+ + +
+ +
+

community.crypto.openssl_privatekey_info filter – Retrieve information from OpenSSL private keys

+
+

Note

+

This filter plugin is part of the community.crypto collection (version 2.10.0).

+

To install it, use: ansible-galaxy collection install community.crypto. +You need further requirements to be able to use this filter plugin, +see Requirements for details.

+

To use it in a playbook, specify: community.crypto.openssl_privatekey_info.

+
+

New in community.crypto 2.10.0

+ +
+

Synopsis

+ +
+
+

Requirements

+

The below requirements are needed on the local controller node that executes this filter.

+
    +

  • If name_encoding is set to another value than ignore, the idna Python library needs to be installed.

    • +
+
+
+

Input

+

This describes the input of the filter, the value before | community.crypto.openssl_privatekey_info.

+ + + + + + + + + + + +

Parameter

Comments

+

Input

+

string / required

+

The content of the OpenSSL private key.

+
+
+
+

Keyword parameters

+

This describes keyword parameters of the filter. These are the values key1=value1, key2=value2 and so on in the following example: input | community.crypto.openssl_privatekey_info(key1=value1, key2=value2, ...).

+ + + + + + + + + + + + + + + + + +

Parameter

Comments

+

name_encoding

+

string

+

How to encode names (DNS names, URIs, email addresses) in return values.

+

ignore will use the encoding returned by the backend.

+

idna will convert all labels of domain names to IDNA encoding. IDNA2008 will be preferred, and IDNA2003 will be used if IDNA2008 encoding fails.

+

unicode will convert all labels of domain names to Unicode. IDNA2008 will be preferred, and IDNA2003 will be used if IDNA2008 decoding fails.

+

Note that idna and unicode require the idna Python library to be installed.

+

Choices:

+
    +

  • "ignore" ← (default)

    • +

  • "idna"

    • +

  • "unicode"

    • +
+
+

passphrase

+

string

+

The passphrase for the private key.

+
+

return_private_key_data

+

boolean

+

Whether to return private key data.

+

Only set this to true when you want private information about this key to leave the remote machine.

+

WARNING: you have to make sure that private key data is not accidentally logged!

+

Choices:

+
    +

  • false ← (default)

    • +

  • true

    • +
+
+
+
+

See Also

+
+

See also

+
+
community.crypto.openssl_privatekey_info

Provide information for OpenSSL private keys.

+
+
+
+
+
+

Examples

+
- name: Show the Subject Alt Names of the CSR
+  ansible.builtin.debug:
+    msg: >-
+      {{
+        (
+          lookup('ansible.builtin.file', '/path/to/cert.csr')
+          | community.crypto.openssl_privatekey_info
+        ).subject_alt_name | join(', ')
+      }}
+
+
+
+
+

Return Value

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

Key

Description

+

Return value

+

dictionary

+

Information on the certificate.

+

Returned: success

+
+

private_data

+

dictionary

+

Private key data. Depends on key type.

+

Returned: success and when return_private_key_data is set to true

+
+

public_data

+

dictionary

+

Public key data. Depends on key type.

+

Returned: success

+
+

curve

+

string

+

The curve’s name for ECC.

+

Returned: When type=ECC

+
+

exponent

+

integer

+

The RSA key’s public exponent.

+

Returned: When type=RSA

+
+

exponent_size

+

integer

+

The maximum number of bits of a private key. This is basically the bit size of the subgroup used.

+

Returned: When type=ECC

+
+

g

+

integer

+

The g value for DSA.

+

This is the element spanning the subgroup of the multiplicative group of the prime field used.

+

Returned: When type=DSA

+
+

modulus

+

integer

+

The RSA key’s modulus.

+

Returned: When type=RSA

+
+

p

+

integer

+

The p value for DSA.

+

This is the prime modulus upon which arithmetic takes place.

+

Returned: When type=DSA

+
+

q

+

integer

+

The q value for DSA.

+

This is a prime that divides p - 1, and at the same time the order of the subgroup of the multiplicative group of the prime field used.

+

Returned: When type=DSA

+
+

size

+

integer

+

Bit size of modulus (RSA) or prime number (DSA).

+

Returned: When type=RSA or type=DSA

+
+

x

+

integer

+

The x coordinate for the public point on the elliptic curve.

+

Returned: When type=ECC

+
+

y

+

integer

+

For type=ECC, this is the y coordinate for the public point on the elliptic curve.

+

For type=DSA, this is the publicly known group element whose discrete logarithm w.r.t. g is the private key.

+

Returned: When type=DSA or type=ECC

+
+

public_key

+

string

+

Private key’s public key in PEM format.

+

Returned: success

+

Sample: "-----BEGIN PUBLIC KEY----- MIICIjANBgkqhkiG9w0BAQEFAAOCAg8A..."

+
+

public_key_fingerprints

+

dictionary

+

Fingerprints of private key’s public key.

+

For every hash algorithm available, the fingerprint is computed.

+

Returned: success

+

Sample: "{'sha256': 'd4:b3:aa:6d:c8:04:ce:4e:ba:f6:29:4d:92:a3:94:b0:c2:ff:bd:bf:33:63:11:43:34:0f:51:b0:95:09:2f:63', 'sha512': 'f7:07:4a:f0:b0:f0:e6:8b:95:5f:f9:e6:61:0a:32:68:f1..."

+
+

type

+

string

+

The key’s type.

+

One of RSA, DSA, ECC, Ed25519, X25519, Ed448, or X448.

+

Will start with unknown if the key type cannot be determined.

+

Returned: success

+

Sample: "RSA"

+
+
+

Authors

+
    +

  • Felix Fontein (@felixfontein)

    • +
+
+

Hint

+

Configuration entries for each entry type have a low to high priority order. For example, a variable that is lower in the list will override a variable that is higher up.

+
+
+ +
+
+ + +
+