in OpenSSH v2 format
+  community.crypto.openssl_publickey:
+    path: /etc/ssl/public/ansible.com.pem
+    privatekey_path: /etc/ssl/private/ansible.com.pem
+    format: OpenSSH
 
-- name: Generate an OpenSSL public key with a passphrase protected private key
-  community.crypto.openssl_publickey:
-    path: /etc/ssl/public/ansible.com.pem
-    privatekey_path: /etc/ssl/private/ansible.com.pem
-    privatekey_passphrase: ansible
+- name: Generate an OpenSSL public key with a passphrase protected private key
+  community.crypto.openssl_publickey:
+    path: /etc/ssl/public/ansible.com.pem
+    privatekey_path: /etc/ssl/private/ansible.com.pem
+    privatekey_passphrase: ansible
 
-- name: Force regenerate an OpenSSL public key if it already exists
-  community.crypto.openssl_publickey:
-    path: /etc/ssl/public/ansible.com.pem
-    privatekey_path: /etc/ssl/private/ansible.com.pem
-    force: true
+- name: Force regenerate an OpenSSL public key if it already exists
+  community.crypto.openssl_publickey:
+    path: /etc/ssl/public/ansible.com.pem
+    privatekey_path: /etc/ssl/private/ansible.com.pem
+    force: true
 
-- name: Remove an OpenSSL public key
-  community.crypto.openssl_publickey:
-    path: /etc/ssl/public/ansible.com.pem
-    state: absent
+- name: Remove an OpenSSL public key
+  community.crypto.openssl_publickey:
+    path: /etc/ssl/public/ansible.com.pem
+    state: absent
 

 

 
diff --git a/branch/main/openssl_signature_info_module.html b/branch/main/openssl_signature_info_module.html
index e9189844..3736f5d4 100644
--- a/branch/main/openssl_signature_info_module.html
+++ b/branch/main/openssl_signature_info_module.html
@@ -311,23 +311,23 @@ ed448 and ed25519 keys: 
 
Examples

-
- name: Sign example file
-  community.crypto.openssl_signature:
-    privatekey_path: private.key
-    path: /tmp/example_file
-  register: sig
+
- name: Sign example file
+  community.crypto.openssl_signature:
+    privatekey_path: private.key
+    path: /tmp/example_file
+  register: sig
 
-- name: Verify signature of example file
-  community.crypto.openssl_signature_info:
-    certificate_path: cert.pem
-    path: /tmp/example_file
-    signature: "{{ sig.signature }}"
-  register: verify
+- name: Verify signature of example file
+  community.crypto.openssl_signature_info:
+    certificate_path: cert.pem
+    path: /tmp/example_file
+    signature: "{{ sig.signature }}"
+  register: verify
 
-- name: Make sure the signature is valid
-  assert:
-    that:
-      - verify.valid
+- name: Make sure the signature is valid
+  assert:
+    that:
+      - verify.valid
 

 

 
diff --git a/branch/main/openssl_signature_module.html b/branch/main/openssl_signature_module.html
index 5fe12fde..9362888d 100644
--- a/branch/main/openssl_signature_module.html
+++ b/branch/main/openssl_signature_module.html
@@ -311,23 +311,23 @@ ed448 and ed25519 keys: 
 
Examples

-
- name: Sign example file
-  community.crypto.openssl_signature:
-    privatekey_path: private.key
-    path: /tmp/example_file
-  register: sig
+
- name: Sign example file
+  community.crypto.openssl_signature:
+    privatekey_path: private.key
+    path: /tmp/example_file
+  register: sig
 
-- name: Verify signature of example file
-  community.crypto.openssl_signature_info:
-    certificate_path: cert.pem
-    path: /tmp/example_file
-    signature: "{{ sig.signature }}"
-  register: verify
+- name: Verify signature of example file
+  community.crypto.openssl_signature_info:
+    certificate_path: cert.pem
+    path: /tmp/example_file
+    signature: "{{ sig.signature }}"
+  register: verify
 
-- name: Make sure the signature is valid
-  assert:
-    that:
-      - verify.valid
+- name: Make sure the signature is valid
+  assert:
+    that:
+      - verify.valid
 

 

 
diff --git a/branch/main/split_pem_filter.html b/branch/main/split_pem_filter.html
index 4c8fc7ce..b4640f1e 100644
--- a/branch/main/split_pem_filter.html
+++ b/branch/main/split_pem_filter.html
@@ -201,11 +201,11 @@
 
 

 
Examples

-
- name: Print all CA certificates
-  ansible.builtin.debug:
-    msg: '{{ item }}'
-  loop: >-
-    {{ lookup('ansible.builtin.file', '/path/to/ca-bundle.pem') | community.crypto.split_pem }}
+
- name: Print all CA certificates
+  ansible.builtin.debug:
+    msg: '{{ item }}'
+  loop: >-
+    {{ lookup('ansible.builtin.file', '/path/to/ca-bundle.pem') | community.crypto.split_pem }}
 

 

 

diff --git a/branch/main/x509_certificate_info_filter.html b/branch/main/x509_certificate_info_filter.html
index 737d27eb..d05c792a 100644
--- a/branch/main/x509_certificate_info_filter.html
+++ b/branch/main/x509_certificate_info_filter.html
@@ -257,15 +257,15 @@ see 
 
Examples

-
- name: Show the Subject Alt Names of the certificate
-  ansible.builtin.debug:
-    msg: >-
+
- name: Show the Subject Alt Names of the certificate
+  ansible.builtin.debug:
+    msg: >-
       {{
         (
           lookup('ansible.builtin.file', '/path/to/cert.pem')
           | community.crypto.x509_certificate_info
         ).subject_alt_name | join(', ')
-      }}
+      }}
 

 

 
diff --git a/branch/main/x509_certificate_info_module.html b/branch/main/x509_certificate_info_module.html
index 96a05530..a09da922 100644
--- a/branch/main/x509_certificate_info_module.html
+++ b/branch/main/x509_certificate_info_module.html
@@ -324,44 +324,44 @@ see 
 
Examples

-
- name: Generate a Self Signed OpenSSL certificate
-  community.crypto.x509_certificate:
-    path: /etc/ssl/crt/ansible.com.crt
-    privatekey_path: /etc/ssl/private/ansible.com.pem
-    csr_path: /etc/ssl/csr/ansible.com.csr
-    provider: selfsigned
+
- name: Generate a Self Signed OpenSSL certificate
+  community.crypto.x509_certificate:
+    path: /etc/ssl/crt/ansible.com.crt
+    privatekey_path: /etc/ssl/private/ansible.com.pem
+    csr_path: /etc/ssl/csr/ansible.com.csr
+    provider: selfsigned
 
 
-# Get information on the certificate
+# Get information on the certificate
 
-- name: Get information on generated certificate
-  community.crypto.x509_certificate_info:
-    path: /etc/ssl/crt/ansible.com.crt
-  register: result
+- name: Get information on generated certificate
+  community.crypto.x509_certificate_info:
+    path: /etc/ssl/crt/ansible.com.crt
+  register: result
 
-- name: Dump information
-  ansible.builtin.debug:
-    var: result
+- name: Dump information
+  ansible.builtin.debug:
+    var: result
 
 
-# Check whether the certificate is valid or not valid at certain times, fail
-# if this is not the case. The first task (x509_certificate_info) collects
-# the information, and the second task (assert) validates the result and
-# makes the playbook fail in case something is not as expected.
+# Check whether the certificate is valid or not valid at certain times, fail
+# if this is not the case. The first task (x509_certificate_info) collects
+# the information, and the second task (assert) validates the result and
+# makes the playbook fail in case something is not as expected.
 
-- name: Test whether that certificate is valid tomorrow and/or in three weeks
-  community.crypto.x509_certificate_info:
-    path: /etc/ssl/crt/ansible.com.crt
-    valid_at:
-      point_1: "+1d"
-      point_2: "+3w"
-  register: result
+- name: Test whether that certificate is valid tomorrow and/or in three weeks
+  community.crypto.x509_certificate_info:
+    path: /etc/ssl/crt/ansible.com.crt
+    valid_at:
+      point_1: "+1d"
+      point_2: "+3w"
+  register: result
 
-- name: Validate that certificate is valid tomorrow, but not in three weeks
-  assert:
-    that:
-      - result.valid_at.point_1      # valid in one day
-      - not result.valid_at.point_2  # not valid in three weeks
+- name: Validate that certificate is valid tomorrow, but not in three weeks
+  assert:
+    that:
+      - result.valid_at.point_1      # valid in one day
+      - not result.valid_at.point_2  # not valid in three weeks
 

 

 
diff --git a/branch/main/x509_certificate_module.html b/branch/main/x509_certificate_module.html
index 57684fb7..ab888059 100644
--- a/branch/main/x509_certificate_module.html
+++ b/branch/main/x509_certificate_module.html
@@ -869,114 +869,114 @@ see 
 
Examples

-
- name: Generate a Self Signed OpenSSL certificate
-  community.crypto.x509_certificate:
-    path: /etc/ssl/crt/ansible.com.crt
-    privatekey_path: /etc/ssl/private/ansible.com.pem
-    csr_path: /etc/ssl/csr/ansible.com.csr
-    provider: selfsigned
+
- name: Generate a Self Signed OpenSSL certificate
+  community.crypto.x509_certificate:
+    path: /etc/ssl/crt/ansible.com.crt
+    privatekey_path: /etc/ssl/private/ansible.com.pem
+    csr_path: /etc/ssl/csr/ansible.com.csr
+    provider: selfsigned
 
-- name: Generate an OpenSSL certificate signed with your own CA certificate
-  community.crypto.x509_certificate:
-    path: /etc/ssl/crt/ansible.com.crt
-    csr_path: /etc/ssl/csr/ansible.com.csr
-    ownca_path: /etc/ssl/crt/ansible_CA.crt
-    ownca_privatekey_path: /etc/ssl/private/ansible_CA.pem
-    provider: ownca
+- name: Generate an OpenSSL certificate signed with your own CA certificate
+  community.crypto.x509_certificate:
+    path: /etc/ssl/crt/ansible.com.crt
+    csr_path: /etc/ssl/csr/ansible.com.csr
+    ownca_path: /etc/ssl/crt/ansible_CA.crt
+    ownca_privatekey_path: /etc/ssl/private/ansible_CA.pem
+    provider: ownca
 
-- name: Generate a Let's Encrypt Certificate
-  community.crypto.x509_certificate:
-    path: /etc/ssl/crt/ansible.com.crt
-    csr_path: /etc/ssl/csr/ansible.com.csr
-    provider: acme
-    acme_accountkey_path: /etc/ssl/private/ansible.com.pem
-    acme_challenge_path: /etc/ssl/challenges/ansible.com/
+- name: Generate a Let's Encrypt Certificate
+  community.crypto.x509_certificate:
+    path: /etc/ssl/crt/ansible.com.crt
+    csr_path: /etc/ssl/csr/ansible.com.csr
+    provider: acme
+    acme_accountkey_path: /etc/ssl/private/ansible.com.pem
+    acme_challenge_path: /etc/ssl/challenges/ansible.com/
 
-- name: Force (re-)generate a new Let's Encrypt Certificate
-  community.crypto.x509_certificate:
-    path: /etc/ssl/crt/ansible.com.crt
-    csr_path: /etc/ssl/csr/ansible.com.csr
-    provider: acme
-    acme_accountkey_path: /etc/ssl/private/ansible.com.pem
-    acme_challenge_path: /etc/ssl/challenges/ansible.com/
-    force: true
+- name: Force (re-)generate a new Let's Encrypt Certificate
+  community.crypto.x509_certificate:
+    path: /etc/ssl/crt/ansible.com.crt
+    csr_path: /etc/ssl/csr/ansible.com.csr
+    provider: acme
+    acme_accountkey_path: /etc/ssl/private/ansible.com.pem
+    acme_challenge_path: /etc/ssl/challenges/ansible.com/
+    force: true
 
-- name: Generate an Entrust certificate via the Entrust Certificate Services (ECS) API
-  community.crypto.x509_certificate:
-    path: /etc/ssl/crt/ansible.com.crt
-    csr_path: /etc/ssl/csr/ansible.com.csr
-    provider: entrust
-    entrust_requester_name: Jo Doe
-    entrust_requester_email: jdoe@ansible.com
-    entrust_requester_phone: 555-555-5555
-    entrust_cert_type: STANDARD_SSL
-    entrust_api_user: apiusername
-    entrust_api_key: a^lv*32!cd9LnT
-    entrust_api_client_cert_path: /etc/ssl/entrust/ecs-client.crt
-    entrust_api_client_cert_key_path: /etc/ssl/entrust/ecs-key.crt
-    entrust_api_specification_path: /etc/ssl/entrust/api-docs/cms-api-2.1.0.yaml
+- name: Generate an Entrust certificate via the Entrust Certificate Services (ECS) API
+  community.crypto.x509_certificate:
+    path: /etc/ssl/crt/ansible.com.crt
+    csr_path: /etc/ssl/csr/ansible.com.csr
+    provider: entrust
+    entrust_requester_name: Jo Doe
+    entrust_requester_email: jdoe@ansible.com
+    entrust_requester_phone: 555-555-5555
+    entrust_cert_type: STANDARD_SSL
+    entrust_api_user: apiusername
+    entrust_api_key: a^lv*32!cd9LnT
+    entrust_api_client_cert_path: /etc/ssl/entrust/ecs-client.crt
+    entrust_api_client_cert_key_path: /etc/ssl/entrust/ecs-key.crt
+    entrust_api_specification_path: /etc/ssl/entrust/api-docs/cms-api-2.1.0.yaml
 
-# The following example shows how to emulate the behavior of the removed
-# "assertonly" provider with the x509_certificate_info, openssl_csr_info,
-# openssl_privatekey_info and assert modules:
+# The following example shows how to emulate the behavior of the removed
+# "assertonly" provider with the x509_certificate_info, openssl_csr_info,
+# openssl_privatekey_info and assert modules:
 
-- name: Get certificate information
-  community.crypto.x509_certificate_info:
-    path: /etc/ssl/crt/ansible.com.crt
-    # for valid_at, invalid_at and valid_in
-    valid_at:
-      one_day_ten_hours: "+1d10h"
-      fixed_timestamp: 20200331202428Z
-      ten_seconds: "+10"
-  register: result
+- name: Get certificate information
+  community.crypto.x509_certificate_info:
+    path: /etc/ssl/crt/ansible.com.crt
+    # for valid_at, invalid_at and valid_in
+    valid_at:
+      one_day_ten_hours: "+1d10h"
+      fixed_timestamp: 20200331202428Z
+      ten_seconds: "+10"
+  register: result
 
-- name: Get CSR information
-  community.crypto.openssl_csr_info:
-    # Verifies that the CSR signature is valid; module will fail if not
-    path: /etc/ssl/csr/ansible.com.csr
-  register: result_csr
+- name: Get CSR information
+  community.crypto.openssl_csr_info:
+    # Verifies that the CSR signature is valid; module will fail if not
+    path: /etc/ssl/csr/ansible.com.csr
+  register: result_csr
 
-- name: Get private key information
-  community.crypto.openssl_privatekey_info:
-    path: /etc/ssl/csr/ansible.com.key
-  register: result_privatekey
+- name: Get private key information
+  community.crypto.openssl_privatekey_info:
+    path: /etc/ssl/csr/ansible.com.key
+  register: result_privatekey
 
-- assert:
-    that:
-      # When private key was specified for assertonly, this was checked:
-      - result.public_key == result_privatekey.public_key
-      # When CSR was specified for assertonly, this was checked:
-      - result.public_key == result_csr.public_key
-      - result.subject_ordered == result_csr.subject_ordered
-      - result.extensions_by_oid == result_csr.extensions_by_oid
-      # signature_algorithms check
-      - "result.signature_algorithm == 'sha256WithRSAEncryption' or result.signature_algorithm == 'sha512WithRSAEncryption'"
-      # subject and subject_strict
-      - "result.subject.commonName == 'ansible.com'"
-      - "result.subject | length == 1"  # the number must be the number of entries you check for
-      # issuer and issuer_strict
-      - "result.issuer.commonName == 'ansible.com'"
-      - "result.issuer | length == 1"  # the number must be the number of entries you check for
-      # has_expired
-      - not result.expired
-      # version
-      - result.version == 3
-      # key_usage and key_usage_strict
-      - "'Data Encipherment' in result.key_usage"
-      - "result.key_usage | length == 1"  # the number must be the number of entries you check for
-      # extended_key_usage and extended_key_usage_strict
-      - "'DVCS' in result.extended_key_usage"
-      - "result.extended_key_usage | length == 1"  # the number must be the number of entries you check for
-      # subject_alt_name and subject_alt_name_strict
-      - "'dns:ansible.com' in result.subject_alt_name"
-      - "result.subject_alt_name | length == 1"  # the number must be the number of entries you check for
-      # not_before and not_after
-      - "result.not_before == '20190331202428Z'"
-      - "result.not_after == '20190413202428Z'"
-      # valid_at, invalid_at and valid_in
-      - "result.valid_at.one_day_ten_hours"  # for valid_at
-      - "not result.valid_at.fixed_timestamp"  # for invalid_at
-      - "result.valid_at.ten_seconds"  # for valid_in
+- assert:
+    that:
+      # When private key was specified for assertonly, this was checked:
+      - result.public_key == result_privatekey.public_key
+      # When CSR was specified for assertonly, this was checked:
+      - result.public_key == result_csr.public_key
+      - result.subject_ordered == result_csr.subject_ordered
+      - result.extensions_by_oid == result_csr.extensions_by_oid
+      # signature_algorithms check
+      - "result.signature_algorithm == 'sha256WithRSAEncryption' or result.signature_algorithm == 'sha512WithRSAEncryption'"
+      # subject and subject_strict
+      - "result.subject.commonName == 'ansible.com'"
+      - "result.subject | length == 1"  # the number must be the number of entries you check for
+      # issuer and issuer_strict
+      - "result.issuer.commonName == 'ansible.com'"
+      - "result.issuer | length == 1"  # the number must be the number of entries you check for
+      # has_expired
+      - not result.expired
+      # version
+      - result.version == 3
+      # key_usage and key_usage_strict
+      - "'Data Encipherment' in result.key_usage"
+      - "result.key_usage | length == 1"  # the number must be the number of entries you check for
+      # extended_key_usage and extended_key_usage_strict
+      - "'DVCS' in result.extended_key_usage"
+      - "result.extended_key_usage | length == 1"  # the number must be the number of entries you check for
+      # subject_alt_name and subject_alt_name_strict
+      - "'dns:ansible.com' in result.subject_alt_name"
+      - "result.subject_alt_name | length == 1"  # the number must be the number of entries you check for
+      # not_before and not_after
+      - "result.not_before == '20190331202428Z'"
+      - "result.not_after == '20190413202428Z'"
+      # valid_at, invalid_at and valid_in
+      - "result.valid_at.one_day_ten_hours"  # for valid_at
+      - "not result.valid_at.fixed_timestamp"  # for invalid_at
+      - "result.valid_at.ten_seconds"  # for valid_in
 

 

 
diff --git a/branch/main/x509_certificate_pipe_module.html b/branch/main/x509_certificate_pipe_module.html
index 07879c9b..19d24d88 100644
--- a/branch/main/x509_certificate_pipe_module.html
+++ b/branch/main/x509_certificate_pipe_module.html
@@ -687,65 +687,65 @@ see 
 
Examples

-
- name: Generate a Self Signed OpenSSL certificate
-  community.crypto.x509_certificate_pipe:
-    provider: selfsigned
-    privatekey_path: /etc/ssl/private/ansible.com.pem
-    csr_path: /etc/ssl/csr/ansible.com.csr
-  register: result
-- name: Print the certificate
-  ansible.builtin.debug:
-    var: result.certificate
+
- name: Generate a Self Signed OpenSSL certificate
+  community.crypto.x509_certificate_pipe:
+    provider: selfsigned
+    privatekey_path: /etc/ssl/private/ansible.com.pem
+    csr_path: /etc/ssl/csr/ansible.com.csr
+  register: result
+- name: Print the certificate
+  ansible.builtin.debug:
+    var: result.certificate
 
-# In the following example, both CSR and certificate file are stored on the
-# machine where ansible-playbook is executed, while the OwnCA data (certificate,
-# private key) are stored on the remote machine.
+# In the following example, both CSR and certificate file are stored on the
+# machine where ansible-playbook is executed, while the OwnCA data (certificate,
+# private key) are stored on the remote machine.
 
-- name: (1/2) Generate an OpenSSL Certificate with the CSR provided inline
-  community.crypto.x509_certificate_pipe:
-    provider: ownca
-    content: "{{ lookup('file', '/etc/ssl/csr/www.ansible.com.crt') }}"
-    csr_content: "{{ lookup('file', '/etc/ssl/csr/www.ansible.com.csr') }}"
-    ownca_cert: /path/to/ca_cert.crt
-    ownca_privatekey: /path/to/ca_cert.key
-    ownca_privatekey_passphrase: hunter2
-  register: result
+- name: (1/2) Generate an OpenSSL Certificate with the CSR provided inline
+  community.crypto.x509_certificate_pipe:
+    provider: ownca
+    content: "{{ lookup('file', '/etc/ssl/csr/www.ansible.com.crt') }}"
+    csr_content: "{{ lookup('file', '/etc/ssl/csr/www.ansible.com.csr') }}"
+    ownca_cert: /path/to/ca_cert.crt
+    ownca_privatekey: /path/to/ca_cert.key
+    ownca_privatekey_passphrase: hunter2
+  register: result
 
-- name: (2/2) Store certificate
-  ansible.builtin.copy:
-    dest: /etc/ssl/csr/www.ansible.com.crt
-    content: "{{ result.certificate }}"
-  delegate_to: localhost
-  when: result is changed
+- name: (2/2) Store certificate
+  ansible.builtin.copy:
+    dest: /etc/ssl/csr/www.ansible.com.crt
+    content: "{{ result.certificate }}"
+  delegate_to: localhost
+  when: result is changed
 
-# In the following example, the certificate from another machine is signed by
-# our OwnCA whose private key and certificate are only available on this
-# machine (where ansible-playbook is executed), without having to write
-# the certificate file to disk on localhost. The CSR could have been
-# provided by community.crypto.openssl_csr_pipe earlier, or also have been
-# read from the remote machine.
+# In the following example, the certificate from another machine is signed by
+# our OwnCA whose private key and certificate are only available on this
+# machine (where ansible-playbook is executed), without having to write
+# the certificate file to disk on localhost. The CSR could have been
+# provided by community.crypto.openssl_csr_pipe earlier, or also have been
+# read from the remote machine.
 
-- name: (1/3) Read certificate's contents from remote machine
-  ansible.builtin.slurp:
-    src: /etc/ssl/csr/www.ansible.com.crt
-  register: certificate_content
+- name: (1/3) Read certificate's contents from remote machine
+  ansible.builtin.slurp:
+    src: /etc/ssl/csr/www.ansible.com.crt
+  register: certificate_content
 
-- name: (2/3) Generate an OpenSSL Certificate with the CSR provided inline
-  community.crypto.x509_certificate_pipe:
-    provider: ownca
-    content: "{{ certificate_content.content | b64decode }}"
-    csr_content: "{{ the_csr }}"
-    ownca_cert: /path/to/ca_cert.crt
-    ownca_privatekey: /path/to/ca_cert.key
-    ownca_privatekey_passphrase: hunter2
-  delegate_to: localhost
-  register: result
+- name: (2/3) Generate an OpenSSL Certificate with the CSR provided inline
+  community.crypto.x509_certificate_pipe:
+    provider: ownca
+    content: "{{ certificate_content.content | b64decode }}"
+    csr_content: "{{ the_csr }}"
+    ownca_cert: /path/to/ca_cert.crt
+    ownca_privatekey: /path/to/ca_cert.key
+    ownca_privatekey_passphrase: hunter2
+  delegate_to: localhost
+  register: result
 
-- name: (3/3) Store certificate
-  ansible.builtin.copy:
-    dest: /etc/ssl/csr/www.ansible.com.crt
-    content: "{{ result.certificate }}"
-  when: result is changed
+- name: (3/3) Store certificate
+  ansible.builtin.copy:
+    dest: /etc/ssl/csr/www.ansible.com.crt
+    content: "{{ result.certificate }}"
+  when: result is changed
 

 

 
diff --git a/branch/main/x509_crl_info_filter.html b/branch/main/x509_crl_info_filter.html
index 176bc77f..a8de2369 100644
--- a/branch/main/x509_crl_info_filter.html
+++ b/branch/main/x509_crl_info_filter.html
@@ -270,15 +270,15 @@ see 
 
Examples

-
- name: Show the Organization Name of the CRL's subject
-  ansible.builtin.debug:
-    msg: >-
+
- name: Show the Organization Name of the CRL's subject
+  ansible.builtin.debug:
+    msg: >-
       {{
         (
           lookup('ansible.builtin.file', '/path/to/cert.pem')
           | community.crypto.x509_crl_info
         ).issuer.organizationName
-      }}
+      }}
 

 

 
diff --git a/branch/main/x509_crl_info_module.html b/branch/main/x509_crl_info_module.html
index 7320b0f2..861f24a0 100644
--- a/branch/main/x509_crl_info_module.html
+++ b/branch/main/x509_crl_info_module.html
@@ -310,20 +310,20 @@ see 
 
Examples

-
- name: Get information on CRL
-  community.crypto.x509_crl_info:
-    path: /etc/ssl/my-ca.crl
-  register: result
+
- name: Get information on CRL
+  community.crypto.x509_crl_info:
+    path: /etc/ssl/my-ca.crl
+  register: result
 
-- name: Print the information
-  ansible.builtin.debug:
-    msg: "{{ result }}"
+- name: Print the information
+  ansible.builtin.debug:
+    msg: "{{ result }}"
 
-- name: Get information on CRL without list of revoked certificates
-  community.crypto.x509_crl_info:
-    path: /etc/ssl/very-large.crl
-    list_revoked_certificates: false
-  register: result
+- name: Get information on CRL without list of revoked certificates
+  community.crypto.x509_crl_info:
+    path: /etc/ssl/very-large.crl
+    list_revoked_certificates: false
+  register: result
 

 

 
diff --git a/branch/main/x509_crl_module.html b/branch/main/x509_crl_module.html
index 537740d5..0aa394c0 100644
--- a/branch/main/x509_crl_module.html
+++ b/branch/main/x509_crl_module.html
@@ -645,25 +645,25 @@ see 
 
Examples

-
- name: Generate a CRL
-  community.crypto.x509_crl:
-    path: /etc/ssl/my-ca.crl
-    privatekey_path: /etc/ssl/private/my-ca.pem
-    issuer:
-      CN: My CA
-    last_update: "+0s"
-    next_update: "+7d"
-    revoked_certificates:
-      - serial_number: 1234
-        revocation_date: 20190331202428Z
-        issuer:
-          CN: My CA
-      - serial_number: 2345
-        revocation_date: 20191013152910Z
-        reason: affiliation_changed
-        invalidity_date: 20191001000000Z
-      - path: /etc/ssl/crt/revoked-cert.pem
-        revocation_date: 20191010010203Z
+
- name: Generate a CRL
+  community.crypto.x509_crl:
+    path: /etc/ssl/my-ca.crl
+    privatekey_path: /etc/ssl/private/my-ca.pem
+    issuer:
+      CN: My CA
+    last_update: "+0s"
+    next_update: "+7d"
+    revoked_certificates:
+      - serial_number: 1234
+        revocation_date: 20190331202428Z
+        issuer:
+          CN: My CA
+      - serial_number: 2345
+        revocation_date: 20191013152910Z
+        reason: affiliation_changed
+        invalidity_date: 20191001000000Z
+      - path: /etc/ssl/crt/revoked-cert.pem
+        revocation_date: 20191010010203Z