Remove support for cryptography < 3.4 (#878)

* Stop passing backend to cryptography. * Make public_bytes() fallback the default. * Remove compatibility code for older cryptography versions. * Require cryptography 3.4+. * Restrict to cryptography >= 3.4 in integration tests. * Remove Debian Bullseye from CI. It only supports cryptography 3.3. * Improve imports. * Remove no longer existing conditional.
2026-05-06 13:22:58 +00:00 · 2025-05-02 15:27:18 +02:00
parent e8fec768cc
commit 5231ac8f3f
102 changed files with 668 additions and 1217 deletions
--- a/plugins/modules/acme_challenge_cert_helper.py
+++ b/plugins/modules/acme_challenge_cert_helper.py
@@ -22,7 +22,7 @@ seealso:
    description: The specification of the C(tls-alpn-01) challenge (RFC 8737).
    link: https://www.rfc-editor.org/rfc/rfc8737.html
 requirements:
-  - "cryptography >= 1.3"
+  - "cryptography >= 3.4"
 extends_documentation_fragment:
  - community.crypto.attributes
 attributes:
@@ -184,8 +184,7 @@ try:
    import cryptography.x509
    import cryptography.x509.oid

-    HAS_CRYPTOGRAPHY = LooseVersion(cryptography.__version__) >= LooseVersion("1.3")
-    _cryptography_backend = cryptography.hazmat.backends.default_backend()
+    HAS_CRYPTOGRAPHY = LooseVersion(cryptography.__version__) >= LooseVersion("3.4")
 except ImportError:
    CRYPTOGRAPHY_IMP_ERR = traceback.format_exc()
    HAS_CRYPTOGRAPHY = False
@@ -216,10 +215,10 @@ def main():
        # Some callbacks die when exception is provided with value None
        if CRYPTOGRAPHY_IMP_ERR:
            module.fail_json(
-                msg=missing_required_lib("cryptography >= 1.3"),
+                msg=missing_required_lib("cryptography >= 3.4"),
                exception=CRYPTOGRAPHY_IMP_ERR,
            )
-        module.fail_json(msg=missing_required_lib("cryptography >= 1.3"))
+        module.fail_json(msg=missing_required_lib("cryptography >= 3.4"))

    try:
        # Get parameters
@@ -242,7 +241,6 @@ def main():
                        if private_key_passphrase is not None
                        else None
                    ),
-                    backend=_cryptography_backend,
                )
            )
        except Exception as e:
@@ -283,7 +281,6 @@ def main():
        regular_certificate = cert_builder.sign(
            private_key,
            cryptography.hazmat.primitives.hashes.SHA256(),
-            _cryptography_backend,
        )

        # Process challenge
@@ -312,7 +309,6 @@ def main():
            challenge_certificate = cert_builder.sign(
                private_key,
                cryptography.hazmat.primitives.hashes.SHA256(),
-                _cryptography_backend,
            )

        module.exit_json(
--- a/plugins/modules/certificate_complete_chain.py
+++ b/plugins/modules/certificate_complete_chain.py
@@ -18,7 +18,7 @@ description:
    that the signature is correct. It ignores validity dates and key usage completely. If you need to verify that a generated
    chain is valid, please use C(openssl verify ...).
 requirements:
-  - "cryptography >= 1.5"
+  - "cryptography >= 3.4"
 extends_documentation_fragment:
  - community.crypto.attributes
  - community.crypto.attributes.idempotent_not_modify_state
@@ -126,10 +126,6 @@ import traceback

 from ansible.module_utils.basic import AnsibleModule, missing_required_lib
 from ansible.module_utils.common.text.converters import to_bytes
-from ansible_collections.community.crypto.plugins.module_utils.crypto.basic import (
-    CRYPTOGRAPHY_HAS_ED448_SIGN,
-    CRYPTOGRAPHY_HAS_ED25519_SIGN,
-)
 from ansible_collections.community.crypto.plugins.module_utils.crypto.pem import (
    split_pem_list,
 )
@@ -152,8 +148,7 @@ try:
    import cryptography.x509
    import cryptography.x509.oid

-    HAS_CRYPTOGRAPHY = LooseVersion(cryptography.__version__) >= LooseVersion("1.5")
-    _cryptography_backend = cryptography.hazmat.backends.default_backend()
+    HAS_CRYPTOGRAPHY = LooseVersion(cryptography.__version__) >= LooseVersion("3.4")
 except ImportError:
    CRYPTOGRAPHY_IMP_ERR = traceback.format_exc()
    HAS_CRYPTOGRAPHY = False
@@ -201,12 +196,12 @@ def is_parent(module, cert, potential_parent):
                    cert.cert.signature_hash_algorithm
                ),
            )
-        elif CRYPTOGRAPHY_HAS_ED25519_SIGN and isinstance(
+        elif isinstance(
            public_key,
            cryptography.hazmat.primitives.asymmetric.ed25519.Ed25519PublicKey,
        ):
            public_key.verify(cert.cert.signature, cert.cert.tbs_certificate_bytes)
-        elif CRYPTOGRAPHY_HAS_ED448_SIGN and isinstance(
+        elif isinstance(
            public_key, cryptography.hazmat.primitives.asymmetric.ed448.Ed448PublicKey
        ):
            public_key.verify(cert.cert.signature, cert.cert.tbs_certificate_bytes)
@@ -232,9 +227,7 @@ def parse_PEM_list(module, text, source, fail_on_error=True):
    for cert_pem in split_pem_list(text):
        # Try to load PEM certificate
        try:
-            cert = cryptography.x509.load_pem_x509_certificate(
-                to_bytes(cert_pem), _cryptography_backend
-            )
+            cert = cryptography.x509.load_pem_x509_certificate(to_bytes(cert_pem))
            result.append(Certificate(cert_pem, cert))
        except Exception as e:
            msg = f"Cannot parse certificate #{len(result) + 1} from {source}: {e}"
@@ -338,7 +331,7 @@ def main():

    if not HAS_CRYPTOGRAPHY:
        module.fail_json(
-            msg=missing_required_lib("cryptography >= 1.5"),
+            msg=missing_required_lib("cryptography >= 3.4"),
            exception=CRYPTOGRAPHY_IMP_ERR,
        )

--- a/plugins/modules/crypto_info.py
+++ b/plugins/modules/crypto_info.py
@@ -154,22 +154,6 @@ openssl:
 import traceback

 from ansible.module_utils.basic import AnsibleModule
-from ansible_collections.community.crypto.plugins.module_utils.crypto.basic import (
-    CRYPTOGRAPHY_HAS_DSA,
-    CRYPTOGRAPHY_HAS_DSA_SIGN,
-    CRYPTOGRAPHY_HAS_EC,
-    CRYPTOGRAPHY_HAS_EC_SIGN,
-    CRYPTOGRAPHY_HAS_ED448,
-    CRYPTOGRAPHY_HAS_ED448_SIGN,
-    CRYPTOGRAPHY_HAS_ED25519,
-    CRYPTOGRAPHY_HAS_ED25519_SIGN,
-    CRYPTOGRAPHY_HAS_RSA,
-    CRYPTOGRAPHY_HAS_RSA_SIGN,
-    CRYPTOGRAPHY_HAS_X448,
-    CRYPTOGRAPHY_HAS_X25519,
-    CRYPTOGRAPHY_HAS_X25519_FULL,
-    HAS_CRYPTOGRAPHY,
-)


 try:
@@ -185,9 +169,11 @@ try:
 except ImportError:
    UnsupportedAlgorithm = Exception
    CryptographyInternalError = Exception
+    HAS_CRYPTOGRAPHY = False
    CRYPTOGRAPHY_VERSION = None
    CRYPTOGRAPHY_IMP_ERR = traceback.format_exc()
 else:
+    HAS_CRYPTOGRAPHY = True
    CRYPTOGRAPHY_VERSION = cryptography.__version__
    CRYPTOGRAPHY_IMP_ERR = None

@@ -222,64 +208,153 @@ def add_crypto_information(module):
        result["python_cryptography_import_error"] = CRYPTOGRAPHY_IMP_ERR
        return result

-    has_ed25519 = CRYPTOGRAPHY_HAS_ED25519
-    if has_ed25519:
-        try:
-            from cryptography.hazmat.primitives.asymmetric.ed25519 import (
-                Ed25519PrivateKey,
-            )
+    # Test for DSA
+    has_dsa = False
+    has_dsa_sign = False
+    try:
+        # added in 0.5 - https://cryptography.io/en/latest/hazmat/primitives/asymmetric/dsa/
+        import cryptography.hazmat.primitives.asymmetric.dsa

+        has_dsa = True
+        try:
+            # added later in 1.5
+            cryptography.hazmat.primitives.asymmetric.dsa.DSAPrivateKey.sign
+            has_dsa_sign = True
+        except AttributeError:
+            pass
+    except ImportError:
+        pass
+
+    # Test for RSA
+    has_rsa = False
+    has_rsa_sign = False
+    try:
+        # added in 0.5 - https://cryptography.io/en/latest/hazmat/primitives/asymmetric/rsa/
+        import cryptography.hazmat.primitives.asymmetric.rsa
+
+        has_rsa = True
+        try:
+            # added later in 1.4
+            cryptography.hazmat.primitives.asymmetric.rsa.RSAPrivateKey.sign
+            has_rsa_sign = True
+        except AttributeError:
+            pass
+    except ImportError:
+        pass
+
+    # Test for Ed25519
+    has_ed25519 = False
+    has_ed25519_sign = False
+    try:
+        # added in 2.6 - https://cryptography.io/en/latest/hazmat/primitives/asymmetric/ed25519/
+        import cryptography.hazmat.primitives.asymmetric.ed25519
+        from cryptography.hazmat.primitives.asymmetric.ed25519 import (
+            Ed25519PrivateKey,
+        )
+
+        try:
            Ed25519PrivateKey.from_private_bytes(b"")
        except ValueError:
            pass
-        except UnsupportedAlgorithm:
-            has_ed25519 = False

-    has_ed448 = CRYPTOGRAPHY_HAS_ED448
-    if has_ed448:
+        has_ed25519 = True
        try:
-            from cryptography.hazmat.primitives.asymmetric.ed448 import Ed448PrivateKey
+            # added with the primitive in 2.6
+            cryptography.hazmat.primitives.asymmetric.ed25519.Ed25519PrivateKey.sign
+            has_ed25519_sign = True
+        except AttributeError:
+            pass
+    except (ImportError, UnsupportedAlgorithm):
+        pass

+    # Test for Ed448
+    has_ed448 = False
+    has_ed448_sign = False
+    try:
+        # added in 2.6 - https://cryptography.io/en/latest/hazmat/primitives/asymmetric/ed448/
+        import cryptography.hazmat.primitives.asymmetric.ed448
+        from cryptography.hazmat.primitives.asymmetric.ed448 import Ed448PrivateKey
+
+        try:
            Ed448PrivateKey.from_private_bytes(b"")
        except ValueError:
            pass
-        except UnsupportedAlgorithm:
-            has_ed448 = False

-    has_x25519 = CRYPTOGRAPHY_HAS_X25519
-    if has_x25519:
+        has_ed448 = True
        try:
-            from cryptography.hazmat.primitives.asymmetric.x25519 import (
-                X25519PrivateKey,
-            )
+            # added with the primitive in 2.6
+            cryptography.hazmat.primitives.asymmetric.ed448.Ed448PrivateKey.sign
+            has_ed448_sign = True
+        except AttributeError:
+            pass
+    except (ImportError, UnsupportedAlgorithm):
+        pass

-            if CRYPTOGRAPHY_HAS_X25519_FULL:
-                X25519PrivateKey.from_private_bytes(b"")
+    # Test for X25519
+    has_x25519 = False
+    has_x25519_full = False
+    try:
+        # added in 2.0 - https://cryptography.io/en/latest/hazmat/primitives/asymmetric/x25519/
+        import cryptography.hazmat.primitives.asymmetric.x25519
+
+        try:
+            # added later in 2.5
+            cryptography.hazmat.primitives.asymmetric.x25519.X25519PrivateKey.private_bytes
+            full = True
+        except AttributeError:
+            full = False
+
+        try:
+            if full:
+                cryptography.hazmat.primitives.asymmetric.x25519.X25519PrivateKey.from_private_bytes(
+                    b""
+                )
            else:
                # Some versions do not support serialization and deserialization - use generate() instead
-                X25519PrivateKey.generate()
+                cryptography.hazmat.primitives.asymmetric.x25519.X25519PrivateKey.generate()
        except ValueError:
            pass
-        except UnsupportedAlgorithm:
-            has_x25519 = False

-    has_x448 = CRYPTOGRAPHY_HAS_X448
-    if has_x448:
+        has_x25519 = True
+        has_x25519_full = full
+    except (ImportError, UnsupportedAlgorithm):
+        pass
+
+    # Test for X448
+    has_x448 = False
+    try:
+        # added in 2.5 - https://cryptography.io/en/latest/hazmat/primitives/asymmetric/x448/
+        import cryptography.hazmat.primitives.asymmetric.x448
+
        try:
            from cryptography.hazmat.primitives.asymmetric.x448 import X448PrivateKey

            X448PrivateKey.from_private_bytes(b"")
        except ValueError:
            pass
-        except UnsupportedAlgorithm:
-            has_x448 = False

+        has_x448 = True
+    except (ImportError, UnsupportedAlgorithm):
+        pass
+
+    # Test for ECC
+    has_ec = False
+    has_ec_sign = False
    curves = []
-    if CRYPTOGRAPHY_HAS_EC:
-        import cryptography.hazmat.backends
+    try:
+        # added in 0.5 - https://cryptography.io/en/latest/hazmat/primitives/asymmetric/ec/
        import cryptography.hazmat.primitives.asymmetric.ec

-        backend = cryptography.hazmat.backends.default_backend()
+        has_ec = True
+        try:
+            # added later in 1.5
+            cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePrivateKey.sign
+            has_ec_sign = True
+        except AttributeError:
+            pass
+    except ImportError:
+        pass
+    else:
        for curve_name, constructor_name in CURVES:
            ecclass = cryptography.hazmat.primitives.asymmetric.ec.__dict__.get(
                constructor_name
@@ -287,7 +362,7 @@ def add_crypto_information(module):
            if ecclass:
                try:
                    cryptography.hazmat.primitives.asymmetric.ec.generate_private_key(
-                        curve=ecclass(), backend=backend
+                        curve=ecclass()
                    )
                    curves.append(curve_name)
                except UnsupportedAlgorithm:
@@ -300,21 +375,22 @@ def add_crypto_information(module):
                    # curves removed.
                    pass

+    # Compose result
    info = {
        "version": CRYPTOGRAPHY_VERSION,
        "curves": curves,
-        "has_ec": CRYPTOGRAPHY_HAS_EC,
-        "has_ec_sign": CRYPTOGRAPHY_HAS_EC_SIGN,
+        "has_ec": has_ec,
+        "has_ec_sign": has_ec_sign,
        "has_ed25519": has_ed25519,
-        "has_ed25519_sign": has_ed25519 and CRYPTOGRAPHY_HAS_ED25519_SIGN,
+        "has_ed25519_sign": has_ed25519_sign,
        "has_ed448": has_ed448,
-        "has_ed448_sign": has_ed448 and CRYPTOGRAPHY_HAS_ED448_SIGN,
-        "has_dsa": CRYPTOGRAPHY_HAS_DSA,
-        "has_dsa_sign": CRYPTOGRAPHY_HAS_DSA_SIGN,
-        "has_rsa": CRYPTOGRAPHY_HAS_RSA,
-        "has_rsa_sign": CRYPTOGRAPHY_HAS_RSA_SIGN,
+        "has_ed448_sign": has_ed448_sign,
+        "has_dsa": has_dsa,
+        "has_dsa_sign": has_dsa_sign,
+        "has_rsa": has_rsa,
+        "has_rsa_sign": has_rsa_sign,
        "has_x25519": has_x25519,
-        "has_x25519_serialization": has_x25519 and CRYPTOGRAPHY_HAS_X25519_FULL,
+        "has_x25519_serialization": has_x25519 and has_x25519_full,
        "has_x448": has_x448,
    }
    result["python_cryptography_capabilities"] = info
--- a/plugins/modules/ecs_certificate.py
+++ b/plugins/modules/ecs_certificate.py
@@ -20,7 +20,7 @@ description:
 notes:
  - O(path) must be specified as the output location of the certificate.
 requirements:
-  - cryptography >= 1.6
+  - cryptography >= 3.4
 extends_documentation_fragment:
  - community.crypto.attributes
  - community.crypto.attributes.files
@@ -581,7 +581,7 @@ except ImportError:
 else:
    CRYPTOGRAPHY_FOUND = True

-MINIMAL_CRYPTOGRAPHY_VERSION = "1.6"
+MINIMAL_CRYPTOGRAPHY_VERSION = "3.4"


 def validate_cert_expiry(cert_expiry):
--- a/plugins/modules/get_certificate.py
+++ b/plugins/modules/get_certificate.py
@@ -121,7 +121,7 @@ notes:
  - When using ca_cert on OS X it has been reported that in some conditions the validate will always succeed.
 requirements:
  - "Python >= 3.10 when O(get_certificate_chain=true)"
-  - "cryptography >= 1.6"
+  - "cryptography >= 3.4"

 seealso:
  - plugin: community.crypto.to_serial
@@ -292,14 +292,13 @@ from ansible_collections.community.crypto.plugins.module_utils.version import (
 )


-MINIMAL_CRYPTOGRAPHY_VERSION = "1.6"
+MINIMAL_CRYPTOGRAPHY_VERSION = "3.4"

 CRYPTOGRAPHY_IMP_ERR = None
 try:
    import cryptography
    import cryptography.exceptions
    import cryptography.x509
-    from cryptography.hazmat.backends import default_backend as cryptography_backend

    CRYPTOGRAPHY_VERSION = LooseVersion(cryptography.__version__)
 except ImportError:
@@ -528,9 +527,7 @@ def main():
    result["cert"] = cert

    if backend == "cryptography":
-        x509 = cryptography.x509.load_pem_x509_certificate(
-            to_bytes(cert), cryptography_backend()
-        )
+        x509 = cryptography.x509.load_pem_x509_certificate(to_bytes(cert))
        result["subject"] = {}
        for attribute in x509.subject:
            result["subject"][cryptography_oid_to_name(attribute.oid, short=True)] = (
--- a/plugins/modules/openssh_keypair.py
+++ b/plugins/modules/openssh_keypair.py
@@ -15,8 +15,7 @@ description:
    V(rsa), V(dsa), V(rsa1), V(ed25519) or V(ecdsa) private keys.
 requirements:
  - ssh-keygen (if O(backend=openssh))
-  - cryptography >= 2.6 (if O(backend=cryptography) and OpenSSH < 7.8 is installed)
-  - cryptography >= 3.0 (if O(backend=cryptography) and OpenSSH >= 7.8 is installed)
+  - cryptography >= 3.4 (if O(backend=cryptography))
 extends_documentation_fragment:
  - ansible.builtin.files
  - community.crypto.attributes
--- a/plugins/modules/openssl_csr_info.py
+++ b/plugins/modules/openssl_csr_info.py
@@ -15,7 +15,7 @@ description:
  - In case the CSR signature cannot be validated, the module will fail. In this case, all return variables are still returned.
  - It uses the cryptography python library to interact with OpenSSL.
 requirements:
-  - cryptography >= 1.3
+  - cryptography >= 3.4
 author:
  - Felix Fontein (@felixfontein)
  - Yanis Guenane (@Spredzy)
--- a/plugins/modules/openssl_dhparam.py
+++ b/plugins/modules/openssl_dhparam.py
@@ -17,7 +17,7 @@ description:
  - The module can use the cryptography Python library, or the C(openssl) executable. By default, it tries to detect which
    one is available. This can be overridden with the O(select_crypto_backend) option.
 requirements:
-  - Either cryptography >= 2.0
+  - Either cryptography >= 3.4
  - Or OpenSSL binary C(openssl)
 author:
  - Thom Wiggers (@thomwiggers)
@@ -148,7 +148,7 @@ from ansible_collections.community.crypto.plugins.module_utils.version import (
 )


-MINIMAL_CRYPTOGRAPHY_VERSION = "2.0"
+MINIMAL_CRYPTOGRAPHY_VERSION = "3.4"

 CRYPTOGRAPHY_IMP_ERR = None
 try:
@@ -322,7 +322,6 @@ class DHParameterCryptography(DHParameterBase):

    def __init__(self, module):
        super(DHParameterCryptography, self).__init__(module)
-        self.crypto_backend = cryptography.hazmat.backends.default_backend()

    def _do_generate(self, module):
        """Actually generate the DH params."""
@@ -330,7 +329,6 @@ class DHParameterCryptography(DHParameterBase):
        params = cryptography.hazmat.primitives.asymmetric.dh.generate_parameters(
            generator=2,
            key_size=self.size,
-            backend=self.crypto_backend,
        )
        # Serialize parameters
        result = params.parameter_bytes(
@@ -349,7 +347,7 @@ class DHParameterCryptography(DHParameterBase):
            with open(self.path, "rb") as f:
                data = f.read()
            params = cryptography.hazmat.primitives.serialization.load_pem_parameters(
-                data, backend=self.crypto_backend
+                data
            )
        except Exception:
            return False
--- a/plugins/modules/openssl_pkcs12.py
+++ b/plugins/modules/openssl_pkcs12.py
@@ -15,7 +15,7 @@ description:
  - This module allows one to (re-)generate PKCS#12.
  - The module uses the cryptography Python library.
 requirements:
-  - cryptography >= 3.0
+  - cryptography >= 3.4
 extends_documentation_fragment:
  - ansible.builtin.files
  - community.crypto.attributes
@@ -305,7 +305,7 @@ from ansible_collections.community.crypto.plugins.module_utils.version import (
 )


-MINIMAL_CRYPTOGRAPHY_VERSION = "3.0"
+MINIMAL_CRYPTOGRAPHY_VERSION = "3.4"

 CRYPTOGRAPHY_IMP_ERR = None
 try:
--- a/plugins/modules/openssl_privatekey_info.py
+++ b/plugins/modules/openssl_privatekey_info.py
@@ -17,7 +17,7 @@ description:
    V(none) is returned for RV(key_is_consistent).
  - It uses the cryptography python library to interact with OpenSSL.
 requirements:
-  - cryptography >= 1.2.3
+  - cryptography >= 3.4
 author:
  - Felix Fontein (@felixfontein)
  - Yanis Guenane (@Spredzy)
--- a/plugins/modules/openssl_publickey.py
+++ b/plugins/modules/openssl_publickey.py
@@ -15,8 +15,7 @@ description:
    not supported), use the M(community.crypto.openssh_keypair) module to manage these.
  - The module uses the cryptography Python library.
 requirements:
-  - cryptography >= 1.2.3 (older versions might work as well)
-  - Needs cryptography >= 1.4 if O(format) is C(OpenSSH)
+  - cryptography >= 3.4
 author:
  - Yanis Guenane (@Spredzy)
  - Felix Fontein (@felixfontein)
@@ -211,13 +210,11 @@ from ansible_collections.community.crypto.plugins.module_utils.version import (
 )


-MINIMAL_CRYPTOGRAPHY_VERSION = "1.2.3"
-MINIMAL_CRYPTOGRAPHY_VERSION_OPENSSH = "1.4"
+MINIMAL_CRYPTOGRAPHY_VERSION = "3.4"

 CRYPTOGRAPHY_IMP_ERR = None
 try:
    import cryptography
-    from cryptography.hazmat.backends import default_backend
    from cryptography.hazmat.primitives import serialization as crypto_serialization

    CRYPTOGRAPHY_VERSION = LooseVersion(cryptography.__version__)
@@ -354,7 +351,7 @@ class PublicKey(OpenSSLObject):
                    if self.format == "OpenSSH":
                        # Read and dump public key. Makes sure that the comment is stripped off.
                        current_publickey = crypto_serialization.load_ssh_public_key(
-                            publickey_content, backend=default_backend()
+                            publickey_content
                        )
                        publickey_content = current_publickey.public_bytes(
                            crypto_serialization.Encoding.OpenSSH,
@@ -362,7 +359,7 @@ class PublicKey(OpenSSLObject):
                        )
                    else:
                        current_publickey = crypto_serialization.load_pem_public_key(
-                            publickey_content, backend=default_backend()
+                            publickey_content
                        )
                        publickey_content = current_publickey.public_bytes(
                            crypto_serialization.Encoding.PEM,
@@ -442,16 +439,12 @@ def main():
        mutually_exclusive=(["privatekey_path", "privatekey_content"],),
    )

-    minimal_cryptography_version = MINIMAL_CRYPTOGRAPHY_VERSION
-    if module.params["format"] == "OpenSSH":
-        minimal_cryptography_version = MINIMAL_CRYPTOGRAPHY_VERSION_OPENSSH
-
    backend = module.params["select_crypto_backend"]
    if backend == "auto":
        # Detection what is possible
        can_use_cryptography = (
            CRYPTOGRAPHY_FOUND
-            and CRYPTOGRAPHY_VERSION >= LooseVersion(minimal_cryptography_version)
+            and CRYPTOGRAPHY_VERSION >= LooseVersion(MINIMAL_CRYPTOGRAPHY_VERSION)
        )

        # Decision
@@ -461,7 +454,7 @@ def main():
        # Success?
        if backend == "auto":
            module.fail_json(
-                msg=f"Cannot detect the required Python library cryptography (>= {minimal_cryptography_version})",
+                msg=f"Cannot detect the required Python library cryptography (>= {MINIMAL_CRYPTOGRAPHY_VERSION})",
            )

    if module.params["format"] == "OpenSSH" and backend != "cryptography":
@@ -471,7 +464,7 @@ def main():
        if not CRYPTOGRAPHY_FOUND:
            module.fail_json(
                msg=missing_required_lib(
-                    f"cryptography >= {minimal_cryptography_version}"
+                    f"cryptography >= {MINIMAL_CRYPTOGRAPHY_VERSION}"
                ),
                exception=CRYPTOGRAPHY_IMP_ERR,
            )
--- a/plugins/modules/openssl_publickey_info.py
+++ b/plugins/modules/openssl_publickey_info.py
@@ -14,7 +14,7 @@ description:
  - It uses the cryptography python library to interact with OpenSSL.
 version_added: 1.7.0
 requirements:
-  - cryptography >= 1.2.3
+  - cryptography >= 3.4
 author:
  - Felix Fontein (@felixfontein)
 extends_documentation_fragment:
--- a/plugins/modules/openssl_signature.py
+++ b/plugins/modules/openssl_signature.py
@@ -14,7 +14,7 @@ description:
  - This module allows one to sign data using a private key.
  - The module uses the cryptography Python library.
 requirements:
-  - cryptography >= 1.4 (some key types require newer versions)
+  - cryptography >= 3.4
 author:
  - Patrick Pichler (@aveexy)
  - Markus Teufelberger (@MarkusTeufelberger)
@@ -62,10 +62,6 @@ options:
    type: str
    default: auto
    choices: [auto, cryptography]
-notes:
-  - "When using the C(cryptography) backend, the following key types require at least the following C(cryptography) version:\n
-    RSA keys: C(cryptography) >= 1.4\nDSA and ECDSA keys: C(cryptography) >= 1.5\ned448 and ed25519 keys: C(cryptography)
-    >= 2.6."
 seealso:
  - module: community.crypto.openssl_signature_info
  - module: community.crypto.openssl_privatekey
@@ -108,7 +104,7 @@ from ansible_collections.community.crypto.plugins.module_utils.version import (
 )


-MINIMAL_CRYPTOGRAPHY_VERSION = "1.4"
+MINIMAL_CRYPTOGRAPHY_VERSION = "3.4"

 CRYPTOGRAPHY_IMP_ERR = None
 try:
@@ -126,11 +122,6 @@ else:
 from ansible.module_utils.basic import AnsibleModule, missing_required_lib
 from ansible.module_utils.common.text.converters import to_native
 from ansible_collections.community.crypto.plugins.module_utils.crypto.basic import (
-    CRYPTOGRAPHY_HAS_DSA_SIGN,
-    CRYPTOGRAPHY_HAS_EC_SIGN,
-    CRYPTOGRAPHY_HAS_ED448_SIGN,
-    CRYPTOGRAPHY_HAS_ED25519_SIGN,
-    CRYPTOGRAPHY_HAS_RSA_SIGN,
    OpenSSLObjectError,
 )
 from ansible_collections.community.crypto.plugins.module_utils.crypto.support import (
@@ -191,42 +182,37 @@ class SignatureCryptography(SignatureBase):

            signature = None

-            if CRYPTOGRAPHY_HAS_DSA_SIGN:
-                if isinstance(
-                    private_key,
-                    cryptography.hazmat.primitives.asymmetric.dsa.DSAPrivateKey,
-                ):
-                    signature = private_key.sign(_in, _hash)
+            if isinstance(
+                private_key,
+                cryptography.hazmat.primitives.asymmetric.dsa.DSAPrivateKey,
+            ):
+                signature = private_key.sign(_in, _hash)

-            if CRYPTOGRAPHY_HAS_EC_SIGN:
-                if isinstance(
-                    private_key,
-                    cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePrivateKey,
-                ):
-                    signature = private_key.sign(
-                        _in, cryptography.hazmat.primitives.asymmetric.ec.ECDSA(_hash)
-                    )
+            elif isinstance(
+                private_key,
+                cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePrivateKey,
+            ):
+                signature = private_key.sign(
+                    _in, cryptography.hazmat.primitives.asymmetric.ec.ECDSA(_hash)
+                )

-            if CRYPTOGRAPHY_HAS_ED25519_SIGN:
-                if isinstance(
-                    private_key,
-                    cryptography.hazmat.primitives.asymmetric.ed25519.Ed25519PrivateKey,
-                ):
-                    signature = private_key.sign(_in)
+            elif isinstance(
+                private_key,
+                cryptography.hazmat.primitives.asymmetric.ed25519.Ed25519PrivateKey,
+            ):
+                signature = private_key.sign(_in)

-            if CRYPTOGRAPHY_HAS_ED448_SIGN:
-                if isinstance(
-                    private_key,
-                    cryptography.hazmat.primitives.asymmetric.ed448.Ed448PrivateKey,
-                ):
-                    signature = private_key.sign(_in)
+            elif isinstance(
+                private_key,
+                cryptography.hazmat.primitives.asymmetric.ed448.Ed448PrivateKey,
+            ):
+                signature = private_key.sign(_in)

-            if CRYPTOGRAPHY_HAS_RSA_SIGN:
-                if isinstance(
-                    private_key,
-                    cryptography.hazmat.primitives.asymmetric.rsa.RSAPrivateKey,
-                ):
-                    signature = private_key.sign(_in, _padding, _hash)
+            elif isinstance(
+                private_key,
+                cryptography.hazmat.primitives.asymmetric.rsa.RSAPrivateKey,
+            ):
+                signature = private_key.sign(_in, _padding, _hash)

            if signature is None:
                self.module.fail_json(
--- a/plugins/modules/openssl_signature_info.py
+++ b/plugins/modules/openssl_signature_info.py
@@ -14,7 +14,7 @@ description:
  - This module allows one to verify a signature for a file by a certificate.
  - The module uses the cryptography Python library.
 requirements:
-  - cryptography >= 1.4 (some key types require newer versions)
+  - cryptography >= 3.4
 author:
  - Patrick Pichler (@aveexy)
  - Markus Teufelberger (@MarkusTeufelberger)
@@ -51,10 +51,6 @@ options:
    type: str
    default: auto
    choices: [auto, cryptography]
-notes:
-  - "When using the C(cryptography) backend, the following key types require at least the following C(cryptography) version:\n
-    RSA keys: C(cryptography) >= 1.4\nDSA and ECDSA keys: C(cryptography) >= 1.5\ned448 and ed25519 keys: C(cryptography)
-    >= 2.6."
 seealso:
  - module: community.crypto.openssl_signature
  - module: community.crypto.x509_certificate
@@ -97,7 +93,7 @@ from ansible_collections.community.crypto.plugins.module_utils.version import (
 )


-MINIMAL_CRYPTOGRAPHY_VERSION = "1.4"
+MINIMAL_CRYPTOGRAPHY_VERSION = "3.4"

 CRYPTOGRAPHY_IMP_ERR = None
 try:
@@ -115,11 +111,6 @@ else:
 from ansible.module_utils.basic import AnsibleModule, missing_required_lib
 from ansible.module_utils.common.text.converters import to_native
 from ansible_collections.community.crypto.plugins.module_utils.crypto.basic import (
-    CRYPTOGRAPHY_HAS_DSA_SIGN,
-    CRYPTOGRAPHY_HAS_EC_SIGN,
-    CRYPTOGRAPHY_HAS_ED448_SIGN,
-    CRYPTOGRAPHY_HAS_ED25519_SIGN,
-    CRYPTOGRAPHY_HAS_RSA_SIGN,
    OpenSSLObjectError,
 )
 from ansible_collections.community.crypto.plugins.module_utils.crypto.support import (
@@ -181,74 +172,53 @@ class SignatureInfoCryptography(SignatureInfoBase):
            verified = False
            valid = False

-            if CRYPTOGRAPHY_HAS_DSA_SIGN:
-                try:
-                    if isinstance(
-                        public_key,
-                        cryptography.hazmat.primitives.asymmetric.dsa.DSAPublicKey,
-                    ):
-                        public_key.verify(_signature, _in, _hash)
-                        verified = True
-                        valid = True
-                except cryptography.exceptions.InvalidSignature:
+            try:
+                if isinstance(
+                    public_key,
+                    cryptography.hazmat.primitives.asymmetric.dsa.DSAPublicKey,
+                ):
+                    public_key.verify(_signature, _in, _hash)
                    verified = True
-                    valid = False
+                    valid = True

-            if CRYPTOGRAPHY_HAS_EC_SIGN:
-                try:
-                    if isinstance(
-                        public_key,
-                        cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePublicKey,
-                    ):
-                        public_key.verify(
-                            _signature,
-                            _in,
-                            cryptography.hazmat.primitives.asymmetric.ec.ECDSA(_hash),
-                        )
-                        verified = True
-                        valid = True
-                except cryptography.exceptions.InvalidSignature:
+                elif isinstance(
+                    public_key,
+                    cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePublicKey,
+                ):
+                    public_key.verify(
+                        _signature,
+                        _in,
+                        cryptography.hazmat.primitives.asymmetric.ec.ECDSA(_hash),
+                    )
                    verified = True
-                    valid = False
+                    valid = True

-            if CRYPTOGRAPHY_HAS_ED25519_SIGN:
-                try:
-                    if isinstance(
-                        public_key,
-                        cryptography.hazmat.primitives.asymmetric.ed25519.Ed25519PublicKey,
-                    ):
-                        public_key.verify(_signature, _in)
-                        verified = True
-                        valid = True
-                except cryptography.exceptions.InvalidSignature:
+                elif isinstance(
+                    public_key,
+                    cryptography.hazmat.primitives.asymmetric.ed25519.Ed25519PublicKey,
+                ):
+                    public_key.verify(_signature, _in)
                    verified = True
-                    valid = False
+                    valid = True

-            if CRYPTOGRAPHY_HAS_ED448_SIGN:
-                try:
-                    if isinstance(
-                        public_key,
-                        cryptography.hazmat.primitives.asymmetric.ed448.Ed448PublicKey,
-                    ):
-                        public_key.verify(_signature, _in)
-                        verified = True
-                        valid = True
-                except cryptography.exceptions.InvalidSignature:
+                elif isinstance(
+                    public_key,
+                    cryptography.hazmat.primitives.asymmetric.ed448.Ed448PublicKey,
+                ):
+                    public_key.verify(_signature, _in)
                    verified = True
-                    valid = False
+                    valid = True

-            if CRYPTOGRAPHY_HAS_RSA_SIGN:
-                try:
-                    if isinstance(
-                        public_key,
-                        cryptography.hazmat.primitives.asymmetric.rsa.RSAPublicKey,
-                    ):
-                        public_key.verify(_signature, _in, _padding, _hash)
-                        verified = True
-                        valid = True
-                except cryptography.exceptions.InvalidSignature:
+                elif isinstance(
+                    public_key,
+                    cryptography.hazmat.primitives.asymmetric.rsa.RSAPublicKey,
+                ):
+                    public_key.verify(_signature, _in, _padding, _hash)
                    verified = True
-                    valid = False
+                    valid = True
+            except cryptography.exceptions.InvalidSignature:
+                verified = True
+                valid = False

            if not verified:
                self.module.fail_json(
--- a/plugins/modules/x509_certificate_convert.py
+++ b/plugins/modules/x509_certificate_convert.py
@@ -85,8 +85,6 @@ seealso:
  - module: community.crypto.x509_certificate
  - module: community.crypto.x509_certificate_pipe
  - module: community.crypto.x509_certificate_info
-requirements:
-  - cryptography >= 1.6 if O(verify_cert_parsable=true)
 """

 EXAMPLES = r"""
@@ -132,12 +130,11 @@ from ansible_collections.community.crypto.plugins.module_utils.io import (
 )


-MINIMAL_CRYPTOGRAPHY_VERSION = "1.6"
+MINIMAL_CRYPTOGRAPHY_VERSION = "3.4"

 CRYPTOGRAPHY_IMP_ERR = None
 try:
    import cryptography  # noqa: F401, pylint: disable=unused-import
-    from cryptography.hazmat.backends import default_backend
    from cryptography.x509 import load_der_x509_certificate
 except ImportError:
    CRYPTOGRAPHY_IMP_ERR = traceback.format_exc()
@@ -234,7 +231,7 @@ class X509CertificateConvertModule(OpenSSLObject):
                exception=CRYPTOGRAPHY_IMP_ERR,
            )
        try:
-            load_der_x509_certificate(self.input, default_backend())
+            load_der_x509_certificate(self.input)
        except Exception as exc:
            module.fail_json(msg=f"Error while parsing certificate: {exc}")

--- a/plugins/modules/x509_certificate_info.py
+++ b/plugins/modules/x509_certificate_info.py
@@ -20,7 +20,7 @@ description:
    L(collections,https://docs.ansible.com/ansible/latest/user_guide/collections_using.html#using-collections-in-a-playbook)
    keyword, the new name M(community.crypto.x509_certificate_info) should be used to avoid a deprecation warning.
 requirements:
-  - cryptography >= 1.6
+  - cryptography >= 3.4
 author:
  - Felix Fontein (@felixfontein)
  - Yanis Guenane (@Spredzy)
--- a/plugins/modules/x509_crl.py
+++ b/plugins/modules/x509_crl.py
@@ -15,7 +15,7 @@ description:
  - Certificates on the revocation list can be either specified by serial number and (optionally) their issuer, or as a path
    to a certificate file in PEM format.
 requirements:
-  - cryptography >= 1.2
+  - cryptography >= 3.4
 author:
  - Felix Fontein (@felixfontein)
 extends_documentation_fragment:
@@ -455,7 +455,6 @@ from ansible_collections.community.crypto.plugins.module_utils.crypto.cryptograp
    cryptography_key_needs_digest_for_signing,
    cryptography_name_to_oid,
    cryptography_oid_to_name,
-    cryptography_serial_number_of_cert,
 )
 from ansible_collections.community.crypto.plugins.module_utils.crypto.module_backends.crl_info import (
    get_crl_info,
@@ -483,13 +482,12 @@ from ansible_collections.community.crypto.plugins.module_utils.version import (
 )


-MINIMAL_CRYPTOGRAPHY_VERSION = "1.2"
+MINIMAL_CRYPTOGRAPHY_VERSION = "3.4"

 CRYPTOGRAPHY_IMP_ERR = None
 try:
    import cryptography
    from cryptography import x509
-    from cryptography.hazmat.backends import default_backend
    from cryptography.hazmat.primitives.serialization import Encoding
    from cryptography.x509 import (
        CertificateRevocationListBuilder,
@@ -585,7 +583,7 @@ class CRL(OpenSSLObject):
                    cert = load_certificate(
                        rc["path"], content=rc["content"], backend="cryptography"
                    )
-                    result["serial_number"] = cryptography_serial_number_of_cert(cert)
+                    result["serial_number"] = cert.serial_number
                except OpenSSLObjectError as e:
                    if rc["content"] is not None:
                        module.fail_json(
@@ -642,11 +640,11 @@ class CRL(OpenSSLObject):
                data = f.read()
            self.actual_format = "pem" if identify_pem_format(data) else "der"
            if self.actual_format == "pem":
-                self.crl = x509.load_pem_x509_crl(data, default_backend())
+                self.crl = x509.load_pem_x509_crl(data)
                if self.return_content:
                    self.crl_content = data
            else:
-                self.crl = x509.load_der_x509_crl(data, default_backend())
+                self.crl = x509.load_der_x509_crl(data)
                if self.return_content:
                    self.crl_content = base64.b64encode(data)
        except Exception:
@@ -783,7 +781,6 @@ class CRL(OpenSSLObject):
        return True

    def _generate_crl(self):
-        backend = default_backend()
        crl = CertificateRevocationListBuilder()

        try:
@@ -830,12 +827,12 @@ class CRL(OpenSSLObject):
                    x509.InvalidityDate(entry["invalidity_date"]),
                    entry["invalidity_date_critical"],
                )
-            crl = crl.add_revoked_certificate(revoked_cert.build(backend))
+            crl = crl.add_revoked_certificate(revoked_cert.build())

        digest = None
        if cryptography_key_needs_digest_for_signing(self.privatekey):
            digest = self.digest
-        self.crl = crl.sign(self.privatekey, digest, backend=backend)
+        self.crl = crl.sign(self.privatekey, digest)
        if self.format == "pem":
            return self.crl.public_bytes(Encoding.PEM)
        else:
--- a/plugins/modules/x509_crl_info.py
+++ b/plugins/modules/x509_crl_info.py
@@ -13,7 +13,7 @@ short_description: Retrieve information on Certificate Revocation Lists (CRLs)
 description:
  - This module allows one to retrieve information on Certificate Revocation Lists (CRLs).
 requirements:
-  - cryptography >= 1.2
+  - cryptography >= 3.4
 author:
  - Felix Fontein (@felixfontein)
 extends_documentation_fragment: