61 Commits

Author SHA1 Message Date
Albert Krewinkel
b1e4777b4d Fix typos (phassphrase => passphrase) (#984) 2026-03-06 19:02:14 +01:00
Felix Fontein
1b86848a6f Stop mentioning Buypass. (#964)
https://community.buypass.com/t/y4y130p
2025-10-29 20:57:54 +01:00
Daniel Ziegenberg
ec063d8515 Add HARICA to the list of tested CAs (#915)
* Add HARICA to the list of tested CAs

Signed-off-by: Daniel Ziegenberg <daniel@ziegenberg.at>

* Add ZeroSSL to list.

---------

Signed-off-by: Daniel Ziegenberg <daniel@ziegenberg.at>
Co-authored-by: Felix Fontein <felix@fontein.de>
2025-06-08 20:58:08 +02:00
Daniel Ziegenberg
7241d5543a Document supported curves for Elliptic Curve keys on ACME Accounts (#904)
Signed-off-by: Daniel Ziegenberg <daniel@ziegenberg.at>
2025-05-30 12:56:16 +02:00
Felix Fontein
b8adc3b241 Use ruff format, and then undo most changes with black and isort. (#903) 2025-05-24 08:30:31 +02:00
Felix Fontein
43ea6148df Remove Entrust modules and certificate providers (#900)
* Remove Entrust modules and certificate providers.

* Add more information on Entrust removal.

* Remove Entrust content from ignore.txt files.

* Work around bug in ansible-test.
2025-05-22 19:08:48 +00:00
Felix Fontein
b08afe4237 Make all doc_fragments private. (#898) 2025-05-18 01:42:18 +02:00
Felix Fontein
56f004dc63 More refactorings (#890)
* Improve typing.

* Improve version parameter validation for x509_certificate* modules.

* Use utils for parsing retry-after.
2025-05-16 21:53:18 +02:00
Felix Fontein
a5a4e022ba Make all module_utils and plugin_utils private (#887)
* Add leading underscore. Remove deprecated module utils.

* Document module and plugin utils as private. Add changelog fragment.

* Convert relative to absolute imports.

* Remove unnecessary imports.
2025-05-11 19:17:58 +02:00
Felix Fontein
645b7bf9ed Get rid of backend parameter whenever possible (#883)
* Get rid of backend parameter whenever possible.

* Always auto-detect if backend choices are 'cryptography' and 'auto', resp. always check cryptography version.

* Improve error message.

* Update documentation.
2025-05-03 10:46:53 +02:00
Felix Fontein
fbcb89f092 Support cryptography 3.3 (#882)
* Re-add Debian Bullseye to CI.

* Support cryptography 3.3 as well.
2025-05-02 21:42:06 +02:00
Felix Fontein
5231ac8f3f Remove support for cryptography < 3.4 (#878)
* Stop passing backend to cryptography.

* Make public_bytes() fallback the default.

* Remove compatibility code for older cryptography versions.

* Require cryptography 3.4+.

* Restrict to cryptography >= 3.4 in integration tests.

* Remove Debian Bullseye from CI.

It only supports cryptography 3.3.

* Improve imports.

* Remove no longer existing conditional.
2025-05-02 15:27:18 +02:00
Felix Fontein
ef230011fd Lint doc fragments. 2025-05-01 16:47:59 +02:00
Felix Fontein
65872e884f Remove Python 2 specific code (#877)
* Get rid of Python 2 special handling.

* Get rid of more Python 2 specific handling.

* Stop using six.

* ipaddress is part of the standard library since Python 3.

* Add changelog.

* Fix import.

* Remove unneeded imports.
2025-05-01 16:21:13 +02:00
Felix Fontein
d8f838c365 Modernize some Python constructs (#876)
* Update __future__ import, remove __metaclass__ assignment.

* Removing obsolete encoding comment.

* Remove unneccessary object inheritance.
2025-05-01 10:36:59 +02:00
Felix Fontein
d368d1943d Bump version to 3.0.0-dev0, remove deprecated functionality and implement announced breaking changes (#873)
* Bump verison to 3.0.0-dev0.

* Change check mode behavior for *_pipe modules.

* Remove PyOpenSSL backend.

* Remove PyOpenSSL setup.

* Change default of asn1_base64.

* Remove deprecated common module utils.

* Remove get_default_argspec().

* Mark two methods as abstract.

* Remove ACME v1 support.

* Remove retrieve_acme_v1_certificate().

* Remove deprecated docs fragment.

* Change meaning of mode parameter.

* Mark no longer used option as 'to deprecate'.
2025-04-29 08:12:44 +02:00
Felix Fontein
aec1826c34 Reformat everything with black.
I had to undo the u string prefix removals to not drop Python 2 compatibility.
That's why black isn't enabled in antsibull-nox.toml yet.
2025-04-28 10:48:00 +02:00
Felix Fontein
aa9e7b6dfb Add isort and flake8 to CI (#869)
* Run isort.

* Clean up unused assignments.

* Add flake8 linting step.
2025-04-27 22:18:29 +02:00
Felix Fontein
3f0e292246 Add 'idempotent' attribute (#833)
* Add 'idempotent' attribute.

* Mention check mode in attribute description.

Co-authored-by: Alexei Znamensky <103110+russoz@users.noreply.github.com>

---------

Co-authored-by: Alexei Znamensky <103110+russoz@users.noreply.github.com>
2024-12-30 21:11:12 +01:00
Felix Fontein
4ce9745d35 Put appropriate module attributes into doc fragments. 2024-12-29 16:17:03 +01:00
Felix Fontein
37af200ecb Fix doc fragments indents. 2024-12-29 15:47:51 +01:00
Felix Fontein
942be86635 Reformat documentation with 'andebox yaml-doc' (#828)
* Reformat documentation with 'andebox yaml-doc'.

* Fix/improve.

* Remaining fixes.

* One more.
2024-12-28 16:00:28 +00:00
Felix Fontein
a49711d383 openssl_privatekey*: add default value for cipher option (#794)
* Add default value for 'cipher' option.
* Adjust tests.
* Add changelog fragment.
* Clarify that cipher is used only when passphrase is provided.
2024-08-30 08:49:20 +01:00
Felix Fontein
00d23753ca Revert "Revert all non-bugfixes merged since the last release."
This reverts commit 82251c2d80.
2024-05-11 17:05:03 +02:00
Felix Fontein
82251c2d80 Revert all non-bugfixes merged since the last release.
Revert "Fix documentation. (#751)"
Revert "ACME modules: simplify code, refactor argspec handling code, move csr/csr_content to own docs fragment (#750)"
Revert "Refactor and extend argument spec helper, use for ACME modules (#749)"
Revert "Avoid exception if certificate has no AKI in acme_certificate. (#748)"
Revert "ACME: improve acme_certificate docs, include cert_id in acme_certificate_renewal_info return value (#747)"
Revert "Add acme_certificate_renewal_info module (#746)"
Revert "Refactor time code, add tests, fix bug when parsing absolute timestamps that omit seconds (#745)"
Revert "Add tests for acme_certificate_deactivate_authz module. (#744)"
Revert "Create acme_certificate_deactivate_authz module (#741)"
Revert "acme_certificate: allow to request renewal of a certificate according to ARI (#739)"
Revert "Implement basic acme_ari_info module. (#732)"
Revert "Add function for retrieval of ARI information. (#738)"
Revert "acme module utils: add functions for parsing Retry-After header values and computation of ARI certificate IDs (#737)"
Revert "Implement certificate information retrieval code in the ACME backends. (#736)"
Revert "Split up the default acme docs fragment to allow modules ot not need account data. (#735)"

This reverts commits 5e59c5261e, aa82575a78,
f3c9cb7a8a, f82b335916, 553ab45f46,
59606d48ad, 0a15be1017, 9501a28a93,
d906914737, 33d278ad8f, 6d4fc589ae,
9614b09f7a, af5f4b57f8, c6fbe58382,
and afe7f7522c.
2024-05-11 16:07:53 +02:00
Felix Fontein
aa82575a78 ACME modules: simplify code, refactor argspec handling code, move csr/csr_content to own docs fragment (#750)
* Fix bug in argspec module util.

* Move csr / csr_content to new docs fragment.

* Simplify code.

* Refactor ACME argspec creation. Add with_certificate argument for new CERTIFICATE docs fragment.
2024-05-05 14:37:52 +02:00
Felix Fontein
afe7f7522c Split up the default acme docs fragment to allow modules ot not need account data. (#735) 2024-04-29 22:22:38 +02:00
Felix Fontein
6b1a3d6e68 Add conversion filters for serial numbers (#713)
* Refactoring.

* Add parse_filter and to_filter plugins.

* Mention filters when serial numbers are accepted or returned.
2024-02-18 21:27:48 +01:00
Felix Fontein
99d1521266 Use semantic markup (#626)
* Enable semantic markup.

* Use semantic markup.

* Break long lines.

* Add ignores.

* Use real option, not alias.
2023-06-24 10:00:56 +02:00
Thomas Anderson
b997773139 fix(doc): privatekey_content docs were the same as privatekey_path (#583) 2023-03-21 13:38:54 +01:00
Felix Fontein
7bbe8f467c Document attributes (#526)
* Add 'acme' action group attribute.

* Compatibility with older ansible-core releases.

* Fix typo.

* Document standard attributes.

* Improve docs.

* Add shortcuts for common combinations.
2022-11-06 21:10:56 +01:00
Felix Fontein
0e15d6cea8 Convert yes/no to true/false. (#503) 2022-08-23 21:33:29 +02:00
Daniel Ziegenberg
d83f7639be add production directory URL for ACME v2 for Sectigo (#496)
According the to official Sectigo documentation [1] the directory URL
for ACME v2 is: https://acme-qa.secure.trust-provider.com/v2/DV

[1] https://docs.sectigo.com/scm/acme-integration-docs/1/eab-clients-sectigo-acme-integration.html

Signed-off-by: Daniel Ziegenberg <daniel@ziegenberg.at>
2022-07-26 18:10:43 +02:00
Felix Fontein
6bf3ef47e1 Move licenses to LICENSES/, use SPDX-License-Identifier, mention all licenses in galaxy.yml (#491)
* Add SPDX license identifiers, mention all licenses in galaxy.yml.

* Add default copyright headers.

* Add headers for documents.

* Fix/add more copyright statements.

* Add copyright / license info for vendored code.

* Add extra sanity test.

* Add changelog fragment.

* Comment PSF-2.0 license out in galaxy.yml for now.

* Remove colon after 'Copyright'.

* Avoid colon after 'Copyright' in lint script.

* Mention correct filename.

* Add BSD-3-Clause.

* Improve lint script.

* Update README.

* Symlinks...
2022-07-21 07:27:26 +02:00
Felix Fontein
4cf951596f Improve handling of IDNA/Unicode domains (#436)
* Prepare IDNA/Unicode conversion code. Use to normalize input.

* Use IDNA library first (IDNA2008) and Python's IDNA2003 implementation as a fallback.

* Make sure idna is installed.

* Add changelog fragment.

* 'punycode' → 'idna'.

* Add name_encoding options and tests.

* Avoid invalid character for IDNA2008.

* Linting.

* Forgot to upate value.

* Work around cryptography bug. Fix port handling for URIs.

* Forgot other place sensitive to cryptography bug.

* Forgot one. (Will likely still fail.)

* Decode IDNA in _compress_entry() to avoid comparison screw-ups.

* Work around Python 3.5 problem in Ansible 2.9's default test container.

* Update changelog fragment.

* Fix error, add tests.

* Python 2 compatibility.

* Update requirements.
2022-05-09 19:57:14 +02:00
Felix Fontein
8a1c60e54a Incorporate feedback from #443 that ACME modules work with Sectigo ACME Service for InCommon (#451)
* Incorporate feedback from #443.

* Update comment.
2022-05-09 13:28:03 +02:00
Jonas Verhofsté
c16d9f78b8 Make request timeout configurable for all acme modules (#448)
* Make request timeout configurable for all acme modules

Fixes #447.

* Log change made in #448
2022-05-03 17:29:38 +02:00
Felix Fontein
bd2bd79497 Add openssl_privatekey_convert module (#362)
* Add openssl_privatekey_convert module.

* Extend tests and fix bugs.

* Fix wrong required.

* Fix condition.

* Fix bad tests.

* Fix documentation for format.

* Fix copyright lines.
2022-01-10 21:01:52 +01:00
Felix Fontein
62272296da Small docs improvements (#374)
* Small improvements.

* Document behavior changes.
2022-01-10 12:05:09 +00:00
Felix Fontein
3e307fe062 Fix typo. (#367) 2022-01-05 18:16:27 +01:00
Felix Fontein
589e7c72ef Allow to specify subject (for CSRs) and issuer (for CRLs) ordered (#316)
* Allow to specify subject (for CSRs) and issuer (for CRLs) ordered.

* Forgot import.

* Apply suggestions from code review

Co-authored-by: Ajpantuso <ajpantuso@gmail.com>

* Apply suggestions from code review

Co-authored-by: Ajpantuso <ajpantuso@gmail.com>

* Fix typo.

* Simplify error handling, reject empty values outright.

* Document d497231e1c.

Co-authored-by: Ajpantuso <ajpantuso@gmail.com>
2021-10-31 15:05:04 +01:00
Felix Fontein
4ab2ed8b77 Add ignore_timestamps option. (#317) 2021-10-30 16:34:27 +02:00
Felix Fontein
a581f1ebcd Remove other deprecations (#290)
* Remove deprecated redirects.

* Remove deprecations.

* Add changelog fragment.

* Add some forgotten pieces.

* Bump version to 2.0.0.

* Fix formulation.
2021-10-16 21:00:48 +02:00
Felix Fontein
5f1efb6f7e Remove assertonly (#289)
* Remove assertonly backend.

* Remove assertonly tests.

* The expired test is basically a test of assertonly.

* Replace assertonly verification by _info + assert.
2021-10-10 10:24:00 +02:00
Felix Fontein
871a185ecb Remove vendored copy of ipaddress (#287)
* Remove vendored copy of ipaddress.

* Forgot an import.

* Remove sanity ignores and checks related to ipaddress.

* Remove octal IPv4 address.

Such IPs are no longer accepted by ipaddress in Python's standard library (CVE-2021-29921).

* Remove unused import.

Co-authored-by: Sviatoslav Sydorenko <wk.cvs.github@sydorenko.org.ua>

Co-authored-by: Sviatoslav Sydorenko <wk.cvs.github@sydorenko.org.ua>
2021-10-06 14:53:40 +02:00
Felix Fontein
ed03841fd1 x509_certificate: document that *notBefore/*notAfter are not used for idempotency (#298)
* Document that *notBefore/*notAfter are not used for idempotency.

* Change formulation.
2021-10-03 22:03:58 +02:00
Felix Fontein
04958ece31 Deprecate ACME v1 (#288)
* Deprecate ACME v1.

* Fix syntax error.
2021-09-29 06:44:31 +02:00
Felix Fontein
f644db3c79 Remove PyOpenSSL backends (except for openssl_pkcs12) (#273)
* Remove Ubuntu 16.04 (Xenial Xerus) from CI.

* Removing PyOpenSSL backend from everywhere but openssl_pkcs12.

* Remove PyOpenSSL support from module_utils that's not needed for openssl_pkcs12.

* Add changelog fragment.
2021-09-28 17:46:35 +02:00
Felix Fontein
67b8274faf openssl_csr: fix error in docs (#269)
* Fix error in docs.

* Add missing word.
2021-09-10 20:53:50 +02:00
Felix Fontein
e85554827f acme_* modules: support private key passprases (#207)
* Support private key passprases.

* Use c.c modules for key generation, add first passphrase tests.

* Some more passphrase tests.
2021-03-21 17:53:20 +01:00