Release 1.6.1.

* Fix wrong usages of ACMEProtocolException.

* Add changelog fragment.

* Fix error handling when content could not be decoded.

* Make sure that content_json is a dict or None.

* Improve acme_inspect's ACMEProtocolException handling.

* Improve error handling.

* Add tests.

* Fix challenge error.

* Add challenges tests.

* Provide content if available.

* Add some order tests.

* Linting.

.azure-pipelines/README.md

@@ -0,0 +1,3 @@
+## Azure Pipelines Configuration
+
+Please see the [Documentation](https://github.com/ansible/community/wiki/Testing:-Azure-Pipelines) for more information.

.azure-pipelines/azure-pipelines.yml

@@ -0,0 +1,322 @@
+trigger:
+  batch: true
+  branches:
+    include:
+      - main
+      - stable-*
+
+pr:
+  autoCancel: true
+  branches:
+    include:
+      - main
+      - stable-*
+
+schedules:
+  - cron: 0 9 * * *
+    displayName: Nightly
+    always: true
+    branches:
+      include:
+        - main
+        - stable-*
+
+variables:
+  - name: checkoutPath
+    value: ansible_collections/community/crypto
+  - name: coverageBranches
+    value: main
+  - name: pipelinesCoverage
+    value: coverage
+  - name: entryPoint
+    value: tests/utils/shippable/shippable.sh
+  - name: fetchDepth
+    value: 0
+
+resources:
+  containers:
+    - container: default
+      image: quay.io/ansible/azure-pipelines-test-container:1.9.0
+
+pool: Standard
+
+stages:
+### Sanity & units
+  - stage: Ansible_devel
+    displayName: Sanity & Units devel
+    dependsOn: []
+    jobs:
+      - template: templates/matrix.yml
+        parameters:
+          targets:
+            - name: Sanity
+              test: 'devel/sanity/1'
+            - name: Sanity Extra # Only on devel
+              test: 'devel/sanity/extra'
+            - name: Units
+              test: 'devel/units/1'
+  - stage: Ansible_2_11
+    displayName: Sanity & Units 2.11
+    dependsOn: []
+    jobs:
+      - template: templates/matrix.yml
+        parameters:
+          targets:
+            - name: Sanity
+              test: '2.11/sanity/1'
+            - name: Units
+              test: '2.11/units/1'
+  - stage: Ansible_2_10
+    displayName: Sanity & Units 2.10
+    dependsOn: []
+    jobs:
+      - template: templates/matrix.yml
+        parameters:
+          targets:
+            - name: Sanity
+              test: '2.10/sanity/1'
+            - name: Units
+              test: '2.10/units/1'
+  - stage: Ansible_2_9
+    displayName: Sanity & Units 2.9
+    dependsOn: []
+    jobs:
+      - template: templates/matrix.yml
+        parameters:
+          targets:
+            - name: Sanity
+              test: '2.9/sanity/1'
+            - name: Units
+              test: '2.9/units/1'
+### Docker
+  - stage: Docker_devel
+    displayName: Docker devel
+    dependsOn: []
+    jobs:
+      - template: templates/matrix.yml
+        parameters:
+          testFormat: devel/linux/{0}/1
+          targets:
+            - name: CentOS 6
+              test: centos6
+            - name: CentOS 7
+              test: centos7
+            - name: CentOS 8
+              test: centos8
+            - name: Fedora 32
+              test: fedora32
+            - name: Fedora 33
+              test: fedora33
+            - name: openSUSE 15 py2
+              test: opensuse15py2
+            - name: openSUSE 15 py3
+              test: opensuse15
+            - name: Ubuntu 18.04
+              test: ubuntu1804
+            - name: Ubuntu 20.04
+              test: ubuntu2004
+  - stage: Docker_2_11
+    displayName: Docker 2.11
+    dependsOn: []
+    jobs:
+      - template: templates/matrix.yml
+        parameters:
+          testFormat: 2.11/linux/{0}/1
+          targets:
+            - name: CentOS 7
+              test: centos7
+            - name: CentOS 8
+              test: centos8
+            - name: Fedora 32
+              test: fedora32
+            - name: openSUSE 15 py2
+              test: opensuse15py2
+            - name: openSUSE 15 py3
+              test: opensuse15
+            - name: Ubuntu 18.04
+              test: ubuntu1804
+            - name: Ubuntu 20.04
+              test: ubuntu2004
+  - stage: Docker_2_10
+    displayName: Docker 2.10
+    dependsOn: []
+    jobs:
+      - template: templates/matrix.yml
+        parameters:
+          testFormat: 2.10/linux/{0}/1
+          targets:
+            - name: CentOS 6
+              test: centos6
+            - name: CentOS 7
+              test: centos7
+            - name: CentOS 8
+              test: centos8
+            - name: Fedora 31
+              test: fedora31
+            - name: Fedora 32
+              test: fedora32
+            - name: openSUSE 15 py2
+              test: opensuse15py2
+            - name: openSUSE 15 py3
+              test: opensuse15
+            - name: Ubuntu 16.04
+              test: ubuntu1604
+            - name: Ubuntu 18.04
+              test: ubuntu1804
+  - stage: Docker_2_9
+    displayName: Docker 2.9
+    dependsOn: []
+    jobs:
+      - template: templates/matrix.yml
+        parameters:
+          testFormat: 2.9/linux/{0}/1
+          targets:
+            - name: CentOS 6
+              test: centos6
+            - name: CentOS 7
+              test: centos7
+            - name: CentOS 8
+              test: centos8
+            - name: Fedora 30
+              test: fedora30
+            - name: Fedora 31
+              test: fedora31
+            - name: openSUSE 15 py2
+              test: opensuse15py2
+            - name: openSUSE 15 py3
+              test: opensuse15
+            - name: Ubuntu 16.04
+              test: ubuntu1604
+            - name: Ubuntu 18.04
+              test: ubuntu1804
+
+### Remote
+  - stage: Remote_devel
+    displayName: Remote devel
+    dependsOn: []
+    jobs:
+      - template: templates/matrix.yml
+        parameters:
+          testFormat: devel/{0}/1
+          targets:
+            - name: macOS 11.1
+              test: macos/11.1
+            - name: RHEL 7.9
+              test: rhel/7.9
+            - name: RHEL 8.3
+              test: rhel/8.3
+            - name: FreeBSD 11.4
+              test: freebsd/11.4
+            - name: FreeBSD 12.2
+              test: freebsd/12.2
+  - stage: Remote_2_11
+    displayName: Remote 2.11
+    dependsOn: []
+    jobs:
+      - template: templates/matrix.yml
+        parameters:
+          testFormat: 2.11/{0}/1
+          targets:
+            - name: RHEL 7.9
+              test: rhel/7.9
+            - name: macOS 11.1
+              test: macos/11.1
+            - name: FreeBSD 12.2
+              test: freebsd/12.2
+  - stage: Remote_2_10
+    displayName: Remote 2.10
+    dependsOn: []
+    jobs:
+      - template: templates/matrix.yml
+        parameters:
+          testFormat: 2.10/{0}/1
+          targets:
+            - name: RHEL 7.8
+              test: rhel/7.8
+            - name: OS X 10.11
+              test: osx/10.11
+            - name: macOS 10.15
+              test: macos/10.15
+            - name: FreeBSD 12.1
+              test: freebsd/12.1
+  - stage: Remote_2_9
+    displayName: Remote 2.9
+    dependsOn: []
+    jobs:
+      - template: templates/matrix.yml
+        parameters:
+          testFormat: 2.9/{0}/1
+          targets:
+            - name: 'RHEL 7.8'
+              test: 'rhel/7.8'
+### cloud
+  - stage: Cloud_devel
+    displayName: Cloud devel
+    dependsOn: []
+    jobs:
+      - template: templates/matrix.yml
+        parameters:
+          nameFormat: Python {0}
+          testFormat: devel/cloud/{0}/1
+          targets:
+            - test: 2.6
+            - test: 2.7
+            - test: 3.5
+            - test: 3.6
+            - test: 3.7
+            - test: 3.8
+            - test: 3.9
+  - stage: Cloud_2_11
+    displayName: Cloud 2.11
+    dependsOn: []
+    jobs:
+      - template: templates/matrix.yml
+        parameters:
+          nameFormat: Python {0}
+          testFormat: 2.11/cloud/{0}/1
+          targets:
+            - test: 3.8
+  - stage: Cloud_2_10
+    displayName: Cloud 2.10
+    dependsOn: []
+    jobs:
+      - template: templates/matrix.yml
+        parameters:
+          nameFormat: Python {0}
+          testFormat: 2.10/cloud/{0}/1
+          targets:
+            - test: 3.6
+  - stage: Cloud_2_9
+    displayName: Cloud 2.9
+    dependsOn: []
+    jobs:
+      - template: templates/matrix.yml
+        parameters:
+          nameFormat: Python {0}
+          testFormat: 2.9/cloud/{0}/1
+          targets:
+            - test: 3.5
+
+  ## Finally
+
+  - stage: Summary
+    condition: succeededOrFailed()
+    dependsOn:
+      - Ansible_devel
+      - Ansible_2_11
+      - Ansible_2_10
+      - Ansible_2_9
+      - Remote_devel
+      - Docker_devel
+      - Cloud_devel
+      - Remote_2_11
+      - Docker_2_11
+      - Cloud_2_11
+      - Remote_2_10
+      - Docker_2_10
+      - Cloud_2_10
+      - Remote_2_9
+      - Docker_2_9
+      - Cloud_2_9
+    jobs:
+      - template: templates/coverage.yml

.azure-pipelines/scripts/aggregate-coverage.sh

@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+# Aggregate code coverage results for later processing.
+
+set -o pipefail -eu
+
+agent_temp_directory="$1"
+
+PATH="${PWD}/bin:${PATH}"
+
+mkdir "${agent_temp_directory}/coverage/"
+
+options=(--venv --venv-system-site-packages --color -v)
+
+ansible-test coverage combine --export "${agent_temp_directory}/coverage/" "${options[@]}"
+
+if ansible-test coverage analyze targets generate --help >/dev/null 2>&1; then
+    # Only analyze coverage if the installed version of ansible-test supports it.
+    # Doing so allows this script to work unmodified for multiple Ansible versions.
+    ansible-test coverage analyze targets generate "${agent_temp_directory}/coverage/coverage-analyze-targets.json" "${options[@]}"
+fi

.azure-pipelines/scripts/combine-coverage.py

@@ -0,0 +1,60 @@
+#!/usr/bin/env python
+"""
+Combine coverage data from multiple jobs, keeping the data only from the most recent attempt from each job.
+Coverage artifacts must be named using the format: "Coverage $(System.JobAttempt) {StableUniqueNameForEachJob}"
+The recommended coverage artifact name format is: Coverage $(System.JobAttempt) $(System.StageDisplayName) $(System.JobDisplayName)
+Keep in mind that Azure Pipelines does not enforce unique job display names (only names).
+It is up to pipeline authors to avoid name collisions when deviating from the recommended format.
+"""
+
+from __future__ import (absolute_import, division, print_function)
+__metaclass__ = type
+
+import os
+import re
+import shutil
+import sys
+
+
+def main():
+    """Main program entry point."""
+    source_directory = sys.argv[1]
+
+    if '/ansible_collections/' in os.getcwd():
+        output_path = "tests/output"
+    else:
+        output_path = "test/results"
+
+    destination_directory = os.path.join(output_path, 'coverage')
+
+    if not os.path.exists(destination_directory):
+        os.makedirs(destination_directory)
+
+    jobs = {}
+    count = 0
+
+    for name in os.listdir(source_directory):
+        match = re.search('^Coverage (?P<attempt>[0-9]+) (?P<label>.+)$', name)
+        label = match.group('label')
+        attempt = int(match.group('attempt'))
+        jobs[label] = max(attempt, jobs.get(label, 0))
+
+    for label, attempt in jobs.items():
+        name = 'Coverage {attempt} {label}'.format(label=label, attempt=attempt)
+        source = os.path.join(source_directory, name)
+        source_files = os.listdir(source)
+
+        for source_file in source_files:
+            source_path = os.path.join(source, source_file)
+            destination_path = os.path.join(destination_directory, source_file + '.' + label)
+            print('"%s" -> "%s"' % (source_path, destination_path))
+            shutil.copyfile(source_path, destination_path)
+            count += 1
+
+    print('Coverage file count: %d' % count)
+    print('##vso[task.setVariable variable=coverageFileCount]%d' % count)
+    print('##vso[task.setVariable variable=outputPath]%s' % output_path)
+
+
+if __name__ == '__main__':
+    main()

.azure-pipelines/scripts/process-results.sh

@@ -0,0 +1,24 @@
+#!/usr/bin/env bash
+# Check the test results and set variables for use in later steps.
+
+set -o pipefail -eu
+
+if [[ "$PWD" =~ /ansible_collections/ ]]; then
+    output_path="tests/output"
+else
+    output_path="test/results"
+fi
+
+echo "##vso[task.setVariable variable=outputPath]${output_path}"
+
+if compgen -G "${output_path}"'/junit/*.xml' > /dev/null; then
+    echo "##vso[task.setVariable variable=haveTestResults]true"
+fi
+
+if compgen -G "${output_path}"'/bot/ansible-test-*' > /dev/null; then
+    echo "##vso[task.setVariable variable=haveBotResults]true"
+fi
+
+if compgen -G "${output_path}"'/coverage/*' > /dev/null; then
+    echo "##vso[task.setVariable variable=haveCoverageData]true"
+fi

.azure-pipelines/scripts/publish-codecov.sh

@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+# Upload code coverage reports to codecov.io.
+# Multiple coverage files from multiple languages are accepted and aggregated after upload.
+# Python coverage, as well as PowerShell and Python stubs can all be uploaded.
+
+set -o pipefail -eu
+
+output_path="$1"
+
+curl --silent --show-error https://codecov.io/bash > codecov.sh
+
+for file in "${output_path}"/reports/coverage*.xml; do
+    name="${file}"
+    name="${name##*/}"  # remove path
+    name="${name##coverage=}"  # remove 'coverage=' prefix if present
+    name="${name%.xml}"  # remove '.xml' suffix
+
+    bash codecov.sh \
+        -f "${file}" \
+        -n "${name}" \
+        -X coveragepy \
+        -X gcov \
+        -X fix \
+        -X search \
+        -X xcode \
+        || echo "Failed to upload code coverage report to codecov.io: ${file}"
+done

.azure-pipelines/scripts/report-coverage.sh

@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+# Generate code coverage reports for uploading to Azure Pipelines and codecov.io.
+
+set -o pipefail -eu
+
+PATH="${PWD}/bin:${PATH}"
+
+if ! ansible-test --help >/dev/null 2>&1; then
+    # Install the devel version of ansible-test for generating code coverage reports.
+    # This is only used by Ansible Collections, which are typically tested against multiple Ansible versions (in separate jobs).
+    # Since a version of ansible-test is required that can work the output from multiple older releases, the devel version is used.
+    pip install https://github.com/ansible/ansible/archive/devel.tar.gz --disable-pip-version-check
+fi
+
+ansible-test coverage xml --stub --venv --venv-system-site-packages --color -v

.azure-pipelines/scripts/run-tests.sh

@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+# Configure the test environment and run the tests.
+
+set -o pipefail -eu
+
+entry_point="$1"
+test="$2"
+read -r -a coverage_branches <<< "$3"  # space separated list of branches to run code coverage on for scheduled builds
+
+export COMMIT_MESSAGE
+export COMPLETE
+export COVERAGE
+export IS_PULL_REQUEST
+
+if [ "${SYSTEM_PULLREQUEST_TARGETBRANCH:-}" ]; then
+    IS_PULL_REQUEST=true
+    COMMIT_MESSAGE=$(git log --format=%B -n 1 HEAD^2)
+else
+    IS_PULL_REQUEST=
+    COMMIT_MESSAGE=$(git log --format=%B -n 1 HEAD)
+fi
+
+COMPLETE=
+COVERAGE=
+
+if [ "${BUILD_REASON}" = "Schedule" ]; then
+    COMPLETE=yes
+
+    if printf '%s\n' "${coverage_branches[@]}" | grep -q "^${BUILD_SOURCEBRANCHNAME}$"; then
+        COVERAGE=yes
+    fi
+fi
+
+"${entry_point}" "${test}" 2>&1 | "$(dirname "$0")/time-command.py"

.azure-pipelines/scripts/time-command.py

@@ -0,0 +1,25 @@
+#!/usr/bin/env python
+"""Prepends a relative timestamp to each input line from stdin and writes it to stdout."""
+
+from __future__ import (absolute_import, division, print_function)
+__metaclass__ = type
+
+import sys
+import time
+
+
+def main():
+    """Main program entry point."""
+    start = time.time()
+
+    sys.stdin.reconfigure(errors='surrogateescape')
+    sys.stdout.reconfigure(errors='surrogateescape')
+
+    for line in sys.stdin:
+        seconds = time.time() - start
+        sys.stdout.write('%02d:%02d %s' % (seconds // 60, seconds % 60, line))
+        sys.stdout.flush()
+
+
+if __name__ == '__main__':
+    main()

.azure-pipelines/templates/coverage.yml

@@ -0,0 +1,39 @@
+# This template adds a job for processing code coverage data.
+# It will upload results to Azure Pipelines and codecov.io.
+# Use it from a job stage that completes after all other jobs have completed.
+# This can be done by placing it in a separate summary stage that runs after the test stage(s) have completed.
+
+jobs:
+  - job: Coverage
+    displayName: Code Coverage
+    container: default
+    workspace:
+      clean: all
+    steps:
+      - checkout: self
+        fetchDepth: $(fetchDepth)
+        path: $(checkoutPath)
+      - task: DownloadPipelineArtifact@2
+        displayName: Download Coverage Data
+        inputs:
+          path: coverage/
+          patterns: "Coverage */*=coverage.combined"
+      - bash: .azure-pipelines/scripts/combine-coverage.py coverage/
+        displayName: Combine Coverage Data
+      - bash: .azure-pipelines/scripts/report-coverage.sh
+        displayName: Generate Coverage Report
+        condition: gt(variables.coverageFileCount, 0)
+      - task: PublishCodeCoverageResults@1
+        inputs:
+          codeCoverageTool: Cobertura
+          # Azure Pipelines only accepts a single coverage data file.
+          # That means only Python or PowerShell coverage can be uploaded, but not both.
+          # Set the "pipelinesCoverage" variable to determine which type is uploaded.
+          # Use "coverage" for Python and "coverage-powershell" for PowerShell.
+          summaryFileLocation: "$(outputPath)/reports/$(pipelinesCoverage).xml"
+        displayName: Publish to Azure Pipelines
+        condition: gt(variables.coverageFileCount, 0)
+      - bash: .azure-pipelines/scripts/publish-codecov.sh "$(outputPath)"
+        displayName: Publish to codecov.io
+        condition: gt(variables.coverageFileCount, 0)
+        continueOnError: true

.azure-pipelines/templates/matrix.yml

@@ -0,0 +1,55 @@
+# This template uses the provided targets and optional groups to generate a matrix which is then passed to the test template.
+# If this matrix template does not provide the required functionality, consider using the test template directly instead.
+
+parameters:
+  # A required list of dictionaries, one per test target.
+  # Each item in the list must contain a "test" or "name" key.
+  # Both may be provided. If one is omitted, the other will be used.
+  - name: targets
+    type: object
+
+  # An optional list of values which will be used to multiply the targets list into a matrix.
+  # Values can be strings or numbers.
+  - name: groups
+    type: object
+    default: []
+
+  # An optional format string used to generate the job name.
+  # - {0} is the name of an item in the targets list.
+  - name: nameFormat
+    type: string
+    default: "{0}"
+
+  # An optional format string used to generate the test name.
+  # - {0} is the name of an item in the targets list.
+  - name: testFormat
+    type: string
+    default: "{0}"
+
+  # An optional format string used to add the group to the job name.
+  # {0} is the formatted name of an item in the targets list.
+  # {{1}} is the group -- be sure to include the double "{{" and "}}".
+  - name: nameGroupFormat
+    type: string
+    default: "{0} - {{1}}"
+
+  # An optional format string used to add the group to the test name.
+  # {0} is the formatted test of an item in the targets list.
+  # {{1}} is the group -- be sure to include the double "{{" and "}}".
+  - name: testGroupFormat
+    type: string
+    default: "{0}/{{1}}"
+
+jobs:
+  - template: test.yml
+    parameters:
+      jobs:
+        - ${{ if eq(length(parameters.groups), 0) }}:
+          - ${{ each target in parameters.targets }}:
+            - name: ${{ format(parameters.nameFormat, coalesce(target.name, target.test)) }}
+              test: ${{ format(parameters.testFormat, coalesce(target.test, target.name)) }}
+        - ${{ if not(eq(length(parameters.groups), 0)) }}:
+          - ${{ each group in parameters.groups }}:
+            - ${{ each target in parameters.targets }}:
+              - name: ${{ format(format(parameters.nameGroupFormat, parameters.nameFormat), coalesce(target.name, target.test), group) }}
+                test: ${{ format(format(parameters.testGroupFormat, parameters.testFormat), coalesce(target.test, target.name), group) }}

.azure-pipelines/templates/test.yml

@@ -0,0 +1,45 @@
+# This template uses the provided list of jobs to create test one or more test jobs.
+# It can be used directly if needed, or through the matrix template.
+
+parameters:
+  # A required list of dictionaries, one per test job.
+  # Each item in the list must contain a "job" and "name" key.
+  - name: jobs
+    type: object
+
+jobs:
+  - ${{ each job in parameters.jobs }}:
+    - job: test_${{ replace(replace(replace(job.test, '/', '_'), '.', '_'), '-', '_') }}
+      displayName: ${{ job.name }}
+      container: default
+      workspace:
+        clean: all
+      steps:
+        - checkout: self
+          fetchDepth: $(fetchDepth)
+          path: $(checkoutPath)
+        - bash: .azure-pipelines/scripts/run-tests.sh "$(entryPoint)" "${{ job.test }}" "$(coverageBranches)"
+          displayName: Run Tests
+        - bash: .azure-pipelines/scripts/process-results.sh
+          condition: succeededOrFailed()
+          displayName: Process Results
+        - bash: .azure-pipelines/scripts/aggregate-coverage.sh "$(Agent.TempDirectory)"
+          condition: eq(variables.haveCoverageData, 'true')
+          displayName: Aggregate Coverage Data
+        - task: PublishTestResults@2
+          condition: eq(variables.haveTestResults, 'true')
+          inputs:
+            testResultsFiles: "$(outputPath)/junit/*.xml"
+          displayName: Publish Test Results
+        - task: PublishPipelineArtifact@1
+          condition: eq(variables.haveBotResults, 'true')
+          displayName: Publish Bot Results
+          inputs:
+            targetPath: "$(outputPath)/bot/"
+            artifactName: "Bot $(System.JobAttempt) $(System.StageDisplayName) $(System.JobDisplayName)"
+        - task: PublishPipelineArtifact@1
+          condition: eq(variables.haveCoverageData, 'true')
+          displayName: Publish Coverage Data
+          inputs:
+            targetPath: "$(Agent.TempDirectory)/coverage/"
+            artifactName: "Coverage $(System.JobAttempt) $(System.StageDisplayName) $(System.JobDisplayName)"

CHANGELOG.rst

@@ -5,6 +5,170 @@ Community Crypto Release Notes
 .. contents:: Topics
 
 
+v1.6.1
+======
+
+Release Summary
+---------------
+
+Bugfix release.
+
+Bugfixes
+--------
+
+- acme_* modules - fix wrong usages of ``ACMEProtocolException`` (https://github.com/ansible-collections/community.crypto/pull/216, https://github.com/ansible-collections/community.crypto/pull/217).
+
+v1.6.0
+======
+
+Release Summary
+---------------
+
+Fixes compatibility issues with the latest ansible-core 2.11 beta, and contains a lot of internal refactoring for the ACME modules and support for private key passphrases for them.
+
+Minor Changes
+-------------
+
+- acme module_utils - the ``acme`` module_utils has been split up into several Python modules (https://github.com/ansible-collections/community.crypto/pull/184).
+- acme_* modules - codebase refactor which should not be visible to end-users (https://github.com/ansible-collections/community.crypto/pull/184).
+- acme_* modules - support account key passphrases for ``cryptography`` backend (https://github.com/ansible-collections/community.crypto/issues/197, https://github.com/ansible-collections/community.crypto/pull/207).
+- acme_certificate_revoke - support revoking by private keys that are passphrase protected for ``cryptography`` backend (https://github.com/ansible-collections/community.crypto/pull/207).
+- acme_challenge_cert_helper - add ``private_key_passphrase`` parameter (https://github.com/ansible-collections/community.crypto/pull/207).
+
+Deprecated Features
+-------------------
+
+- acme module_utils - the ``acme`` module_utils (``ansible_collections.community.crypto.plugins.module_utils.acme``) is deprecated and will be removed in community.crypto 2.0.0. Use the new Python modules in the ``acme`` package instead (``ansible_collections.community.crypto.plugins.module_utils.acme.xxx``) (https://github.com/ansible-collections/community.crypto/pull/184).
+
+Bugfixes
+--------
+
+- action_module plugin helper - make compatible with latest changes in ansible-core 2.11.0b3 (https://github.com/ansible-collections/community.crypto/pull/202).
+- openssl_privatekey_pipe - make compatible with latest changes in ansible-core 2.11.0b3 (https://github.com/ansible-collections/community.crypto/pull/202).
+
+v1.5.0
+======
+
+Release Summary
+---------------
+
+Regular feature and bugfix release. Deprecates a return value.
+
+Minor Changes
+-------------
+
+- acme_account_info - when ``retrieve_orders`` is not ``ignore`` and the ACME server allows to query orders, the new return value ``order_uris`` is always populated with a list of URIs (https://github.com/ansible-collections/community.crypto/pull/178).
+- luks_device - allow to specify sector size for LUKS2 containers with new ``sector_size`` parameter (https://github.com/ansible-collections/community.crypto/pull/193).
+
+Deprecated Features
+-------------------
+
+- acme_account_info - when ``retrieve_orders=url_list``, ``orders`` will no longer be returned in community.crypto 2.0.0. Use ``order_uris`` instead (https://github.com/ansible-collections/community.crypto/pull/178).
+
+Bugfixes
+--------
+
+- openssl_csr - no longer fails when comparing CSR without basic constraint when ``basic_constraints`` is specified (https://github.com/ansible-collections/community.crypto/issues/179, https://github.com/ansible-collections/community.crypto/pull/180).
+
+v1.4.0
+======
+
+Release Summary
+---------------
+
+Release with several new features and bugfixes.
+
+Minor Changes
+-------------
+
+- The ACME module_utils has been relicensed back from the Simplified BSD License (https://opensource.org/licenses/BSD-2-Clause) to the GPLv3+ (same license used by most other code in this collection). This undoes a licensing change when the original GPLv3+ licensed code was moved to module_utils in https://github.com/ansible/ansible/pull/40697 (https://github.com/ansible-collections/community.crypto/pull/165).
+- The ``crypto/identify.py`` module_utils has been renamed to ``crypto/pem.py`` (https://github.com/ansible-collections/community.crypto/pull/166).
+- luks_device - ``new_keyfile``, ``new_passphrase``, ``remove_keyfile`` and ``remove_passphrase`` are now idempotent (https://github.com/ansible-collections/community.crypto/issues/19, https://github.com/ansible-collections/community.crypto/pull/168).
+- luks_device - allow to configure PBKDF (https://github.com/ansible-collections/community.crypto/pull/163).
+- openssl_csr, openssl_csr_pipe - allow to specify CRL distribution endpoints with ``crl_distribution_points`` (https://github.com/ansible-collections/community.crypto/issues/147, https://github.com/ansible-collections/community.crypto/pull/167).
+- openssl_pkcs12 - allow to specify certificate bundles in ``other_certificates`` by using new option ``other_certificates_parse_all`` (https://github.com/ansible-collections/community.crypto/issues/149, https://github.com/ansible-collections/community.crypto/pull/166).
+
+Bugfixes
+--------
+
+- acme_certificate - error when requested challenge type is not found for non-valid challenges, instead of hanging on step 2 (https://github.com/ansible-collections/community.crypto/issues/171, https://github.com/ansible-collections/community.crypto/pull/173).
+
+v1.3.0
+======
+
+Release Summary
+---------------
+
+Contains new modules ``openssl_privatekey_pipe``, ``openssl_csr_pipe`` and ``x509_certificate_pipe`` which allow to create or update private keys, CSRs and X.509 certificates without having to write them to disk.
+
+
+Minor Changes
+-------------
+
+- openssh_cert - add module parameter ``use_agent`` to enable using signing keys stored in ssh-agent (https://github.com/ansible-collections/community.crypto/issues/116).
+- openssl_csr - refactor module to allow code re-use by openssl_csr_pipe (https://github.com/ansible-collections/community.crypto/pull/123).
+- openssl_privatekey - refactor module to allow code re-use by openssl_privatekey_pipe (https://github.com/ansible-collections/community.crypto/pull/119).
+- openssl_privatekey - the elliptic curve ``secp192r1`` now triggers a security warning. Elliptic curves of at least 224 bits should be used for new keys; see `here <https://cryptography.io/en/latest/hazmat/primitives/asymmetric/ec.html#elliptic-curves>`_ (https://github.com/ansible-collections/community.crypto/pull/132).
+- x509_certificate - for the ``selfsigned`` provider, a CSR is not required anymore. If no CSR is provided, the module behaves as if a minimal CSR which only contains the public key has been provided (https://github.com/ansible-collections/community.crypto/issues/32, https://github.com/ansible-collections/community.crypto/pull/129).
+- x509_certificate - refactor module to allow code re-use by x509_certificate_pipe (https://github.com/ansible-collections/community.crypto/pull/135).
+
+Bugfixes
+--------
+
+- openssl_pkcs12 - report the correct state when ``action`` is ``parse`` (https://github.com/ansible-collections/community.crypto/issues/143).
+- support code - improve handling of certificate and certificate signing request (CSR) loading with the ``cryptography`` backend when errors occur (https://github.com/ansible-collections/community.crypto/issues/138, https://github.com/ansible-collections/community.crypto/pull/139).
+- x509_certificate - fix ``entrust`` provider, which was broken since community.crypto 0.1.0 due to a feature added before the collection move (https://github.com/ansible-collections/community.crypto/pull/135).
+
+New Modules
+-----------
+
+- openssl_csr_pipe - Generate OpenSSL Certificate Signing Request (CSR)
+- openssl_privatekey_pipe - Generate OpenSSL private keys without disk access
+- x509_certificate_pipe - Generate and/or check OpenSSL certificates
+
+v1.2.0
+======
+
+Release Summary
+---------------
+
+Please note that this release fixes a security issue (CVE-2020-25646).
+
+Minor Changes
+-------------
+
+- acme_certificate - allow to pass CSR file as content with new option ``csr_content`` (https://github.com/ansible-collections/community.crypto/pull/115).
+- x509_certificate_info - add ``fingerprints`` return value which returns certificate fingerprints (https://github.com/ansible-collections/community.crypto/pull/121).
+
+Security Fixes
+--------------
+
+- openssl_csr - the option ``privatekey_content`` was not marked as ``no_log``, resulting in it being dumped into the system log by default, and returned in the registered results in the ``invocation`` field (CVE-2020-25646, https://github.com/ansible-collections/community.crypto/pull/125).
+- openssl_privatekey_info - the option ``content`` was not marked as ``no_log``, resulting in it being dumped into the system log by default, and returned in the registered results in the ``invocation`` field (CVE-2020-25646, https://github.com/ansible-collections/community.crypto/pull/125).
+- openssl_publickey - the option ``privatekey_content`` was not marked as ``no_log``, resulting in it being dumped into the system log by default, and returned in the registered results in the ``invocation`` field (CVE-2020-25646, https://github.com/ansible-collections/community.crypto/pull/125).
+- openssl_signature - the option ``privatekey_content`` was not marked as ``no_log``, resulting in it being dumped into the system log by default, and returned in the registered results in the ``invocation`` field (CVE-2020-25646, https://github.com/ansible-collections/community.crypto/pull/125).
+- x509_certificate - the options ``privatekey_content`` and ``ownca_privatekey_content`` were not marked as ``no_log``, resulting in it being dumped into the system log by default, and returned in the registered results in the ``invocation`` field (CVE-2020-25646, https://github.com/ansible-collections/community.crypto/pull/125).
+- x509_crl - the option ``privatekey_content`` was not marked as ``no_log``, resulting in it being dumped into the system log by default, and returned in the registered results in the ``invocation`` field (CVE-2020-25646, https://github.com/ansible-collections/community.crypto/pull/125).
+
+Bugfixes
+--------
+
+- openssl_pkcs12 - do not crash when reading PKCS#12 file which has no private key and/or no main certificate (https://github.com/ansible-collections/community.crypto/issues/103).
+
+v1.1.1
+======
+
+Release Summary
+---------------
+
+Bugfixes for Ansible 2.10.0.
+
+Bugfixes
+--------
+
+- meta/runtime.yml - convert Ansible version numbers for old names of modules to collection version numbers (https://github.com/ansible-collections/community.crypto/pull/108).
+- openssl_csr - improve handling of IDNA errors (https://github.com/ansible-collections/community.crypto/issues/105).
+
 v1.1.0
 ======
 

README.md

@@ -1,12 +1,15 @@
 # Ansible Community Crypto Collection
-[![Shippable build status](https://api.shippable.com/projects/5e66776ca27f990007073a42/badge?branch=main)](https://app.shippable.com/projects/5e66776ca27f990007073a42)
+
+[![Build Status](https://dev.azure.com/ansible/community.crypto/_apis/build/status/CI?branchName=main)](https://dev.azure.com/ansible/community.crypto/_build?definitionId=21)
 [![Codecov](https://img.shields.io/codecov/c/github/ansible-collections/community.crypto)](https://codecov.io/gh/ansible-collections/community.crypto)
 
 Provides modules for [Ansible](https://www.ansible.com/community) for various cryptographic operations.
 
+You can find [documentation for this collection on the Ansible docs site](https://docs.ansible.com/ansible/latest/collections/community/crypto/).
+
 ## Tested with Ansible
 
-Tested with both the current Ansible 2.9 and 2.10 releases and the current development version of Ansible. Ansible versions before 2.9.10 are not supported.
+Tested with the current Ansible 2.9, ansible-base 2.10 and ansible-core 2.11 releases and the current development version of ansible-core. Ansible versions before 2.9.10 are not supported.
 
 ## External requirements
 
@@ -48,6 +51,8 @@ Most modules require a recent enough version of [the Python cryptography library
   - get_certificate
   - luks_device
 
+You can also find a list of all modules with documentation on the [Ansible docs site](https://docs.ansible.com/ansible/latest/collections/community/crypto/).
+
 ## Using this collection
 
 Before using the crypto community collection, you need to install the collection with the `ansible-galaxy` CLI:

changelogs/changelog.yaml

@@ -185,3 +185,200 @@ releases:
       name: openssl_signature_info
       namespace: ''
     release_date: '2020-08-18'
+  1.1.1:
+    changes:
+      bugfixes:
+      - meta/runtime.yml - convert Ansible version numbers for old names of modules
+        to collection version numbers (https://github.com/ansible-collections/community.crypto/pull/108).
+      - openssl_csr - improve handling of IDNA errors (https://github.com/ansible-collections/community.crypto/issues/105).
+      release_summary: Bugfixes for Ansible 2.10.0.
+    fragments:
+    - 1.1.1.yml
+    - 106-openssl_csr-idna-errors.yml
+    - 108-meta-runtime-versions.yml
+    release_date: '2020-09-14'
+  1.2.0:
+    changes:
+      bugfixes:
+      - openssl_pkcs12 - do not crash when reading PKCS#12 file which has no private
+        key and/or no main certificate (https://github.com/ansible-collections/community.crypto/issues/103).
+      minor_changes:
+      - acme_certificate - allow to pass CSR file as content with new option ``csr_content``
+        (https://github.com/ansible-collections/community.crypto/pull/115).
+      - x509_certificate_info - add ``fingerprints`` return value which returns certificate
+        fingerprints (https://github.com/ansible-collections/community.crypto/pull/121).
+      release_summary: Please note that this release fixes a security issue (CVE-2020-25646).
+      security_fixes:
+      - openssl_csr - the option ``privatekey_content`` was not marked as ``no_log``,
+        resulting in it being dumped into the system log by default, and returned
+        in the registered results in the ``invocation`` field (CVE-2020-25646, https://github.com/ansible-collections/community.crypto/pull/125).
+      - openssl_privatekey_info - the option ``content`` was not marked as ``no_log``,
+        resulting in it being dumped into the system log by default, and returned
+        in the registered results in the ``invocation`` field (CVE-2020-25646, https://github.com/ansible-collections/community.crypto/pull/125).
+      - openssl_publickey - the option ``privatekey_content`` was not marked as ``no_log``,
+        resulting in it being dumped into the system log by default, and returned
+        in the registered results in the ``invocation`` field (CVE-2020-25646, https://github.com/ansible-collections/community.crypto/pull/125).
+      - openssl_signature - the option ``privatekey_content`` was not marked as ``no_log``,
+        resulting in it being dumped into the system log by default, and returned
+        in the registered results in the ``invocation`` field (CVE-2020-25646, https://github.com/ansible-collections/community.crypto/pull/125).
+      - x509_certificate - the options ``privatekey_content`` and ``ownca_privatekey_content``
+        were not marked as ``no_log``, resulting in it being dumped into the system
+        log by default, and returned in the registered results in the ``invocation``
+        field (CVE-2020-25646, https://github.com/ansible-collections/community.crypto/pull/125).
+      - x509_crl - the option ``privatekey_content`` was not marked as ``no_log``,
+        resulting in it being dumped into the system log by default, and returned
+        in the registered results in the ``invocation`` field (CVE-2020-25646, https://github.com/ansible-collections/community.crypto/pull/125).
+    fragments:
+    - 1.2.0.yml
+    - 109-openssl_pkcs12-crash-no-cert-key.yml
+    - 115-acme_certificate-csr_content.yml
+    - 121-x509_certificate_info-fingerprints.yml
+    - cve-2020-25646.yml
+    release_date: '2020-10-13'
+  1.3.0:
+    changes:
+      bugfixes:
+      - openssl_pkcs12 - report the correct state when ``action`` is ``parse`` (https://github.com/ansible-collections/community.crypto/issues/143).
+      - support code - improve handling of certificate and certificate signing request
+        (CSR) loading with the ``cryptography`` backend when errors occur (https://github.com/ansible-collections/community.crypto/issues/138,
+        https://github.com/ansible-collections/community.crypto/pull/139).
+      - x509_certificate - fix ``entrust`` provider, which was broken since community.crypto
+        0.1.0 due to a feature added before the collection move (https://github.com/ansible-collections/community.crypto/pull/135).
+      minor_changes:
+      - openssh_cert - add module parameter ``use_agent`` to enable using signing
+        keys stored in ssh-agent (https://github.com/ansible-collections/community.crypto/issues/116).
+      - openssl_csr - refactor module to allow code re-use by openssl_csr_pipe (https://github.com/ansible-collections/community.crypto/pull/123).
+      - openssl_privatekey - refactor module to allow code re-use by openssl_privatekey_pipe
+        (https://github.com/ansible-collections/community.crypto/pull/119).
+      - openssl_privatekey - the elliptic curve ``secp192r1`` now triggers a security
+        warning. Elliptic curves of at least 224 bits should be used for new keys;
+        see `here <https://cryptography.io/en/latest/hazmat/primitives/asymmetric/ec.html#elliptic-curves>`_
+        (https://github.com/ansible-collections/community.crypto/pull/132).
+      - x509_certificate - for the ``selfsigned`` provider, a CSR is not required
+        anymore. If no CSR is provided, the module behaves as if a minimal CSR which
+        only contains the public key has been provided (https://github.com/ansible-collections/community.crypto/issues/32,
+        https://github.com/ansible-collections/community.crypto/pull/129).
+      - x509_certificate - refactor module to allow code re-use by x509_certificate_pipe
+        (https://github.com/ansible-collections/community.crypto/pull/135).
+      release_summary: 'Contains new modules ``openssl_privatekey_pipe``, ``openssl_csr_pipe``
+        and ``x509_certificate_pipe`` which allow to create or update private keys,
+        CSRs and X.509 certificates without having to write them to disk.
+
+        '
+    fragments:
+    - 1.3.0.yml
+    - 117-openssh_cert-use-ssh-agent.yml
+    - 129-x509_certificate-no-csr-selfsigned.yml
+    - 132-openssl_privatekey-ecc-order.yml
+    - 135-x509_certificate-entrust.yml
+    - 139-improve-error-handling.yml
+    - 145-add-check-for-parsed-pkcs12-files.yml
+    - privatekey-csr-certificate-refactoring.yml
+    modules:
+    - description: Generate OpenSSL Certificate Signing Request (CSR)
+      name: openssl_csr_pipe
+      namespace: ''
+    - description: Generate OpenSSL private keys without disk access
+      name: openssl_privatekey_pipe
+      namespace: ''
+    - description: Generate and/or check OpenSSL certificates
+      name: x509_certificate_pipe
+      namespace: ''
+    release_date: '2020-11-24'
+  1.4.0:
+    changes:
+      bugfixes:
+      - acme_certificate - error when requested challenge type is not found for non-valid
+        challenges, instead of hanging on step 2 (https://github.com/ansible-collections/community.crypto/issues/171,
+        https://github.com/ansible-collections/community.crypto/pull/173).
+      minor_changes:
+      - The ACME module_utils has been relicensed back from the Simplified BSD License
+        (https://opensource.org/licenses/BSD-2-Clause) to the GPLv3+ (same license
+        used by most other code in this collection). This undoes a licensing change
+        when the original GPLv3+ licensed code was moved to module_utils in https://github.com/ansible/ansible/pull/40697
+        (https://github.com/ansible-collections/community.crypto/pull/165).
+      - The ``crypto/identify.py`` module_utils has been renamed to ``crypto/pem.py``
+        (https://github.com/ansible-collections/community.crypto/pull/166).
+      - luks_device - ``new_keyfile``, ``new_passphrase``, ``remove_keyfile`` and
+        ``remove_passphrase`` are now idempotent (https://github.com/ansible-collections/community.crypto/issues/19,
+        https://github.com/ansible-collections/community.crypto/pull/168).
+      - luks_device - allow to configure PBKDF (https://github.com/ansible-collections/community.crypto/pull/163).
+      - openssl_csr, openssl_csr_pipe - allow to specify CRL distribution endpoints
+        with ``crl_distribution_points`` (https://github.com/ansible-collections/community.crypto/issues/147,
+        https://github.com/ansible-collections/community.crypto/pull/167).
+      - openssl_pkcs12 - allow to specify certificate bundles in ``other_certificates``
+        by using new option ``other_certificates_parse_all`` (https://github.com/ansible-collections/community.crypto/issues/149,
+        https://github.com/ansible-collections/community.crypto/pull/166).
+      release_summary: Release with several new features and bugfixes.
+    fragments:
+    - 1.4.0.yml
+    - 163-luks-pbkdf.yml
+    - 166-openssl_pkcs12-certificate-bundles.yml
+    - 167-openssl_csr-crl-distribution-points.yml
+    - 168-luks_device-add-remove-idempotence.yml
+    - 173-acme_certificate-wrong-challenge.yml
+    - acme-module-utils-relicense.yml
+    release_date: '2021-01-26'
+  1.5.0:
+    changes:
+      bugfixes:
+      - openssl_csr - no longer fails when comparing CSR without basic constraint
+        when ``basic_constraints`` is specified (https://github.com/ansible-collections/community.crypto/issues/179,
+        https://github.com/ansible-collections/community.crypto/pull/180).
+      deprecated_features:
+      - acme_account_info - when ``retrieve_orders=url_list``, ``orders`` will no
+        longer be returned in community.crypto 2.0.0. Use ``order_uris`` instead (https://github.com/ansible-collections/community.crypto/pull/178).
+      minor_changes:
+      - acme_account_info - when ``retrieve_orders`` is not ``ignore`` and the ACME
+        server allows to query orders, the new return value ``order_uris`` is always
+        populated with a list of URIs (https://github.com/ansible-collections/community.crypto/pull/178).
+      - luks_device - allow to specify sector size for LUKS2 containers with new ``sector_size``
+        parameter (https://github.com/ansible-collections/community.crypto/pull/193).
+      release_summary: Regular feature and bugfix release. Deprecates a return value.
+    fragments:
+    - 1.5.0.yml
+    - 178-acme_account_info-orders-urls.yml
+    - 179-openssl-csr-basic-constraint.yml
+    - 193-luks_device-sector_size.yml
+    release_date: '2021-03-08'
+  1.6.0:
+    changes:
+      bugfixes:
+      - action_module plugin helper - make compatible with latest changes in ansible-core
+        2.11.0b3 (https://github.com/ansible-collections/community.crypto/pull/202).
+      - openssl_privatekey_pipe - make compatible with latest changes in ansible-core
+        2.11.0b3 (https://github.com/ansible-collections/community.crypto/pull/202).
+      deprecated_features:
+      - acme module_utils - the ``acme`` module_utils (``ansible_collections.community.crypto.plugins.module_utils.acme``)
+        is deprecated and will be removed in community.crypto 2.0.0. Use the new Python
+        modules in the ``acme`` package instead (``ansible_collections.community.crypto.plugins.module_utils.acme.xxx``)
+        (https://github.com/ansible-collections/community.crypto/pull/184).
+      minor_changes:
+      - acme module_utils - the ``acme`` module_utils has been split up into several
+        Python modules (https://github.com/ansible-collections/community.crypto/pull/184).
+      - acme_* modules - codebase refactor which should not be visible to end-users
+        (https://github.com/ansible-collections/community.crypto/pull/184).
+      - acme_* modules - support account key passphrases for ``cryptography`` backend
+        (https://github.com/ansible-collections/community.crypto/issues/197, https://github.com/ansible-collections/community.crypto/pull/207).
+      - acme_certificate_revoke - support revoking by private keys that are passphrase
+        protected for ``cryptography`` backend (https://github.com/ansible-collections/community.crypto/pull/207).
+      - acme_challenge_cert_helper - add ``private_key_passphrase`` parameter (https://github.com/ansible-collections/community.crypto/pull/207).
+      release_summary: Fixes compatibility issues with the latest ansible-core 2.11
+        beta, and contains a lot of internal refactoring for the ACME modules and
+        support for private key passphrases for them.
+    fragments:
+    - 1.6.0.yml
+    - 184-acme-refactor.yml
+    - 202-actionmodule-plugin-utils-ansible-core-2.11.yml
+    - 207-acme-account-key-passphrase.yml
+    release_date: '2021-03-22'
+  1.6.1:
+    changes:
+      bugfixes:
+      - acme_* modules - fix wrong usages of ``ACMEProtocolException`` (https://github.com/ansible-collections/community.crypto/pull/216,
+        https://github.com/ansible-collections/community.crypto/pull/217).
+      release_summary: Bugfix release.
+    fragments:
+    - 1.6.1.yml
+    - 217-acme-exceptions.yml
+    release_date: '2021-04-11'

galaxy.yml

@@ -1,6 +1,6 @@
 namespace: community
 name: crypto
-version: 1.1.0
+version: 1.6.1
 readme: README.md
 authors:
   - Ansible (github.com/ansible)
@@ -21,7 +21,7 @@ tags:
   - openssh
   - pkcs12
 repository: https://github.com/ansible-collections/community.crypto
-#documentation: https://github.com/ansible-collection-migration/community.crypto/tree/main/docs
+documentation: https://docs.ansible.com/ansible/latest/collections/community/crypto/
 homepage: https://github.com/ansible-collections/community.crypto
 issues: https://github.com/ansible-collections/community.crypto/issues
 build_ignore:

meta/runtime.yml

@@ -13,13 +13,19 @@ plugin_routing:
   modules:
     acme_account_facts:
       deprecation:
-        removal_version: '2.12'
+        removal_version: 2.0.0
         warning_text: The 'community.crypto.acme_account_facts' module has been renamed to 'community.crypto.acme_account_info'.
     openssl_certificate:
       deprecation:
-        removal_version: '2.14'
+        removal_version: 2.0.0
         warning_text: The 'community.crypto.openssl_certificate' module has been renamed to 'community.crypto.x509_certificate'
     openssl_certificate_info:
       deprecation:
-        removal_version: '2.14'
+        removal_version: 2.0.0
         warning_text: The 'community.crypto.openssl_certificate_info' module has been renamed to 'community.crypto.x509_certificate_info'
+  module_utils:
+    crypto.identify:
+      redirect: community.crypto.crypto.pem
+      deprecation:
+        removal_version: 2.0.0
+        warning_text: The 'crypto/identify.py' module_utils has been renamed 'crypto/pem.py'. Please update your imports

plugins/action/openssl_privatekey_pipe.py

@@ -0,0 +1,107 @@
+# -*- coding: utf-8 -*-
+
+# Copyright: (c) 2020, Felix Fontein <felix@fontein.de>
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+
+from __future__ import absolute_import, division, print_function
+__metaclass__ = type
+
+
+import base64
+
+from ansible.module_utils._text import to_native, to_bytes
+
+from ansible_collections.community.crypto.plugins.plugin_utils.action_module import ActionModuleBase
+
+from ansible_collections.community.crypto.plugins.module_utils.crypto.basic import (
+    OpenSSLObjectError,
+)
+
+from ansible_collections.community.crypto.plugins.module_utils.crypto.module_backends.privatekey import (
+    select_backend,
+    get_privatekey_argument_spec,
+)
+
+
+class PrivateKeyModule(object):
+    def __init__(self, module, module_backend):
+        self.module = module
+        self.module_backend = module_backend
+        self.check_mode = module.check_mode
+        self.changed = False
+        self.return_current_key = module.params['return_current_key']
+
+        if module.params['content'] is not None:
+            if module.params['content_base64']:
+                try:
+                    data = base64.b64decode(module.params['content'])
+                except Exception as e:
+                    module.fail_json(msg='Cannot decode Base64 encoded data: {0}'.format(e))
+            else:
+                data = to_bytes(module.params['content'])
+            module_backend.set_existing(data)
+
+    def generate(self, module):
+        """Generate a keypair."""
+
+        if self.module_backend.needs_regeneration():
+            # Regenerate
+            if not self.check_mode:
+                self.module_backend.generate_private_key()
+                privatekey_data = self.module_backend.get_private_key_data()
+                self.privatekey_bytes = privatekey_data
+            self.changed = True
+        elif self.module_backend.needs_conversion():
+            # Convert
+            if not self.check_mode:
+                self.module_backend.convert_private_key()
+                privatekey_data = self.module_backend.get_private_key_data()
+                self.privatekey_bytes = privatekey_data
+            self.changed = True
+
+    def dump(self):
+        """Serialize the object into a dictionary."""
+        result = self.module_backend.dump(include_key=self.changed or self.return_current_key)
+        result['changed'] = self.changed
+        return result
+
+
+class ActionModule(ActionModuleBase):
+    @staticmethod
+    def setup_module():
+        argument_spec = get_privatekey_argument_spec()
+        argument_spec.argument_spec.update(dict(
+            content=dict(type='str', no_log=True),
+            content_base64=dict(type='bool', default=False),
+            return_current_key=dict(type='bool', default=False),
+        ))
+        return argument_spec, dict(
+            supports_check_mode=True,
+        )
+
+    @staticmethod
+    def run_module(module):
+        backend, module_backend = select_backend(
+            module=module,
+            backend=module.params['select_crypto_backend'],
+        )
+
+        try:
+            private_key = PrivateKeyModule(module, module_backend)
+            private_key.generate(module)
+            result = private_key.dump()
+            if private_key.return_current_key:
+                # In case the module's input (`content`) is returned as `privatekey`:
+                # Since `content` is no_log=True, `privatekey`'s value will get replaced by
+                # VALUE_SPECIFIED_IN_NO_LOG_PARAMETER. To avoid this, we remove the value of
+                # `content` from module.no_log_values. Since we explicitly set
+                # `module.no_log = True`, this should be safe.
+                module.no_log = True
+                try:
+                    module.no_log_values.remove(module.params['content'])
+                except KeyError:
+                    pass
+                module.params['content'] = 'ANSIBLE_NO_LOG_VALUE'
+            module.exit_json(**result)
+        except OpenSSLObjectError as exc:
+            module.fail_json(msg=to_native(exc))

plugins/doc_fragments/acme.py

@@ -32,11 +32,11 @@ options:
       - "Path to a file containing the ACME account RSA or Elliptic Curve
          key."
       - "Private keys can be created with the
-         M(community.crypto.openssl_privatekey) module. If the requisites
-         (pyOpenSSL or cryptography) are not available, keys can also be
-         created directly with the C(openssl) command line tool: RSA keys
-         can be created with C(openssl genrsa ...). Elliptic curve keys can be
-         created with C(openssl ecparam -genkey ...). Any other tool creating
+         M(community.crypto.openssl_privatekey) or M(community.crypto.openssl_privatekey_pipe)
+         modules. If the requisites (pyOpenSSL or cryptography) are not available,
+         keys can also be created directly with the C(openssl) command line tool:
+         RSA keys can be created with C(openssl genrsa ...). Elliptic curve keys
+         can be created with C(openssl ecparam -genkey ...). Any other tool creating
          private keys in PEM format can be used as well."
       - "Mutually exclusive with C(account_key_content)."
       - "Required if C(account_key_content) is not used."
@@ -47,7 +47,7 @@ options:
       - "Content of the ACME account RSA or Elliptic Curve key."
       - "Mutually exclusive with C(account_key_src)."
       - "Required if C(account_key_src) is not used."
-      - "*Warning:* the content will be written into a temporary file, which will
+      - "B(Warning:) the content will be written into a temporary file, which will
          be deleted by Ansible when the module completes. Since this is an
          important private key — it can be used to change the account key,
          or to revoke your certificates without knowing their private keys
@@ -57,6 +57,12 @@ options:
          Ansible in the process of moving the module with its argument to
          the node where it is executed."
     type: str
+  account_key_passphrase:
+    description:
+      - Phassphrase to use to decode the account key.
+      - "B(Note:) this is not supported by the C(openssl) backend, only by the C(cryptography) backend."
+    type: str
+    version_added: 1.6.0
   account_uri:
     description:
       - "If specified, assumes that the account URI is as given. If the
@@ -66,40 +72,52 @@ options:
   acme_version:
     description:
       - "The ACME version of the endpoint."
-      - "Must be 1 for the classic Let's Encrypt and Buypass ACME endpoints,
-         or 2 for standardized ACME v2 endpoints."
-      - "The default value is 1. Note that in Ansible 2.14, this option *will
-         be required* and will no longer have a default."
+      - "Must be C(1) for the classic Let's Encrypt and Buypass ACME endpoints,
+         or C(2) for standardized ACME v2 endpoints."
+      - "The default value is C(1). Note that in community.crypto 2.0.0, this
+         option B(will be required) and will no longer have a default."
       - "Please also note that we will deprecate ACME v1 support eventually."
     type: int
     choices: [ 1, 2 ]
   acme_directory:
     description:
       - "The ACME directory to use. This is the entry point URL to access
-         CA server API."
+         the ACME CA server API."
       - "For safety reasons the default is set to the Let's Encrypt staging
          server (for the ACME v1 protocol). This will create technically correct,
          but untrusted certificates."
-      - "The default value is U(https://acme-staging.api.letsencrypt.org/directory).
-         Note that in Ansible 2.14, this option *will be required* and will no longer
-         have a default."
+      - "The default value is C(https://acme-staging.api.letsencrypt.org/directory).
+         Note that in community.crypto 2.0.0, this option B(will be required) and
+         will no longer have a default. Note that the default is the Let's Encrypt
+         staging server for the ACME v1 protocol, which is deprecated and will
+         be disabled in May 2021 (see
+         L(here,https://community.letsencrypt.org/t/end-of-life-plan-for-acmev1/88430/7)
+         for details)."
       - "For Let's Encrypt, all staging endpoints can be found here:
          U(https://letsencrypt.org/docs/staging-environment/). For Buypass, all
          endpoints can be found here:
          U(https://community.buypass.com/t/63d4ay/buypass-go-ssl-endpoints)"
-      - "For Let's Encrypt, the production directory URL for ACME v1 is
-         U(https://acme-v01.api.letsencrypt.org/directory), and the production
-         directory URL for ACME v2 is U(https://acme-v02.api.letsencrypt.org/directory)."
-      - "For Buypass, the production directory URL for ACME v2 and v1 is
+      - "For B(Let's Encrypt), the production directory URL for ACME v2 is
+         U(https://acme-v02.api.letsencrypt.org/directory).
+         (The production directory URL for ACME v1 is
+         U(https://acme-v01.api.letsencrypt.org/directory) and will be
+         disabled in July 2021.)"
+      - "For B(Buypass), the production directory URL for ACME v2 and v1 is
          U(https://api.buypass.com/acme/directory)."
-      - "*Warning:* So far, the module has only been tested against Let's Encrypt
-         (staging and production), Buypass (staging and production), and
-         L(Pebble testing server,https://github.com/letsencrypt/Pebble)."
+      - "For B(ZeroSSL), the production directory URL for ACME v2 is
+         U(https://acme.zerossl.com/v2/DV90)."
+      - "B(Warning:) So far, the ACME modules have only been tested against Let's Encrypt
+         (staging and production), Buypass (staging and production), ZeroSSL (production),
+         and L(Pebble testing server,https://github.com/letsencrypt/Pebble). If you
+         experience problems with another ACME server, please
+         L(create an issue,https://github.com/ansible-collections/community.crypto/issues/new/choose)
+         to help us supporting it. Feedback that an ACME server not mentioned does work
+         is also appreciated."
     type: str
   validate_certs:
     description:
       - Whether calls to the ACME directory will validate TLS certificates.
-      - "*Warning:* Should *only ever* be set to C(no) for testing purposes,
+      - "B(Warning:) Should B(only ever) be set to C(no) for testing purposes,
          for example when testing against a local Pebble server."
     type: bool
     default: yes

plugins/doc_fragments/module_certificate.py

@@ -0,0 +1,587 @@
+# -*- coding: utf-8 -*-
+
+# Copyright: (c) 2016-2017, Yanis Guenane <yanis+ansible@guenane.org>
+# Copyright: (c) 2017, Markus Teufelberger <mteufelberger+ansible@mgit.at>
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+
+from __future__ import absolute_import, division, print_function
+__metaclass__ = type
+
+
+class ModuleDocFragment(object):
+
+    # Standard files documentation fragment
+    DOCUMENTATION = r'''
+description:
+    - This module allows one to (re)generate OpenSSL certificates.
+    - It uses the pyOpenSSL or cryptography python library to interact with OpenSSL.
+    - If both the cryptography and PyOpenSSL libraries are available (and meet the minimum version requirements)
+      cryptography will be preferred as a backend over PyOpenSSL (unless the backend is forced with C(select_crypto_backend)).
+      Please note that the PyOpenSSL backend was deprecated in Ansible 2.9 and will be removed in community.crypto 2.0.0.
+requirements:
+    - PyOpenSSL >= 0.15 or cryptography >= 1.6 (if using C(selfsigned), C(ownca) or C(assertonly) provider)
+options:
+    force:
+        description:
+            - Generate the certificate, even if it already exists.
+        type: bool
+        default: no
+
+    csr_path:
+        description:
+            - Path to the Certificate Signing Request (CSR) used to generate this certificate.
+            - This is mutually exclusive with I(csr_content).
+        type: path
+    csr_content:
+        description:
+            - Content of the Certificate Signing Request (CSR) used to generate this certificate.
+            - This is mutually exclusive with I(csr_path).
+        type: str
+
+    privatekey_path:
+        description:
+            - Path to the private key to use when signing the certificate.
+            - This is mutually exclusive with I(privatekey_content).
+        type: path
+    privatekey_content:
+        description:
+            - Path to the private key to use when signing the certificate.
+            - This is mutually exclusive with I(privatekey_path).
+        type: str
+
+    privatekey_passphrase:
+        description:
+            - The passphrase for the I(privatekey_path) resp. I(privatekey_content).
+            - This is required if the private key is password protected.
+        type: str
+
+    select_crypto_backend:
+        description:
+            - Determines which crypto backend to use.
+            - The default choice is C(auto), which tries to use C(cryptography) if available, and falls back to C(pyopenssl).
+            - If set to C(pyopenssl), will try to use the L(pyOpenSSL,https://pypi.org/project/pyOpenSSL/) library.
+            - If set to C(cryptography), will try to use the L(cryptography,https://cryptography.io/) library.
+            - Please note that the C(pyopenssl) backend has been deprecated in Ansible 2.9, and will be removed in community.crypto 2.0.0.
+              From that point on, only the C(cryptography) backend will be available.
+        type: str
+        default: auto
+        choices: [ auto, cryptography, pyopenssl ]
+
+notes:
+    - All ASN.1 TIME values should be specified following the YYYYMMDDHHMMSSZ pattern.
+    - Date specified should be UTC. Minutes and seconds are mandatory.
+    - For security reason, when you use C(ownca) provider, you should NOT run
+      M(community.crypto.x509_certificate) on a target machine, but on a dedicated CA machine. It
+      is recommended not to store the CA private key on the target machine. Once signed, the
+      certificate can be moved to the target machine.
+seealso:
+- module: community.crypto.openssl_csr
+- module: community.crypto.openssl_csr_pipe
+- module: community.crypto.openssl_dhparam
+- module: community.crypto.openssl_pkcs12
+- module: community.crypto.openssl_privatekey
+- module: community.crypto.openssl_privatekey_pipe
+- module: community.crypto.openssl_publickey
+'''
+
+    BACKEND_ACME_DOCUMENTATION = r'''
+description:
+    - This module allows one to (re)generate OpenSSL certificates.
+requirements:
+    - acme-tiny >= 4.0.0 (if using the C(acme) provider)
+options:
+    acme_accountkey_path:
+        description:
+            - The path to the accountkey for the C(acme) provider.
+            - This is only used by the C(acme) provider.
+        type: path
+
+    acme_challenge_path:
+        description:
+            - The path to the ACME challenge directory that is served on U(http://<HOST>:80/.well-known/acme-challenge/)
+            - This is only used by the C(acme) provider.
+        type: path
+
+    acme_chain:
+        description:
+            - Include the intermediate certificate to the generated certificate
+            - This is only used by the C(acme) provider.
+            - Note that this is only available for older versions of C(acme-tiny).
+              New versions include the chain automatically, and setting I(acme_chain) to C(yes) results in an error.
+        type: bool
+        default: no
+
+    acme_directory:
+        description:
+            - "The ACME directory to use. You can use any directory that supports the ACME protocol, such as Buypass or Let's Encrypt."
+            - "Let's Encrypt recommends using their staging server while developing jobs. U(https://letsencrypt.org/docs/staging-environment/)."
+        type: str
+        default: https://acme-v02.api.letsencrypt.org/directory
+'''
+
+    BACKEND_ASSERTONLY_DOCUMENTATION = r'''
+description:
+    - The C(assertonly) provider is intended for use cases where one is only interested in
+      checking properties of a supplied certificate. Please note that this provider has been
+      deprecated in Ansible 2.9 and will be removed in community.crypto 2.0.0. See the examples on how
+      to emulate C(assertonly) usage with M(community.crypto.x509_certificate_info),
+      M(community.crypto.openssl_csr_info), M(community.crypto.openssl_privatekey_info) and
+      M(ansible.builtin.assert). This also allows more flexible checks than
+      the ones offered by the C(assertonly) provider.
+    - Many properties that can be specified in this module are for validation of an
+      existing or newly generated certificate. The proper place to specify them, if you
+      want to receive a certificate with these properties is a CSR (Certificate Signing Request).
+options:
+    csr_path:
+        description:
+            - This is not required for the C(assertonly) provider.
+
+    csr_content:
+        description:
+            - This is not required for the C(assertonly) provider.
+
+    signature_algorithms:
+        description:
+            - A list of algorithms that you would accept the certificate to be signed with
+              (e.g. ['sha256WithRSAEncryption', 'sha512WithRSAEncryption']).
+            - This is only used by the C(assertonly) provider.
+            - This option is deprecated since Ansible 2.9 and will be removed with the C(assertonly) provider in community.crypto 2.0.0.
+              For alternatives, see the example on replacing C(assertonly).
+        type: list
+        elements: str
+
+    issuer:
+        description:
+            - The key/value pairs that must be present in the issuer name field of the certificate.
+            - If you need to specify more than one value with the same key, use a list as value.
+            - This is only used by the C(assertonly) provider.
+            - This option is deprecated since Ansible 2.9 and will be removed with the C(assertonly) provider in community.crypto 2.0.0.
+              For alternatives, see the example on replacing C(assertonly).
+        type: dict
+
+    issuer_strict:
+        description:
+            - If set to C(yes), the I(issuer) field must contain only these values.
+            - This is only used by the C(assertonly) provider.
+            - This option is deprecated since Ansible 2.9 and will be removed with the C(assertonly) provider in community.crypto 2.0.0.
+              For alternatives, see the example on replacing C(assertonly).
+        type: bool
+        default: no
+
+    subject:
+        description:
+            - The key/value pairs that must be present in the subject name field of the certificate.
+            - If you need to specify more than one value with the same key, use a list as value.
+            - This is only used by the C(assertonly) provider.
+            - This option is deprecated since Ansible 2.9 and will be removed with the C(assertonly) provider in community.crypto 2.0.0.
+              For alternatives, see the example on replacing C(assertonly).
+        type: dict
+
+    subject_strict:
+        description:
+            - If set to C(yes), the I(subject) field must contain only these values.
+            - This is only used by the C(assertonly) provider.
+            - This option is deprecated since Ansible 2.9 and will be removed with the C(assertonly) provider in community.crypto 2.0.0.
+              For alternatives, see the example on replacing C(assertonly).
+        type: bool
+        default: no
+
+    has_expired:
+        description:
+            - Checks if the certificate is expired/not expired at the time the module is executed.
+            - This is only used by the C(assertonly) provider.
+            - This option is deprecated since Ansible 2.9 and will be removed with the C(assertonly) provider in community.crypto 2.0.0.
+              For alternatives, see the example on replacing C(assertonly).
+        type: bool
+        default: no
+
+    version:
+        description:
+            - The version of the certificate.
+            - Nowadays it should almost always be 3.
+            - This is only used by the C(assertonly) provider.
+            - This option is deprecated since Ansible 2.9 and will be removed with the C(assertonly) provider in community.crypto 2.0.0.
+              For alternatives, see the example on replacing C(assertonly).
+        type: int
+
+    valid_at:
+        description:
+            - The certificate must be valid at this point in time.
+            - The timestamp is formatted as an ASN.1 TIME.
+            - This is only used by the C(assertonly) provider.
+            - This option is deprecated since Ansible 2.9 and will be removed with the C(assertonly) provider in community.crypto 2.0.0.
+              For alternatives, see the example on replacing C(assertonly).
+        type: str
+
+    invalid_at:
+        description:
+            - The certificate must be invalid at this point in time.
+            - The timestamp is formatted as an ASN.1 TIME.
+            - This is only used by the C(assertonly) provider.
+            - This option is deprecated since Ansible 2.9 and will be removed with the C(assertonly) provider in community.crypto 2.0.0.
+              For alternatives, see the example on replacing C(assertonly).
+        type: str
+
+    not_before:
+        description:
+            - The certificate must start to become valid at this point in time.
+            - The timestamp is formatted as an ASN.1 TIME.
+            - This is only used by the C(assertonly) provider.
+            - This option is deprecated since Ansible 2.9 and will be removed with the C(assertonly) provider in community.crypto 2.0.0.
+              For alternatives, see the example on replacing C(assertonly).
+        type: str
+        aliases: [ notBefore ]
+
+    not_after:
+        description:
+            - The certificate must expire at this point in time.
+            - The timestamp is formatted as an ASN.1 TIME.
+            - This is only used by the C(assertonly) provider.
+            - This option is deprecated since Ansible 2.9 and will be removed with the C(assertonly) provider in community.crypto 2.0.0.
+              For alternatives, see the example on replacing C(assertonly).
+        type: str
+        aliases: [ notAfter ]
+
+    valid_in:
+        description:
+            - The certificate must still be valid at this relative time offset from now.
+            - Valid format is C([+-]timespec | number_of_seconds) where timespec can be an integer
+              + C([w | d | h | m | s]) (e.g. C(+32w1d2h).
+            - Note that if using this parameter, this module is NOT idempotent.
+            - This is only used by the C(assertonly) provider.
+            - This option is deprecated since Ansible 2.9 and will be removed with the C(assertonly) provider in community.crypto 2.0.0.
+              For alternatives, see the example on replacing C(assertonly).
+        type: str
+
+    key_usage:
+        description:
+            - The I(key_usage) extension field must contain all these values.
+            - This is only used by the C(assertonly) provider.
+            - This option is deprecated since Ansible 2.9 and will be removed with the C(assertonly) provider in community.crypto 2.0.0.
+              For alternatives, see the example on replacing C(assertonly).
+        type: list
+        elements: str
+        aliases: [ keyUsage ]
+
+    key_usage_strict:
+        description:
+            - If set to C(yes), the I(key_usage) extension field must contain only these values.
+            - This is only used by the C(assertonly) provider.
+            - This option is deprecated since Ansible 2.9 and will be removed with the C(assertonly) provider in community.crypto 2.0.0.
+              For alternatives, see the example on replacing C(assertonly).
+        type: bool
+        default: no
+        aliases: [ keyUsage_strict ]
+
+    extended_key_usage:
+        description:
+            - The I(extended_key_usage) extension field must contain all these values.
+            - This is only used by the C(assertonly) provider.
+            - This option is deprecated since Ansible 2.9 and will be removed with the C(assertonly) provider in community.crypto 2.0.0.
+              For alternatives, see the example on replacing C(assertonly).
+        type: list
+        elements: str
+        aliases: [ extendedKeyUsage ]
+
+    extended_key_usage_strict:
+        description:
+            - If set to C(yes), the I(extended_key_usage) extension field must contain only these values.
+            - This is only used by the C(assertonly) provider.
+            - This option is deprecated since Ansible 2.9 and will be removed with the C(assertonly) provider in community.crypto 2.0.0.
+              For alternatives, see the example on replacing C(assertonly).
+        type: bool
+        default: no
+        aliases: [ extendedKeyUsage_strict ]
+
+    subject_alt_name:
+        description:
+            - The I(subject_alt_name) extension field must contain these values.
+            - This is only used by the C(assertonly) provider.
+            - This option is deprecated since Ansible 2.9 and will be removed with the C(assertonly) provider in community.crypto 2.0.0.
+              For alternatives, see the example on replacing C(assertonly).
+        type: list
+        elements: str
+        aliases: [ subjectAltName ]
+
+    subject_alt_name_strict:
+        description:
+            - If set to C(yes), the I(subject_alt_name) extension field must contain only these values.
+            - This is only used by the C(assertonly) provider.
+            - This option is deprecated since Ansible 2.9 and will be removed with the C(assertonly) provider in community.crypto 2.0.0.
+              For alternatives, see the example on replacing C(assertonly).
+        type: bool
+        default: no
+        aliases: [ subjectAltName_strict ]
+'''
+
+    BACKEND_ENTRUST_DOCUMENTATION = r'''
+options:
+    entrust_cert_type:
+        description:
+            - Specify the type of certificate requested.
+            - This is only used by the C(entrust) provider.
+        type: str
+        default: STANDARD_SSL
+        choices: [ 'STANDARD_SSL', 'ADVANTAGE_SSL', 'UC_SSL', 'EV_SSL', 'WILDCARD_SSL', 'PRIVATE_SSL', 'PD_SSL', 'CDS_ENT_LITE', 'CDS_ENT_PRO', 'SMIME_ENT' ]
+
+    entrust_requester_email:
+        description:
+            - The email of the requester of the certificate (for tracking purposes).
+            - This is only used by the C(entrust) provider.
+            - This is required if the provider is C(entrust).
+        type: str
+
+    entrust_requester_name:
+        description:
+            - The name of the requester of the certificate (for tracking purposes).
+            - This is only used by the C(entrust) provider.
+            - This is required if the provider is C(entrust).
+        type: str
+
+    entrust_requester_phone:
+        description:
+            - The phone number of the requester of the certificate (for tracking purposes).
+            - This is only used by the C(entrust) provider.
+            - This is required if the provider is C(entrust).
+        type: str
+
+    entrust_api_user:
+        description:
+            - The username for authentication to the Entrust Certificate Services (ECS) API.
+            - This is only used by the C(entrust) provider.
+            - This is required if the provider is C(entrust).
+        type: str
+
+    entrust_api_key:
+        description:
+            - The key (password) for authentication to the Entrust Certificate Services (ECS) API.
+            - This is only used by the C(entrust) provider.
+            - This is required if the provider is C(entrust).
+        type: str
+
+    entrust_api_client_cert_path:
+        description:
+            - The path to the client certificate used to authenticate to the Entrust Certificate Services (ECS) API.
+            - This is only used by the C(entrust) provider.
+            - This is required if the provider is C(entrust).
+        type: path
+
+    entrust_api_client_cert_key_path:
+        description:
+            - The path to the private key of the client certificate used to authenticate to the Entrust Certificate Services (ECS) API.
+            - This is only used by the C(entrust) provider.
+            - This is required if the provider is C(entrust).
+        type: path
+
+    entrust_not_after:
+        description:
+            - The point in time at which the certificate stops being valid.
+            - Time can be specified either as relative time or as an absolute timestamp.
+            - A valid absolute time format is C(ASN.1 TIME) such as C(2019-06-18).
+            - A valid relative time format is C([+-]timespec) where timespec can be an integer + C([w | d | h | m | s]), such as C(+365d) or C(+32w1d2h)).
+            - Time will always be interpreted as UTC.
+            - Note that only the date (day, month, year) is supported for specifying the expiry date of the issued certificate.
+            - The full date-time is adjusted to EST (GMT -5:00) before issuance, which may result in a certificate with an expiration date one day
+              earlier than expected if a relative time is used.
+            - The minimum certificate lifetime is 90 days, and maximum is three years.
+            - If this value is not specified, the certificate will stop being valid 365 days the date of issue.
+            - This is only used by the C(entrust) provider.
+        type: str
+        default: +365d
+
+    entrust_api_specification_path:
+        description:
+            - The path to the specification file defining the Entrust Certificate Services (ECS) API configuration.
+            - You can use this to keep a local copy of the specification to avoid downloading it every time the module is used.
+            - This is only used by the C(entrust) provider.
+        type: path
+        default: https://cloud.entrust.net/EntrustCloud/documentation/cms-api-2.1.0.yaml
+'''
+
+    BACKEND_OWNCA_DOCUMENTATION = r'''
+description:
+    - The C(ownca) provider is intended for generating an OpenSSL certificate signed with your own
+      CA (Certificate Authority) certificate (self-signed certificate).
+options:
+    ownca_path:
+        description:
+            - Remote absolute path of the CA (Certificate Authority) certificate.
+            - This is only used by the C(ownca) provider.
+            - This is mutually exclusive with I(ownca_content).
+        type: path
+    ownca_content:
+        description:
+            - Content of the CA (Certificate Authority) certificate.
+            - This is only used by the C(ownca) provider.
+            - This is mutually exclusive with I(ownca_path).
+        type: str
+
+    ownca_privatekey_path:
+        description:
+            - Path to the CA (Certificate Authority) private key to use when signing the certificate.
+            - This is only used by the C(ownca) provider.
+            - This is mutually exclusive with I(ownca_privatekey_content).
+        type: path
+    ownca_privatekey_content:
+        description:
+            - Content of the CA (Certificate Authority) private key to use when signing the certificate.
+            - This is only used by the C(ownca) provider.
+            - This is mutually exclusive with I(ownca_privatekey_path).
+        type: str
+
+    ownca_privatekey_passphrase:
+        description:
+            - The passphrase for the I(ownca_privatekey_path) resp. I(ownca_privatekey_content).
+            - This is only used by the C(ownca) provider.
+        type: str
+
+    ownca_digest:
+        description:
+            - The digest algorithm to be used for the C(ownca) certificate.
+            - This is only used by the C(ownca) provider.
+        type: str
+        default: sha256
+
+    ownca_version:
+        description:
+            - The version of the C(ownca) certificate.
+            - Nowadays it should almost always be C(3).
+            - This is only used by the C(ownca) provider.
+        type: int
+        default: 3
+
+    ownca_not_before:
+        description:
+            - The point in time the certificate is valid from.
+            - Time can be specified either as relative time or as absolute timestamp.
+            - Time will always be interpreted as UTC.
+            - Valid format is C([+-]timespec | ASN.1 TIME) where timespec can be an integer
+              + C([w | d | h | m | s]) (e.g. C(+32w1d2h).
+            - Note that if using relative time this module is NOT idempotent.
+            - If this value is not specified, the certificate will start being valid from now.
+            - This is only used by the C(ownca) provider.
+        type: str
+        default: +0s
+
+    ownca_not_after:
+        description:
+            - The point in time at which the certificate stops being valid.
+            - Time can be specified either as relative time or as absolute timestamp.
+            - Time will always be interpreted as UTC.
+            - Valid format is C([+-]timespec | ASN.1 TIME) where timespec can be an integer
+              + C([w | d | h | m | s]) (e.g. C(+32w1d2h).
+            - Note that if using relative time this module is NOT idempotent.
+            - If this value is not specified, the certificate will stop being valid 10 years from now.
+            - This is only used by the C(ownca) provider.
+            - On macOS 10.15 and onwards, TLS server certificates must have a validity period of 825 days or fewer.
+              Please see U(https://support.apple.com/en-us/HT210176) for more details.
+        type: str
+        default: +3650d
+
+    ownca_create_subject_key_identifier:
+        description:
+            - Whether to create the Subject Key Identifier (SKI) from the public key.
+            - A value of C(create_if_not_provided) (default) only creates a SKI when the CSR does not
+              provide one.
+            - A value of C(always_create) always creates a SKI. If the CSR provides one, that one is
+              ignored.
+            - A value of C(never_create) never creates a SKI. If the CSR provides one, that one is used.
+            - This is only used by the C(ownca) provider.
+            - Note that this is only supported if the C(cryptography) backend is used!
+        type: str
+        choices: [create_if_not_provided, always_create, never_create]
+        default: create_if_not_provided
+
+    ownca_create_authority_key_identifier:
+        description:
+            - Create a Authority Key Identifier from the CA's certificate. If the CSR provided
+              a authority key identifier, it is ignored.
+            - The Authority Key Identifier is generated from the CA certificate's Subject Key Identifier,
+              if available. If it is not available, the CA certificate's public key will be used.
+            - This is only used by the C(ownca) provider.
+            - Note that this is only supported if the C(cryptography) backend is used!
+        type: bool
+        default: yes
+'''
+
+    BACKEND_SELFSIGNED_DOCUMENTATION = r'''
+notes:
+    - For the C(selfsigned) provider, I(csr_path) and I(csr_content) are optional. If not provided, a
+      certificate without any information (Subject, Subject Alternative Names, Key Usage, etc.) is created.
+
+options:
+    # NOTE: descriptions in options are overwritten, not appended. For that reason, the texts provided
+    #       here for csr_path and csr_content are not visible to the user. That's why this information is
+    #       added to the notes (see above).
+
+    # csr_path:
+    #     description:
+    #         - This is optional for the C(selfsigned) provider. If not provided, a certificate
+    #           without any information (Subject, Subject Alternative Names, Key Usage, etc.) is
+    #           created.
+
+    # csr_content:
+    #     description:
+    #         - This is optional for the C(selfsigned) provider. If not provided, a certificate
+    #           without any information (Subject, Subject Alternative Names, Key Usage, etc.) is
+    #           created.
+
+    selfsigned_version:
+        description:
+            - Version of the C(selfsigned) certificate.
+            - Nowadays it should almost always be C(3).
+            - This is only used by the C(selfsigned) provider.
+        type: int
+        default: 3
+
+    selfsigned_digest:
+        description:
+            - Digest algorithm to be used when self-signing the certificate.
+            - This is only used by the C(selfsigned) provider.
+        type: str
+        default: sha256
+
+    selfsigned_not_before:
+        description:
+            - The point in time the certificate is valid from.
+            - Time can be specified either as relative time or as absolute timestamp.
+            - Time will always be interpreted as UTC.
+            - Valid format is C([+-]timespec | ASN.1 TIME) where timespec can be an integer
+              + C([w | d | h | m | s]) (e.g. C(+32w1d2h).
+            - Note that if using relative time this module is NOT idempotent.
+            - If this value is not specified, the certificate will start being valid from now.
+            - This is only used by the C(selfsigned) provider.
+        type: str
+        default: +0s
+        aliases: [ selfsigned_notBefore ]
+
+    selfsigned_not_after:
+        description:
+            - The point in time at which the certificate stops being valid.
+            - Time can be specified either as relative time or as absolute timestamp.
+            - Time will always be interpreted as UTC.
+            - Valid format is C([+-]timespec | ASN.1 TIME) where timespec can be an integer
+              + C([w | d | h | m | s]) (e.g. C(+32w1d2h).
+            - Note that if using relative time this module is NOT idempotent.
+            - If this value is not specified, the certificate will stop being valid 10 years from now.
+            - This is only used by the C(selfsigned) provider.
+            - On macOS 10.15 and onwards, TLS server certificates must have a validity period of 825 days or fewer.
+              Please see U(https://support.apple.com/en-us/HT210176) for more details.
+        type: str
+        default: +3650d
+        aliases: [ selfsigned_notAfter ]
+
+    selfsigned_create_subject_key_identifier:
+        description:
+            - Whether to create the Subject Key Identifier (SKI) from the public key.
+            - A value of C(create_if_not_provided) (default) only creates a SKI when the CSR does not
+              provide one.
+            - A value of C(always_create) always creates a SKI. If the CSR provides one, that one is
+              ignored.
+            - A value of C(never_create) never creates a SKI. If the CSR provides one, that one is used.
+            - This is only used by the C(selfsigned) provider.
+            - Note that this is only supported if the C(cryptography) backend is used!
+        type: str
+        choices: [create_if_not_provided, always_create, never_create]
+        default: create_if_not_provided
+'''

plugins/doc_fragments/module_csr.py

@@ -0,0 +1,318 @@
+# -*- coding: utf-8 -*-
+
+# Copyrigt: (c) 2017, Yanis Guenane <yanis+ansible@guenane.org>
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+
+from __future__ import absolute_import, division, print_function
+__metaclass__ = type
+
+
+class ModuleDocFragment(object):
+
+    # Standard files documentation fragment
+    DOCUMENTATION = r'''
+description:
+    - This module allows one to (re)generate OpenSSL certificate signing requests.
+    - This module supports the subjectAltName, keyUsage, extendedKeyUsage, basicConstraints and OCSP Must Staple
+      extensions.
+    - "The module can use the cryptography Python library, or the pyOpenSSL Python
+      library. By default, it tries to detect which one is available. This can be
+      overridden with the I(select_crypto_backend) option. Please note that the
+      PyOpenSSL backend was deprecated in Ansible 2.9 and will be removed in community.crypto 2.0.0."
+requirements:
+    - Either cryptography >= 1.3
+    - Or pyOpenSSL >= 0.15
+options:
+    digest:
+        description:
+            - The digest used when signing the certificate signing request with the private key.
+        type: str
+        default: sha256
+    privatekey_path:
+        description:
+            - The path to the private key to use when signing the certificate signing request.
+            - Either I(privatekey_path) or I(privatekey_content) must be specified if I(state) is C(present), but not both.
+        type: path
+    privatekey_content:
+        description:
+            - The content of the private key to use when signing the certificate signing request.
+            - Either I(privatekey_path) or I(privatekey_content) must be specified if I(state) is C(present), but not both.
+        type: str
+    privatekey_passphrase:
+        description:
+            - The passphrase for the private key.
+            - This is required if the private key is password protected.
+        type: str
+    version:
+        description:
+            - The version of the certificate signing request.
+            - "The only allowed value according to L(RFC 2986,https://tools.ietf.org/html/rfc2986#section-4.1)
+               is 1."
+            - This option will no longer accept unsupported values from community.crypto 2.0.0 on.
+        type: int
+        default: 1
+    subject:
+        description:
+            - Key/value pairs that will be present in the subject name field of the certificate signing request.
+            - If you need to specify more than one value with the same key, use a list as value.
+        type: dict
+    country_name:
+        description:
+            - The countryName field of the certificate signing request subject.
+        type: str
+        aliases: [ C, countryName ]
+    state_or_province_name:
+        description:
+            - The stateOrProvinceName field of the certificate signing request subject.
+        type: str
+        aliases: [ ST, stateOrProvinceName ]
+    locality_name:
+        description:
+            - The localityName field of the certificate signing request subject.
+        type: str
+        aliases: [ L, localityName ]
+    organization_name:
+        description:
+            - The organizationName field of the certificate signing request subject.
+        type: str
+        aliases: [ O, organizationName ]
+    organizational_unit_name:
+        description:
+            - The organizationalUnitName field of the certificate signing request subject.
+        type: str
+        aliases: [ OU, organizationalUnitName ]
+    common_name:
+        description:
+            - The commonName field of the certificate signing request subject.
+        type: str
+        aliases: [ CN, commonName ]
+    email_address:
+        description:
+            - The emailAddress field of the certificate signing request subject.
+        type: str
+        aliases: [ E, emailAddress ]
+    subject_alt_name:
+        description:
+            - Subject Alternative Name (SAN) extension to attach to the certificate signing request.
+            - This can either be a 'comma separated string' or a YAML list.
+            - Values must be prefixed by their options. (i.e., C(email), C(URI), C(DNS), C(RID), C(IP), C(dirName),
+              C(otherName) and the ones specific to your CA).
+            - Note that if no SAN is specified, but a common name, the common
+              name will be added as a SAN except if C(useCommonNameForSAN) is
+              set to I(false).
+            - More at U(https://tools.ietf.org/html/rfc5280#section-4.2.1.6).
+        type: list
+        elements: str
+        aliases: [ subjectAltName ]
+    subject_alt_name_critical:
+        description:
+            - Should the subjectAltName extension be considered as critical.
+        type: bool
+        default: false
+        aliases: [ subjectAltName_critical ]
+    use_common_name_for_san:
+        description:
+            - If set to C(yes), the module will fill the common name in for
+              C(subject_alt_name) with C(DNS:) prefix if no SAN is specified.
+        type: bool
+        default: yes
+        aliases: [ useCommonNameForSAN ]
+    key_usage:
+        description:
+            - This defines the purpose (e.g. encipherment, signature, certificate signing)
+              of the key contained in the certificate.
+        type: list
+        elements: str
+        aliases: [ keyUsage ]
+    key_usage_critical:
+        description:
+            - Should the keyUsage extension be considered as critical.
+        type: bool
+        default: false
+        aliases: [ keyUsage_critical ]
+    extended_key_usage:
+        description:
+            - Additional restrictions (e.g. client authentication, server authentication)
+              on the allowed purposes for which the public key may be used.
+        type: list
+        elements: str
+        aliases: [ extKeyUsage, extendedKeyUsage ]
+    extended_key_usage_critical:
+        description:
+            - Should the extkeyUsage extension be considered as critical.
+        type: bool
+        default: false
+        aliases: [ extKeyUsage_critical, extendedKeyUsage_critical ]
+    basic_constraints:
+        description:
+            - Indicates basic constraints, such as if the certificate is a CA.
+        type: list
+        elements: str
+        aliases: [ basicConstraints ]
+    basic_constraints_critical:
+        description:
+            - Should the basicConstraints extension be considered as critical.
+        type: bool
+        default: false
+        aliases: [ basicConstraints_critical ]
+    ocsp_must_staple:
+        description:
+            - Indicates that the certificate should contain the OCSP Must Staple
+              extension (U(https://tools.ietf.org/html/rfc7633)).
+        type: bool
+        default: false
+        aliases: [ ocspMustStaple ]
+    ocsp_must_staple_critical:
+        description:
+            - Should the OCSP Must Staple extension be considered as critical.
+            - Note that according to the RFC, this extension should not be marked
+              as critical, as old clients not knowing about OCSP Must Staple
+              are required to reject such certificates
+              (see U(https://tools.ietf.org/html/rfc7633#section-4)).
+        type: bool
+        default: false
+        aliases: [ ocspMustStaple_critical ]
+    name_constraints_permitted:
+        description:
+            - For CA certificates, this specifies a list of identifiers which describe
+              subtrees of names that this CA is allowed to issue certificates for.
+            - Values must be prefixed by their options. (i.e., C(email), C(URI), C(DNS), C(RID), C(IP), C(dirName),
+              C(otherName) and the ones specific to your CA).
+        type: list
+        elements: str
+    name_constraints_excluded:
+        description:
+            - For CA certificates, this specifies a list of identifiers which describe
+              subtrees of names that this CA is B(not) allowed to issue certificates for.
+            - Values must be prefixed by their options. (i.e., C(email), C(URI), C(DNS), C(RID), C(IP), C(dirName),
+              C(otherName) and the ones specific to your CA).
+        type: list
+        elements: str
+    name_constraints_critical:
+        description:
+            - Should the Name Constraints extension be considered as critical.
+        type: bool
+        default: false
+    select_crypto_backend:
+        description:
+            - Determines which crypto backend to use.
+            - The default choice is C(auto), which tries to use C(cryptography) if available, and falls back to C(pyopenssl).
+            - If set to C(pyopenssl), will try to use the L(pyOpenSSL,https://pypi.org/project/pyOpenSSL/) library.
+            - If set to C(cryptography), will try to use the L(cryptography,https://cryptography.io/) library.
+            - Please note that the C(pyopenssl) backend has been deprecated in Ansible 2.9, and will be removed in community.crypto 2.0.0.
+              From that point on, only the C(cryptography) backend will be available.
+        type: str
+        default: auto
+        choices: [ auto, cryptography, pyopenssl ]
+    create_subject_key_identifier:
+        description:
+            - Create the Subject Key Identifier from the public key.
+            - "Please note that commercial CAs can ignore the value, respectively use a value of
+               their own choice instead. Specifying this option is mostly useful for self-signed
+               certificates or for own CAs."
+            - Note that this is only supported if the C(cryptography) backend is used!
+        type: bool
+        default: no
+    subject_key_identifier:
+        description:
+            - The subject key identifier as a hex string, where two bytes are separated by colons.
+            - "Example: C(00:11:22:33:44:55:66:77:88:99:aa:bb:cc:dd:ee:ff:00:11:22:33)"
+            - "Please note that commercial CAs ignore this value, respectively use a value of their
+               own choice. Specifying this option is mostly useful for self-signed certificates
+               or for own CAs."
+            - Note that this option can only be used if I(create_subject_key_identifier) is C(no).
+            - Note that this is only supported if the C(cryptography) backend is used!
+        type: str
+    authority_key_identifier:
+        description:
+            - The authority key identifier as a hex string, where two bytes are separated by colons.
+            - "Example: C(00:11:22:33:44:55:66:77:88:99:aa:bb:cc:dd:ee:ff:00:11:22:33)"
+            - If specified, I(authority_cert_issuer) must also be specified.
+            - "Please note that commercial CAs ignore this value, respectively use a value of their
+               own choice. Specifying this option is mostly useful for self-signed certificates
+               or for own CAs."
+            - Note that this is only supported if the C(cryptography) backend is used!
+            - The C(AuthorityKeyIdentifier) will only be added if at least one of I(authority_key_identifier),
+              I(authority_cert_issuer) and I(authority_cert_serial_number) is specified.
+        type: str
+    authority_cert_issuer:
+        description:
+            - Names that will be present in the authority cert issuer field of the certificate signing request.
+            - Values must be prefixed by their options. (i.e., C(email), C(URI), C(DNS), C(RID), C(IP), C(dirName),
+              C(otherName) and the ones specific to your CA)
+            - "Example: C(DNS:ca.example.org)"
+            - If specified, I(authority_key_identifier) must also be specified.
+            - "Please note that commercial CAs ignore this value, respectively use a value of their
+               own choice. Specifying this option is mostly useful for self-signed certificates
+               or for own CAs."
+            - Note that this is only supported if the C(cryptography) backend is used!
+            - The C(AuthorityKeyIdentifier) will only be added if at least one of I(authority_key_identifier),
+              I(authority_cert_issuer) and I(authority_cert_serial_number) is specified.
+        type: list
+        elements: str
+    authority_cert_serial_number:
+        description:
+            - The authority cert serial number.
+            - Note that this is only supported if the C(cryptography) backend is used!
+            - "Please note that commercial CAs ignore this value, respectively use a value of their
+               own choice. Specifying this option is mostly useful for self-signed certificates
+               or for own CAs."
+            - The C(AuthorityKeyIdentifier) will only be added if at least one of I(authority_key_identifier),
+              I(authority_cert_issuer) and I(authority_cert_serial_number) is specified.
+        type: int
+    crl_distribution_points:
+        description:
+            - Allows to specify one or multiple CRL distribution points.
+            - Only supported by the C(cryptography) backend.
+        type: list
+        elements: dict
+        suboptions:
+            full_name:
+                description:
+                    - Describes how the CRL can be retrieved.
+                    - Mutually exclusive with I(relative_name).
+                    - "Example: C(URI:https://ca.example.com/revocations.crl)."
+                type: list
+                elements: str
+            relative_name:
+                description:
+                    - Describes how the CRL can be retrieved relative to the CRL issuer.
+                    - Mutually exclusive with I(full_name).
+                    - "Example: C(/CN=example.com)."
+                    - Can only be used when cryptography >= 1.6 is installed.
+                type: list
+                elements: str
+            crl_issuer:
+                description:
+                    - Information about the issuer of the CRL.
+                type: list
+                elements: str
+            reasons:
+                description:
+                    - List of reasons that this distribution point can be used for when performing revocation checks.
+                type: list
+                elements: str
+                choices:
+                    - key_compromise
+                    - ca_compromise
+                    - affiliation_changed
+                    - superseded
+                    - cessation_of_operation
+                    - certificate_hold
+                    - privilege_withdrawn
+                    - aa_compromise
+        version_added: 1.4.0
+notes:
+    - If the certificate signing request already exists it will be checked whether subjectAltName,
+      keyUsage, extendedKeyUsage and basicConstraints only contain the requested values, whether
+      OCSP Must Staple is as requested, and if the request was signed by the given private key.
+seealso:
+- module: community.crypto.x509_certificate
+- module: community.crypto.x509_certificate_pipe
+- module: community.crypto.openssl_dhparam
+- module: community.crypto.openssl_pkcs12
+- module: community.crypto.openssl_privatekey
+- module: community.crypto.openssl_privatekey_pipe
+- module: community.crypto.openssl_publickey
+- module: community.crypto.openssl_csr_info
+'''

plugins/doc_fragments/module_privatekey.py

@@ -0,0 +1,163 @@
+# -*- coding: utf-8 -*-
+
+# Copyright: (c) 2016, Yanis Guenane <yanis+ansible@guenane.org>
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+
+from __future__ import absolute_import, division, print_function
+__metaclass__ = type
+
+
+class ModuleDocFragment(object):
+
+    # Standard files documentation fragment
+    DOCUMENTATION = r'''
+description:
+    - One can generate L(RSA,https://en.wikipedia.org/wiki/RSA_%28cryptosystem%29),
+      L(DSA,https://en.wikipedia.org/wiki/Digital_Signature_Algorithm),
+      L(ECC,https://en.wikipedia.org/wiki/Elliptic-curve_cryptography) or
+      L(EdDSA,https://en.wikipedia.org/wiki/EdDSA) private keys.
+    - Keys are generated in PEM format.
+    - "Please note that the module regenerates private keys if they don't match
+      the module's options. In particular, if you provide another passphrase
+      (or specify none), change the keysize, etc., the private key will be
+      regenerated. If you are concerned that this could B(overwrite your private key),
+      consider using the I(backup) option."
+    - "The module can use the cryptography Python library, or the pyOpenSSL Python
+      library. By default, it tries to detect which one is available. This can be
+      overridden with the I(select_crypto_backend) option. Please note that the
+      PyOpenSSL backend was deprecated in Ansible 2.9 and will be removed in community.crypto 2.0.0."
+requirements:
+    - Either cryptography >= 1.2.3 (older versions might work as well)
+    - Or pyOpenSSL
+options:
+    size:
+        description:
+            - Size (in bits) of the TLS/SSL key to generate.
+        type: int
+        default: 4096
+    type:
+        description:
+            - The algorithm used to generate the TLS/SSL private key.
+            - Note that C(ECC), C(X25519), C(X448), C(Ed25519) and C(Ed448) require the C(cryptography) backend.
+              C(X25519) needs cryptography 2.5 or newer, while C(X448), C(Ed25519) and C(Ed448) require
+              cryptography 2.6 or newer. For C(ECC), the minimal cryptography version required depends on the
+              I(curve) option.
+        type: str
+        default: RSA
+        choices: [ DSA, ECC, Ed25519, Ed448, RSA, X25519, X448 ]
+    curve:
+        description:
+            - Note that not all curves are supported by all versions of C(cryptography).
+            - For maximal interoperability, C(secp384r1) or C(secp256r1) should be used.
+            - We use the curve names as defined in the
+              L(IANA registry for TLS,https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8).
+            - Please note that all curves except C(secp224r1), C(secp256k1), C(secp256r1), C(secp384r1) and C(secp521r1)
+              are discouraged for new private keys.
+        type: str
+        choices:
+            - secp224r1
+            - secp256k1
+            - secp256r1
+            - secp384r1
+            - secp521r1
+            - secp192r1
+            - brainpoolP256r1
+            - brainpoolP384r1
+            - brainpoolP512r1
+            - sect163k1
+            - sect163r2
+            - sect233k1
+            - sect233r1
+            - sect283k1
+            - sect283r1
+            - sect409k1
+            - sect409r1
+            - sect571k1
+            - sect571r1
+    passphrase:
+        description:
+            - The passphrase for the private key.
+        type: str
+    cipher:
+        description:
+            - The cipher to encrypt the private key. (Valid values can be found by
+              running `openssl list -cipher-algorithms` or `openssl list-cipher-algorithms`,
+              depending on your OpenSSL version.)
+            - When using the C(cryptography) backend, use C(auto).
+        type: str
+    select_crypto_backend:
+        description:
+            - Determines which crypto backend to use.
+            - The default choice is C(auto), which tries to use C(cryptography) if available, and falls back to C(pyopenssl).
+            - If set to C(pyopenssl), will try to use the L(pyOpenSSL,https://pypi.org/project/pyOpenSSL/) library.
+            - If set to C(cryptography), will try to use the L(cryptography,https://cryptography.io/) library.
+            - Please note that the C(pyopenssl) backend has been deprecated in Ansible 2.9, and will be removed in community.crypto 2.0.0.
+              From that point on, only the C(cryptography) backend will be available.
+        type: str
+        default: auto
+        choices: [ auto, cryptography, pyopenssl ]
+    format:
+        description:
+            - Determines which format the private key is written in. By default, PKCS1 (traditional OpenSSL format)
+              is used for all keys which support it. Please note that not every key can be exported in any format.
+            - The value C(auto) selects a fromat based on the key format. The value C(auto_ignore) does the same,
+              but for existing private key files, it will not force a regenerate when its format is not the automatically
+              selected one for generation.
+            - Note that if the format for an existing private key mismatches, the key is B(regenerated) by default.
+              To change this behavior, use the I(format_mismatch) option.
+            - The I(format) option is only supported by the C(cryptography) backend. The C(pyopenssl) backend will
+              fail if a value different from C(auto_ignore) is used.
+        type: str
+        default: auto_ignore
+        choices: [ pkcs1, pkcs8, raw, auto, auto_ignore ]
+    format_mismatch:
+        description:
+            - Determines behavior of the module if the format of a private key does not match the expected format, but all
+              other parameters are as expected.
+            - If set to C(regenerate) (default), generates a new private key.
+            - If set to C(convert), the key will be converted to the new format instead.
+            - Only supported by the C(cryptography) backend.
+        type: str
+        default: regenerate
+        choices: [ regenerate, convert ]
+    regenerate:
+        description:
+            - Allows to configure in which situations the module is allowed to regenerate private keys.
+              The module will always generate a new key if the destination file does not exist.
+            - By default, the key will be regenerated when it doesn't match the module's options,
+              except when the key cannot be read or the passphrase does not match. Please note that
+              this B(changed) for Ansible 2.10. For Ansible 2.9, the behavior was as if C(full_idempotence)
+              is specified.
+            - If set to C(never), the module will fail if the key cannot be read or the passphrase
+              isn't matching, and will never regenerate an existing key.
+            - If set to C(fail), the module will fail if the key does not correspond to the module's
+              options.
+            - If set to C(partial_idempotence), the key will be regenerated if it does not conform to
+              the module's options. The key is B(not) regenerated if it cannot be read (broken file),
+              the key is protected by an unknown passphrase, or when they key is not protected by a
+              passphrase, but a passphrase is specified.
+            - If set to C(full_idempotence), the key will be regenerated if it does not conform to the
+              module's options. This is also the case if the key cannot be read (broken file), the key
+              is protected by an unknown passphrase, or when they key is not protected by a passphrase,
+              but a passphrase is specified. Make sure you have a B(backup) when using this option!
+            - If set to C(always), the module will always regenerate the key. This is equivalent to
+              setting I(force) to C(yes).
+            - Note that if I(format_mismatch) is set to C(convert) and everything matches except the
+              format, the key will always be converted, except if I(regenerate) is set to C(always).
+        type: str
+        choices:
+            - never
+            - fail
+            - partial_idempotence
+            - full_idempotence
+            - always
+        default: full_idempotence
+seealso:
+- module: community.crypto.x509_certificate
+- module: community.crypto.x509_certificate_pipe
+- module: community.crypto.openssl_csr
+- module: community.crypto.openssl_csr_pipe
+- module: community.crypto.openssl_dhparam
+- module: community.crypto.openssl_pkcs12
+- module: community.crypto.openssl_publickey
+'''

plugins/module_utils/acme/__init__.py

@@ -0,0 +1,90 @@
+# -*- coding: utf-8 -*-
+
+# Copyright: (c) 2016 Michael Gruener <michael.gruener@chaosmoon.net>
+# Copyright: (c) 2021 Felix Fontein <felix@fontein.de>
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+
+from __future__ import absolute_import, division, print_function
+__metaclass__ = type
+
+
+import base64
+import binascii
+import copy
+import datetime
+import hashlib
+import json
+import locale
+import os
+import re
+import shutil
+import sys
+import tempfile
+import traceback
+
+from ansible.module_utils.basic import missing_required_lib
+from ansible.module_utils.urls import fetch_url
+from ansible.module_utils.six.moves.urllib.parse import unquote
+from ansible.module_utils._text import to_native, to_text, to_bytes
+
+from ansible_collections.community.crypto.plugins.module_utils.acme.acme import (
+    get_default_argspec,
+    ACMEDirectory,
+)
+
+from ansible_collections.community.crypto.plugins.module_utils.acme.backend_cryptography import (
+    CryptographyBackend,
+    CRYPTOGRAPHY_VERSION,
+)
+
+from ansible_collections.community.crypto.plugins.module_utils.acme.backend_openssl_cli import (
+    OpenSSLCLIBackend,
+)
+
+from ansible_collections.community.crypto.plugins.module_utils.acme._compatibility import (
+    handle_standard_module_arguments,
+    set_crypto_backend,
+    HAS_CURRENT_CRYPTOGRAPHY,
+)
+
+from ansible_collections.community.crypto.plugins.module_utils.acme._compatibility import ACMELegacyAccount as ACMEAccount
+
+from ansible_collections.community.crypto.plugins.module_utils.acme.errors import ModuleFailException
+
+from ansible_collections.community.crypto.plugins.module_utils.acme.io import (
+    read_file,
+    write_file,
+)
+
+from ansible_collections.community.crypto.plugins.module_utils.acme.utils import (
+    nopad_b64,
+    pem_to_der,
+    process_links,
+)
+
+
+def openssl_get_csr_identifiers(openssl_binary, module, csr_filename, csr_content=None):
+    module.deprecate(
+        'Please adjust your custom module/plugin to the ACME module_utils refactor '
+        '(https://github.com/ansible-collections/community.crypto/pull/184). The '
+        'compatibility layer will be removed in community.crypto 2.0.0, thus breaking '
+        'your code', version='2.0.0', collection_name='community.crypto')
+    return OpenSSLCLIBackend(module, openssl_binary=openssl_binary).get_csr_identifiers(csr_filename=csr_filename, csr_content=csr_content)
+
+
+def cryptography_get_csr_identifiers(module, csr_filename, csr_content=None):
+    module.deprecate(
+        'Please adjust your custom module/plugin to the ACME module_utils refactor '
+        '(https://github.com/ansible-collections/community.crypto/pull/184). The '
+        'compatibility layer will be removed in community.crypto 2.0.0, thus breaking '
+        'your code', version='2.0.0', collection_name='community.crypto')
+    return CryptographyBackend(module).get_csr_identifiers(csr_filename=csr_filename, csr_content=csr_content)
+
+
+def cryptography_get_cert_days(module, cert_file, now=None):
+    module.deprecate(
+        'Please adjust your custom module/plugin to the ACME module_utils refactor '
+        '(https://github.com/ansible-collections/community.crypto/pull/184). The '
+        'compatibility layer will be removed in community.crypto 2.0.0, thus breaking '
+        'your code', version='2.0.0', collection_name='community.crypto')
+    return CryptographyBackend(module).get_cert_days(cert_filename=cert_file, now=now)

plugins/module_utils/acme/_compatibility.py

@@ -0,0 +1,267 @@
+# -*- coding: utf-8 -*-
+
+# Copyright: (c) 2016 Michael Gruener <michael.gruener@chaosmoon.net>
+# Copyright: (c) 2021 Felix Fontein <felix@fontein.de>
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+
+from __future__ import absolute_import, division, print_function
+__metaclass__ = type
+
+
+import locale
+
+from ansible.module_utils.basic import missing_required_lib
+
+from ansible_collections.community.crypto.plugins.module_utils.acme.backend_cryptography import HAS_CURRENT_CRYPTOGRAPHY as _ORIGINAL_HAS_CURRENT_CRYPTOGRAPHY
+
+from ansible_collections.community.crypto.plugins.module_utils.acme.backend_cryptography import (
+    CryptographyBackend,
+    CRYPTOGRAPHY_VERSION,
+)
+
+from ansible_collections.community.crypto.plugins.module_utils.acme.backend_openssl_cli import (
+    OpenSSLCLIBackend,
+)
+
+from ansible_collections.community.crypto.plugins.module_utils.acme.acme import (
+    ACMEClient,
+)
+
+from ansible_collections.community.crypto.plugins.module_utils.acme.account import (
+    ACMEAccount,
+)
+
+from ansible_collections.community.crypto.plugins.module_utils.acme.challenges import (
+    create_key_authorization,
+)
+
+from ansible_collections.community.crypto.plugins.module_utils.acme.errors import (
+    KeyParsingError,
+)
+
+
+HAS_CURRENT_CRYPTOGRAPHY = _ORIGINAL_HAS_CURRENT_CRYPTOGRAPHY
+
+
+def set_crypto_backend(module):
+    '''
+    Sets which crypto backend to use (default: auto detection).
+
+    Does not care whether a new enough cryptoraphy is available or not. Must
+    be called before any real stuff is done which might evaluate
+    ``HAS_CURRENT_CRYPTOGRAPHY``.
+    '''
+    global HAS_CURRENT_CRYPTOGRAPHY
+
+    module.deprecate(
+        'Please adjust your custom module/plugin to the ACME module_utils refactor '
+        '(https://github.com/ansible-collections/community.crypto/pull/184). The '
+        'compatibility layer will be removed in community.crypto 2.0.0, thus breaking '
+        'your code', version='2.0.0', collection_name='community.crypto')
+
+    # Choose backend
+    backend = module.params['select_crypto_backend']
+    if backend == 'auto':
+        pass
+    elif backend == 'openssl':
+        HAS_CURRENT_CRYPTOGRAPHY = False
+    elif backend == 'cryptography':
+        if not _ORIGINAL_HAS_CURRENT_CRYPTOGRAPHY:
+            module.fail_json(msg=missing_required_lib('cryptography'))
+        HAS_CURRENT_CRYPTOGRAPHY = True
+    else:
+        module.fail_json(msg='Unknown crypto backend "{0}"!'.format(backend))
+    # Inform about choices
+    if HAS_CURRENT_CRYPTOGRAPHY:
+        module.debug('Using cryptography backend (library version {0})'.format(CRYPTOGRAPHY_VERSION))
+        return 'cryptography'
+    else:
+        module.debug('Using OpenSSL binary backend')
+        return 'openssl'
+
+
+def handle_standard_module_arguments(module, needs_acme_v2=False):
+    '''
+    Do standard module setup, argument handling and warning emitting.
+    '''
+    backend = set_crypto_backend(module)
+
+    if not module.params['validate_certs']:
+        module.warn(
+            'Disabling certificate validation for communications with ACME endpoint. '
+            'This should only be done for testing against a local ACME server for '
+            'development purposes, but *never* for production purposes.'
+        )
+
+    if module.params['acme_version'] is None:
+        module.params['acme_version'] = 1
+        module.deprecate("The option 'acme_version' will be required from community.crypto 2.0.0 on",
+                         version='2.0.0', collection_name='community.crypto')
+
+    if module.params['acme_directory'] is None:
+        module.params['acme_directory'] = 'https://acme-staging.api.letsencrypt.org/directory'
+        module.deprecate("The option 'acme_directory' will be required from community.crypto 2.0.0 on",
+                         version='2.0.0', collection_name='community.crypto')
+
+    if needs_acme_v2 and module.params['acme_version'] < 2:
+        module.fail_json(msg='The {0} module requires the ACME v2 protocol!'.format(module._name))
+
+    # AnsibleModule() changes the locale, so change it back to C because we rely on time.strptime() when parsing certificate dates.
+    module.run_command_environ_update = dict(LANG='C', LC_ALL='C', LC_MESSAGES='C', LC_CTYPE='C')
+    locale.setlocale(locale.LC_ALL, 'C')
+
+    return backend
+
+
+def get_compatibility_backend(module):
+    if HAS_CURRENT_CRYPTOGRAPHY:
+        return CryptographyBackend(module)
+    else:
+        return OpenSSLCLIBackend(module)
+
+
+class ACMELegacyAccount(object):
+    '''
+    ACME account object. Handles the authorized communication with the
+    ACME server. Provides access to account bound information like
+    the currently active authorizations and valid certificates
+    '''
+
+    def __init__(self, module):
+        module.deprecate(
+            'Please adjust your custom module/plugin to the ACME module_utils refactor '
+            '(https://github.com/ansible-collections/community.crypto/pull/184). The '
+            'compatibility layer will be removed in community.crypto 2.0.0, thus breaking '
+            'your code', version='2.0.0', collection_name='community.crypto')
+        backend = get_compatibility_backend(module)
+        self.client = ACMEClient(module, backend)
+        self.account = ACMEAccount(self.client)
+        self.key = self.client.account_key_file
+        self.key_content = self.client.account_key_content
+        self.uri = self.client.account_uri
+        self.key_data = self.client.account_key_data
+        self.jwk = self.client.account_jwk
+        self.jws_header = self.client.account_jws_header
+        self.directory = self.client.directory
+
+    def get_keyauthorization(self, token):
+        '''
+        Returns the key authorization for the given token
+        https://tools.ietf.org/html/rfc8555#section-8.1
+        '''
+        return create_key_authorization(self.client, token)
+
+    def parse_key(self, key_file=None, key_content=None):
+        '''
+        Parses an RSA or Elliptic Curve key file in PEM format and returns a pair
+        (error, key_data).
+        '''
+        try:
+            return None, self.client.parse_key(key_file=key_file, key_content=key_content)
+        except KeyParsingError as e:
+            return e.msg, {}
+
+    def sign_request(self, protected, payload, key_data, encode_payload=True):
+        return self.client.sign_request(protected, payload, key_data, encode_payload=encode_payload)
+
+    def send_signed_request(self, url, payload, key_data=None, jws_header=None, parse_json_result=True, encode_payload=True):
+        '''
+        Sends a JWS signed HTTP POST request to the ACME server and returns
+        the response as dictionary
+        https://tools.ietf.org/html/rfc8555#section-6.2
+
+        If payload is None, a POST-as-GET is performed.
+        (https://tools.ietf.org/html/rfc8555#section-6.3)
+        '''
+        return self.client.send_signed_request(
+            url,
+            payload,
+            key_data=key_data,
+            jws_header=jws_header,
+            parse_json_result=parse_json_result,
+            encode_payload=encode_payload,
+            fail_on_error=False,
+        )
+
+    def get_request(self, uri, parse_json_result=True, headers=None, get_only=False, fail_on_error=True):
+        '''
+        Perform a GET-like request. Will try POST-as-GET for ACMEv2, with fallback
+        to GET if server replies with a status code of 405.
+        '''
+        return self.client.get_request(
+            uri,
+            parse_json_result=parse_json_result,
+            headers=headers,
+            get_only=get_only,
+            fail_on_error=fail_on_error,
+        )
+
+    def set_account_uri(self, uri):
+        '''
+        Set account URI. For ACME v2, it needs to be used to sending signed
+        requests.
+        '''
+        self.client.set_account_uri(uri)
+        self.uri = self.client.account_uri
+
+    def get_account_data(self):
+        '''
+        Retrieve account information. Can only be called when the account
+        URI is already known (such as after calling setup_account).
+        Return None if the account was deactivated, or a dict otherwise.
+        '''
+        return self.account.get_account_data()
+
+    def setup_account(self, contact=None, agreement=None, terms_agreed=False,
+                      allow_creation=True, remove_account_uri_if_not_exists=False,
+                      external_account_binding=None):
+        '''
+        Detect or create an account on the ACME server. For ACME v1,
+        as the only way (without knowing an account URI) to test if an
+        account exists is to try and create one with the provided account
+        key, this method will always result in an account being present
+        (except on error situations). For ACME v2, a new account will
+        only be created if ``allow_creation`` is set to True.
+
+        For ACME v2, ``check_mode`` is fully respected. For ACME v1, the
+        account might be created if it does not yet exist.
+
+        Return a pair ``(created, account_data)``. Here, ``created`` will
+        be ``True`` in case the account was created or would be created
+        (check mode). ``account_data`` will be the current account data,
+        or ``None`` if the account does not exist.
+
+        The account URI will be stored in ``self.uri``; if it is ``None``,
+        the account does not exist.
+
+        If specified, ``external_account_binding`` should be a dictionary
+        with keys ``kid``, ``alg`` and ``key``
+        (https://tools.ietf.org/html/rfc8555#section-7.3.4).
+
+        https://tools.ietf.org/html/rfc8555#section-7.3
+        '''
+        result = self.account.setup_account(
+            contact=contact,
+            agreement=agreement,
+            terms_agreed=terms_agreed,
+            allow_creation=allow_creation,
+            remove_account_uri_if_not_exists=remove_account_uri_if_not_exists,
+            external_account_binding=external_account_binding,
+        )
+        self.uri = self.client.account_uri
+        return result
+
+    def update_account(self, account_data, contact=None):
+        '''
+        Update an account on the ACME server. Check mode is fully respected.
+
+        The current account data must be provided as ``account_data``.
+
+        Return a pair ``(updated, account_data)``, where ``updated`` is
+        ``True`` in case something changed (contact info updated) or
+        would be changed (check mode), and ``account_data`` the updated
+        account data.
+
+        https://tools.ietf.org/html/rfc8555#section-7.3.2
+        '''
+        return self.account.update_account(account_data, contact=contact)

plugins/module_utils/acme/account.py

@@ -0,0 +1,251 @@
+# -*- coding: utf-8 -*-
+
+# Copyright: (c) 2016 Michael Gruener <michael.gruener@chaosmoon.net>
+# Copyright: (c) 2021 Felix Fontein <felix@fontein.de>
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+
+from __future__ import absolute_import, division, print_function
+__metaclass__ = type
+
+
+from ansible_collections.community.crypto.plugins.module_utils.acme.errors import (
+    ACMEProtocolException,
+    ModuleFailException,
+)
+
+
+class ACMEAccount(object):
+    '''
+    ACME account object. Allows to create new accounts, check for existence of accounts,
+    retrieve account data.
+    '''
+
+    def __init__(self, client):
+        # Set to true to enable logging of all signed requests
+        self._debug = False
+
+        self.client = client
+
+    def _new_reg(self, contact=None, agreement=None, terms_agreed=False, allow_creation=True,
+                 external_account_binding=None):
+        '''
+        Registers a new ACME account. Returns a pair ``(created, data)``.
+        Here, ``created`` is ``True`` if the account was created and
+        ``False`` if it already existed (e.g. it was not newly created),
+        or does not exist. In case the account was created or exists,
+        ``data`` contains the account data; otherwise, it is ``None``.
+
+        If specified, ``external_account_binding`` should be a dictionary
+        with keys ``kid``, ``alg`` and ``key``
+        (https://tools.ietf.org/html/rfc8555#section-7.3.4).
+
+        https://tools.ietf.org/html/rfc8555#section-7.3
+        '''
+        contact = contact or []
+
+        if self.client.version == 1:
+            new_reg = {
+                'resource': 'new-reg',
+                'contact': contact
+            }
+            if agreement:
+                new_reg['agreement'] = agreement
+            else:
+                new_reg['agreement'] = self.client.directory['meta']['terms-of-service']
+            if external_account_binding is not None:
+                raise ModuleFailException('External account binding is not supported for ACME v1')
+            url = self.client.directory['new-reg']
+        else:
+            if (external_account_binding is not None or self.client.directory['meta'].get('externalAccountRequired')) and allow_creation:
+                # Some ACME servers such as ZeroSSL do not like it when you try to register an existing account
+                # and provide external_account_binding credentials. Thus we first send a request with allow_creation=False
+                # to see whether the account already exists.
+
+                # Note that we pass contact here: ZeroSSL does not accept regisration calls without contacts, even
+                # if onlyReturnExisting is set to true.
+                created, data = self._new_reg(contact=contact, allow_creation=False)
+                if data:
+                    # An account already exists! Return data
+                    return created, data
+                # An account does not yet exist. Try to create one next.
+
+            new_reg = {
+                'contact': contact
+            }
+            if not allow_creation:
+                # https://tools.ietf.org/html/rfc8555#section-7.3.1
+                new_reg['onlyReturnExisting'] = True
+            if terms_agreed:
+                new_reg['termsOfServiceAgreed'] = True
+            url = self.client.directory['newAccount']
+            if external_account_binding is not None:
+                new_reg['externalAccountBinding'] = self.client.sign_request(
+                    {
+                        'alg': external_account_binding['alg'],
+                        'kid': external_account_binding['kid'],
+                        'url': url,
+                    },
+                    self.client.account_jwk,
+                    self.client.backend.create_mac_key(external_account_binding['alg'], external_account_binding['key'])
+                )
+            elif self.client.directory['meta'].get('externalAccountRequired') and allow_creation:
+                raise ModuleFailException(
+                    'To create an account, an external account binding must be specified. '
+                    'Use the acme_account module with the external_account_binding option.'
+                )
+
+        result, info = self.client.send_signed_request(url, new_reg, fail_on_error=False)
+
+        if info['status'] in ([200, 201] if self.client.version == 1 else [201]):
+            # Account did not exist
+            if 'location' in info:
+                self.client.set_account_uri(info['location'])
+            return True, result
+        elif info['status'] == (409 if self.client.version == 1 else 200):
+            # Account did exist
+            if result.get('status') == 'deactivated':
+                # A bug in Pebble (https://github.com/letsencrypt/pebble/issues/179) and
+                # Boulder (https://github.com/letsencrypt/boulder/issues/3971): this should
+                # not return a valid account object according to
+                # https://tools.ietf.org/html/rfc8555#section-7.3.6:
+                #     "Once an account is deactivated, the server MUST NOT accept further
+                #      requests authorized by that account's key."
+                if not allow_creation:
+                    return False, None
+                else:
+                    raise ModuleFailException("Account is deactivated")
+            if 'location' in info:
+                self.client.set_account_uri(info['location'])
+            return False, result
+        elif info['status'] == 400 and result['type'] == 'urn:ietf:params:acme:error:accountDoesNotExist' and not allow_creation:
+            # Account does not exist (and we didn't try to create it)
+            return False, None
+        elif info['status'] == 403 and result['type'] == 'urn:ietf:params:acme:error:unauthorized' and 'deactivated' in (result.get('detail') or ''):
+            # Account has been deactivated; currently works for Pebble; hasn't been
+            # implemented for Boulder (https://github.com/letsencrypt/boulder/issues/3971),
+            # might need adjustment in error detection.
+            if not allow_creation:
+                return False, None
+            else:
+                raise ModuleFailException("Account is deactivated")
+        else:
+            raise ACMEProtocolException(
+                self.client.module, msg='Registering ACME account failed', info=info, content_json=result)
+
+    def get_account_data(self):
+        '''
+        Retrieve account information. Can only be called when the account
+        URI is already known (such as after calling setup_account).
+        Return None if the account was deactivated, or a dict otherwise.
+        '''
+        if self.client.account_uri is None:
+            raise ModuleFailException("Account URI unknown")
+        if self.client.version == 1:
+            data = {}
+            data['resource'] = 'reg'
+            result, info = self.client.send_signed_request(self.client.account_uri, data, fail_on_error=False)
+        else:
+            # try POST-as-GET first (draft-15 or newer)
+            data = None
+            result, info = self.client.send_signed_request(self.client.account_uri, data, fail_on_error=False)
+            # check whether that failed with a malformed request error
+            if info['status'] >= 400 and result.get('type') == 'urn:ietf:params:acme:error:malformed':
+                # retry as a regular POST (with no changed data) for pre-draft-15 ACME servers
+                data = {}
+                result, info = self.client.send_signed_request(self.client.account_uri, data, fail_on_error=False)
+        if info['status'] in (400, 403) and result.get('type') == 'urn:ietf:params:acme:error:unauthorized':
+            # Returned when account is deactivated
+            return None
+        if info['status'] in (400, 404) and result.get('type') == 'urn:ietf:params:acme:error:accountDoesNotExist':
+            # Returned when account does not exist
+            return None
+        if info['status'] < 200 or info['status'] >= 300:
+            raise ACMEProtocolException(
+                self.client.module, msg='Error retrieving account data', info=info, content_json=result)
+        return result
+
+    def setup_account(self, contact=None, agreement=None, terms_agreed=False,
+                      allow_creation=True, remove_account_uri_if_not_exists=False,
+                      external_account_binding=None):
+        '''
+        Detect or create an account on the ACME server. For ACME v1,
+        as the only way (without knowing an account URI) to test if an
+        account exists is to try and create one with the provided account
+        key, this method will always result in an account being present
+        (except on error situations). For ACME v2, a new account will
+        only be created if ``allow_creation`` is set to True.
+
+        For ACME v2, ``check_mode`` is fully respected. For ACME v1, the
+        account might be created if it does not yet exist.
+
+        Return a pair ``(created, account_data)``. Here, ``created`` will
+        be ``True`` in case the account was created or would be created
+        (check mode). ``account_data`` will be the current account data,
+        or ``None`` if the account does not exist.
+
+        The account URI will be stored in ``client.account_uri``; if it is ``None``,
+        the account does not exist.
+
+        If specified, ``external_account_binding`` should be a dictionary
+        with keys ``kid``, ``alg`` and ``key``
+        (https://tools.ietf.org/html/rfc8555#section-7.3.4).
+
+        https://tools.ietf.org/html/rfc8555#section-7.3
+        '''
+
+        if self.client.account_uri is not None:
+            created = False
+            # Verify that the account key belongs to the URI.
+            # (If update_contact is True, this will be done below.)
+            account_data = self.get_account_data()
+            if account_data is None:
+                if remove_account_uri_if_not_exists and not allow_creation:
+                    self.client.account_uri = None
+                else:
+                    raise ModuleFailException("Account is deactivated or does not exist!")
+        else:
+            created, account_data = self._new_reg(
+                contact,
+                agreement=agreement,
+                terms_agreed=terms_agreed,
+                allow_creation=allow_creation and not self.client.module.check_mode,
+                external_account_binding=external_account_binding,
+            )
+            if self.client.module.check_mode and self.client.account_uri is None and allow_creation:
+                created = True
+                account_data = {
+                    'contact': contact or []
+                }
+        return created, account_data
+
+    def update_account(self, account_data, contact=None):
+        '''
+        Update an account on the ACME server. Check mode is fully respected.
+
+        The current account data must be provided as ``account_data``.
+
+        Return a pair ``(updated, account_data)``, where ``updated`` is
+        ``True`` in case something changed (contact info updated) or
+        would be changed (check mode), and ``account_data`` the updated
+        account data.
+
+        https://tools.ietf.org/html/rfc8555#section-7.3.2
+        '''
+        # Create request
+        update_request = {}
+        if contact is not None and account_data.get('contact', []) != contact:
+            update_request['contact'] = list(contact)
+
+        # No change?
+        if not update_request:
+            return False, dict(account_data)
+
+        # Apply change
+        if self.client.module.check_mode:
+            account_data = dict(account_data)
+            account_data.update(update_request)
+        else:
+            if self.client.version == 1:
+                update_request['resource'] = 'reg'
+            account_data, dummy = self.client.send_signed_request(self.client.account_uri, update_request)
+        return True, account_data

plugins/module_utils/acme/acme.py

@@ -0,0 +1,370 @@
+# -*- coding: utf-8 -*-
+
+# Copyright: (c) 2016 Michael Gruener <michael.gruener@chaosmoon.net>
+# Copyright: (c) 2021 Felix Fontein <felix@fontein.de>
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+
+from __future__ import absolute_import, division, print_function
+__metaclass__ = type
+
+
+import copy
+import datetime
+import json
+import locale
+
+from ansible.module_utils.basic import missing_required_lib
+from ansible.module_utils.urls import fetch_url
+from ansible.module_utils._text import to_bytes
+
+from ansible_collections.community.crypto.plugins.module_utils.acme.backend_openssl_cli import (
+    OpenSSLCLIBackend,
+)
+
+from ansible_collections.community.crypto.plugins.module_utils.acme.backend_cryptography import (
+    CryptographyBackend,
+    CRYPTOGRAPHY_VERSION,
+    HAS_CURRENT_CRYPTOGRAPHY,
+)
+
+from ansible_collections.community.crypto.plugins.module_utils.acme.errors import (
+    ACMEProtocolException,
+    NetworkException,
+    ModuleFailException,
+    KeyParsingError,
+)
+
+from ansible_collections.community.crypto.plugins.module_utils.acme.utils import (
+    nopad_b64,
+)
+
+
+def _assert_fetch_url_success(module, response, info, allow_redirect=False, allow_client_error=True, allow_server_error=True):
+    if info['status'] < 0:
+        raise NetworkException(msg="Failure downloading %s, %s" % (info['url'], info['msg']))
+
+    if (300 <= info['status'] < 400 and not allow_redirect) or \
+       (400 <= info['status'] < 500 and not allow_client_error) or \
+       (info['status'] >= 500 and not allow_server_error):
+        raise ACMEProtocolException(module, info=info, response=response)
+
+
+def _is_failed(info, expected_status_codes=None):
+    if info['status'] < 200 or info['status'] >= 400:
+        return True
+    if expected_status_codes is not None and info['status'] not in expected_status_codes:
+        return True
+    return False
+
+
+class ACMEDirectory(object):
+    '''
+    The ACME server directory. Gives access to the available resources,
+    and allows to obtain a Replay-Nonce. The acme_directory URL
+    needs to support unauthenticated GET requests; ACME endpoints
+    requiring authentication are not supported.
+    https://tools.ietf.org/html/rfc8555#section-7.1.1
+    '''
+
+    def __init__(self, module, account):
+        self.module = module
+        self.directory_root = module.params['acme_directory']
+        self.version = module.params['acme_version']
+
+        self.directory, dummy = account.get_request(self.directory_root, get_only=True)
+
+        # Check whether self.version matches what we expect
+        if self.version == 1:
+            for key in ('new-reg', 'new-authz', 'new-cert'):
+                if key not in self.directory:
+                    raise ModuleFailException("ACME directory does not seem to follow protocol ACME v1")
+        if self.version == 2:
+            for key in ('newNonce', 'newAccount', 'newOrder'):
+                if key not in self.directory:
+                    raise ModuleFailException("ACME directory does not seem to follow protocol ACME v2")
+
+    def __getitem__(self, key):
+        return self.directory[key]
+
+    def get_nonce(self, resource=None):
+        url = self.directory_root if self.version == 1 else self.directory['newNonce']
+        if resource is not None:
+            url = resource
+        dummy, info = fetch_url(self.module, url, method='HEAD')
+        if info['status'] not in (200, 204):
+            raise NetworkException("Failed to get replay-nonce, got status {0}".format(info['status']))
+        return info['replay-nonce']
+
+
+class ACMEClient(object):
+    '''
+    ACME client object. Handles the authorized communication with the
+    ACME server.
+    '''
+
+    def __init__(self, module, backend):
+        # Set to true to enable logging of all signed requests
+        self._debug = False
+
+        self.module = module
+        self.backend = backend
+        self.version = module.params['acme_version']
+        # account_key path and content are mutually exclusive
+        self.account_key_file = module.params['account_key_src']
+        self.account_key_content = module.params['account_key_content']
+        self.account_key_passphrase = module.params['account_key_passphrase']
+
+        # Grab account URI from module parameters.
+        # Make sure empty string is treated as None.
+        self.account_uri = module.params.get('account_uri') or None
+
+        self.account_key_data = None
+        self.account_jwk = None
+        self.account_jws_header = None
+        if self.account_key_file is not None or self.account_key_content is not None:
+            try:
+                self.account_key_data = self.parse_key(
+                    key_file=self.account_key_file,
+                    key_content=self.account_key_content,
+                    passphrase=self.account_key_passphrase)
+            except KeyParsingError as e:
+                raise ModuleFailException("Error while parsing account key: {msg}".format(msg=e.msg))
+            self.account_jwk = self.account_key_data['jwk']
+            self.account_jws_header = {
+                "alg": self.account_key_data['alg'],
+                "jwk": self.account_jwk,
+            }
+            if self.account_uri:
+                # Make sure self.account_jws_header is updated
+                self.set_account_uri(self.account_uri)
+
+        self.directory = ACMEDirectory(module, self)
+
+    def set_account_uri(self, uri):
+        '''
+        Set account URI. For ACME v2, it needs to be used to sending signed
+        requests.
+        '''
+        self.account_uri = uri
+        if self.version != 1:
+            self.account_jws_header.pop('jwk')
+            self.account_jws_header['kid'] = self.account_uri
+
+    def parse_key(self, key_file=None, key_content=None, passphrase=None):
+        '''
+        Parses an RSA or Elliptic Curve key file in PEM format and returns key_data.
+        In case of an error, raises KeyParsingError.
+        '''
+        if key_file is None and key_content is None:
+            raise AssertionError('One of key_file and key_content must be specified!')
+        return self.backend.parse_key(key_file, key_content, passphrase=passphrase)
+
+    def sign_request(self, protected, payload, key_data, encode_payload=True):
+        '''
+        Signs an ACME request.
+        '''
+        try:
+            if payload is None:
+                # POST-as-GET
+                payload64 = ''
+            else:
+                # POST
+                if encode_payload:
+                    payload = self.module.jsonify(payload).encode('utf8')
+                payload64 = nopad_b64(to_bytes(payload))
+            protected64 = nopad_b64(self.module.jsonify(protected).encode('utf8'))
+        except Exception as e:
+            raise ModuleFailException("Failed to encode payload / headers as JSON: {0}".format(e))
+
+        return self.backend.sign(payload64, protected64, key_data)
+
+    def _log(self, msg, data=None):
+        '''
+        Write arguments to acme.log when logging is enabled.
+        '''
+        if self._debug:
+            with open('acme.log', 'ab') as f:
+                f.write('[{0}] {1}\n'.format(datetime.datetime.now().strftime('%Y-%m-%d %H:%M:%S.%s'), msg).encode('utf-8'))
+                if data is not None:
+                    f.write('{0}\n\n'.format(json.dumps(data, indent=2, sort_keys=True)).encode('utf-8'))
+
+    def send_signed_request(self, url, payload, key_data=None, jws_header=None, parse_json_result=True,
+                            encode_payload=True, fail_on_error=True, error_msg=None, expected_status_codes=None):
+        '''
+        Sends a JWS signed HTTP POST request to the ACME server and returns
+        the response as dictionary (if parse_json_result is True) or in raw form
+        (if parse_json_result is False).
+        https://tools.ietf.org/html/rfc8555#section-6.2
+
+        If payload is None, a POST-as-GET is performed.
+        (https://tools.ietf.org/html/rfc8555#section-6.3)
+        '''
+        key_data = key_data or self.account_key_data
+        jws_header = jws_header or self.account_jws_header
+        failed_tries = 0
+        while True:
+            protected = copy.deepcopy(jws_header)
+            protected["nonce"] = self.directory.get_nonce()
+            if self.version != 1:
+                protected["url"] = url
+
+            self._log('URL', url)
+            self._log('protected', protected)
+            self._log('payload', payload)
+            data = self.sign_request(protected, payload, key_data, encode_payload=encode_payload)
+            if self.version == 1:
+                data["header"] = jws_header.copy()
+                for k, v in protected.items():
+                    dummy = data["header"].pop(k, None)
+            self._log('signed request', data)
+            data = self.module.jsonify(data)
+
+            headers = {
+                'Content-Type': 'application/jose+json',
+            }
+            resp, info = fetch_url(self.module, url, data=data, headers=headers, method='POST')
+            _assert_fetch_url_success(self.module, resp, info)
+            result = {}
+            try:
+                content = resp.read()
+            except AttributeError:
+                content = info.pop('body', None)
+
+            if content or not parse_json_result:
+                if (parse_json_result and info['content-type'].startswith('application/json')) or 400 <= info['status'] < 600:
+                    try:
+                        decoded_result = self.module.from_json(content.decode('utf8'))
+                        self._log('parsed result', decoded_result)
+                        # In case of badNonce error, try again (up to 5 times)
+                        # (https://tools.ietf.org/html/rfc8555#section-6.7)
+                        if all((
+                            400 <= info['status'] < 600,
+                            decoded_result.get('type') == 'urn:ietf:params:acme:error:badNonce',
+                            failed_tries <= 5,
+                        )):
+                            failed_tries += 1
+                            continue
+                        if parse_json_result:
+                            result = decoded_result
+                        else:
+                            result = content
+                    except ValueError:
+                        raise NetworkException("Failed to parse the ACME response: {0} {1}".format(url, content))
+                else:
+                    result = content
+
+            if fail_on_error and _is_failed(info, expected_status_codes=expected_status_codes):
+                raise ACMEProtocolException(
+                    self.module, msg=error_msg, info=info, content=content, content_json=result if parse_json_result else None)
+            return result, info
+
+    def get_request(self, uri, parse_json_result=True, headers=None, get_only=False,
+                    fail_on_error=True, error_msg=None, expected_status_codes=None):
+        '''
+        Perform a GET-like request. Will try POST-as-GET for ACMEv2, with fallback
+        to GET if server replies with a status code of 405.
+        '''
+        if not get_only and self.version != 1:
+            # Try POST-as-GET
+            content, info = self.send_signed_request(uri, None, parse_json_result=False, fail_on_error=False)
+            if info['status'] == 405:
+                # Instead, do unauthenticated GET
+                get_only = True
+        else:
+            # Do unauthenticated GET
+            get_only = True
+
+        if get_only:
+            # Perform unauthenticated GET
+            resp, info = fetch_url(self.module, uri, method='GET', headers=headers)
+
+            _assert_fetch_url_success(self.module, resp, info)
+
+            try:
+                content = resp.read()
+            except AttributeError:
+                content = info.pop('body', None)
+
+        # Process result
+        parsed_json_result = False
+        if parse_json_result:
+            result = {}
+            if content:
+                if info['content-type'].startswith('application/json'):
+                    try:
+                        result = self.module.from_json(content.decode('utf8'))
+                        parsed_json_result = True
+                    except ValueError:
+                        raise NetworkException("Failed to parse the ACME response: {0} {1}".format(uri, content))
+                else:
+                    result = content
+        else:
+            result = content
+
+        if fail_on_error and _is_failed(info, expected_status_codes=expected_status_codes):
+            raise ACMEProtocolException(
+                self.module, msg=error_msg, info=info, content=content, content_json=result if parsed_json_result else None)
+        return result, info
+
+
+def get_default_argspec():
+    '''
+    Provides default argument spec for the options documented in the acme doc fragment.
+    '''
+    return dict(
+        account_key_src=dict(type='path', aliases=['account_key']),
+        account_key_content=dict(type='str', no_log=True),
+        account_key_passphrase=dict(type='str', no_log=True),
+        account_uri=dict(type='str'),
+        acme_directory=dict(type='str'),
+        acme_version=dict(type='int', choices=[1, 2]),
+        validate_certs=dict(type='bool', default=True),
+        select_crypto_backend=dict(type='str', default='auto', choices=['auto', 'openssl', 'cryptography']),
+    )
+
+
+def create_backend(module, needs_acme_v2):
+    backend = module.params['select_crypto_backend']
+
+    # Backend autodetect
+    if backend == 'auto':
+        backend = 'cryptography' if HAS_CURRENT_CRYPTOGRAPHY else 'openssl'
+
+    # Create backend object
+    if backend == 'cryptography':
+        if not HAS_CURRENT_CRYPTOGRAPHY:
+            module.fail_json(msg=missing_required_lib('cryptography'))
+        module.debug('Using cryptography backend (library version {0})'.format(CRYPTOGRAPHY_VERSION))
+        module_backend = CryptographyBackend(module)
+    elif backend == 'openssl':
+        module.debug('Using OpenSSL binary backend')
+        module_backend = OpenSSLCLIBackend(module)
+    else:
+        module.fail_json(msg='Unknown crypto backend "{0}"!'.format(backend))
+
+    # Check common module parameters
+    if not module.params['validate_certs']:
+        module.warn(
+            'Disabling certificate validation for communications with ACME endpoint. '
+            'This should only be done for testing against a local ACME server for '
+            'development purposes, but *never* for production purposes.'
+        )
+
+    if module.params['acme_version'] is None:
+        module.params['acme_version'] = 1
+        module.deprecate("The option 'acme_version' will be required from community.crypto 2.0.0 on",
+                         version='2.0.0', collection_name='community.crypto')
+
+    if module.params['acme_directory'] is None:
+        module.params['acme_directory'] = 'https://acme-staging.api.letsencrypt.org/directory'
+        module.deprecate("The option 'acme_directory' will be required from community.crypto 2.0.0 on",
+                         version='2.0.0', collection_name='community.crypto')
+
+    if needs_acme_v2 and module.params['acme_version'] < 2:
+        module.fail_json(msg='The {0} module requires the ACME v2 protocol!'.format(module._name))
+
+    # AnsibleModule() changes the locale, so change it back to C because we rely
+    # on datetime.datetime.strptime() when parsing certificate dates.
+    locale.setlocale(locale.LC_ALL, 'C')
+
+    return module_backend

plugins/module_utils/acme/backend_cryptography.py

@@ -0,0 +1,375 @@
+# -*- coding: utf-8 -*-
+
+# Copyright: (c) 2016 Michael Gruener <michael.gruener@chaosmoon.net>
+# Copyright: (c) 2021 Felix Fontein <felix@fontein.de>
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+
+from __future__ import absolute_import, division, print_function
+__metaclass__ = type
+
+
+import base64
+import binascii
+import datetime
+import os
+import sys
+
+from ansible.module_utils._text import to_bytes, to_native
+
+from ansible_collections.community.crypto.plugins.module_utils.acme.backends import (
+    CryptoBackend,
+)
+
+from ansible_collections.community.crypto.plugins.module_utils.acme.certificates import (
+    ChainMatcher,
+)
+
+from ansible_collections.community.crypto.plugins.module_utils.acme.errors import (
+    BackendException,
+    KeyParsingError,
+)
+
+from ansible_collections.community.crypto.plugins.module_utils.acme.io import read_file
+
+from ansible_collections.community.crypto.plugins.module_utils.acme.utils import nopad_b64
+
+from ansible_collections.community.crypto.plugins.module_utils.crypto.support import (
+    parse_name_field,
+)
+
+from ansible_collections.community.crypto.plugins.module_utils.crypto.cryptography_support import (
+    cryptography_name_to_oid,
+)
+
+try:
+    import cryptography
+    import cryptography.hazmat.backends
+    import cryptography.hazmat.primitives.hashes
+    import cryptography.hazmat.primitives.hmac
+    import cryptography.hazmat.primitives.asymmetric.ec
+    import cryptography.hazmat.primitives.asymmetric.padding
+    import cryptography.hazmat.primitives.asymmetric.rsa
+    import cryptography.hazmat.primitives.asymmetric.utils
+    import cryptography.hazmat.primitives.serialization
+    import cryptography.x509
+    import cryptography.x509.oid
+    from distutils.version import LooseVersion
+    CRYPTOGRAPHY_VERSION = cryptography.__version__
+    HAS_CURRENT_CRYPTOGRAPHY = (LooseVersion(CRYPTOGRAPHY_VERSION) >= LooseVersion('1.5'))
+    if HAS_CURRENT_CRYPTOGRAPHY:
+        _cryptography_backend = cryptography.hazmat.backends.default_backend()
+except Exception as dummy:
+    HAS_CURRENT_CRYPTOGRAPHY = False
+    CRYPTOGRAPHY_VERSION = None
+
+
+if sys.version_info[0] >= 3:
+    # Python 3 (and newer)
+    def _count_bytes(n):
+        return (n.bit_length() + 7) // 8 if n > 0 else 0
+
+    def _convert_int_to_bytes(count, no):
+        return no.to_bytes(count, byteorder='big')
+
+    def _pad_hex(n, digits):
+        res = hex(n)[2:]
+        if len(res) < digits:
+            res = '0' * (digits - len(res)) + res
+        return res
+else:
+    # Python 2
+    def _count_bytes(n):
+        if n <= 0:
+            return 0
+        h = '%x' % n
+        return (len(h) + 1) // 2
+
+    def _convert_int_to_bytes(count, n):
+        h = '%x' % n
+        if len(h) > 2 * count:
+            raise Exception('Number {1} needs more than {0} bytes!'.format(count, n))
+        return ('0' * (2 * count - len(h)) + h).decode('hex')
+
+    def _pad_hex(n, digits):
+        h = '%x' % n
+        if len(h) < digits:
+            h = '0' * (digits - len(h)) + h
+        return h
+
+
+class CryptographyChainMatcher(ChainMatcher):
+    @staticmethod
+    def _parse_key_identifier(key_identifier, name, criterium_idx, module):
+        if key_identifier:
+            try:
+                return binascii.unhexlify(key_identifier.replace(':', ''))
+            except Exception:
+                if criterium_idx is None:
+                    module.warn('Criterium has invalid {0} value. Ignoring criterium.'.format(name))
+                else:
+                    module.warn('Criterium {0} in select_chain has invalid {1} value. '
+                                'Ignoring criterium.'.format(criterium_idx, name))
+        return None
+
+    def __init__(self, criterium, module):
+        self.criterium = criterium
+        self.test_certificates = criterium.test_certificates
+        self.subject = []
+        self.issuer = []
+        if criterium.subject:
+            self.subject = [
+                (cryptography_name_to_oid(k), to_native(v)) for k, v in parse_name_field(criterium.subject)
+            ]
+        if criterium.issuer:
+            self.issuer = [
+                (cryptography_name_to_oid(k), to_native(v)) for k, v in parse_name_field(criterium.issuer)
+            ]
+        self.subject_key_identifier = CryptographyChainMatcher._parse_key_identifier(
+            criterium.subject_key_identifier, 'subject_key_identifier', criterium.index, module)
+        self.authority_key_identifier = CryptographyChainMatcher._parse_key_identifier(
+            criterium.authority_key_identifier, 'authority_key_identifier', criterium.index, module)
+
+    def _match_subject(self, x509_subject, match_subject):
+        for oid, value in match_subject:
+            found = False
+            for attribute in x509_subject:
+                if attribute.oid == oid and value == to_native(attribute.value):
+                    found = True
+                    break
+            if not found:
+                return False
+        return True
+
+    def match(self, certificate):
+        '''
+        Check whether an alternate chain matches the specified criterium.
+        '''
+        chain = certificate.chain
+        if self.test_certificates == 'last':
+            chain = chain[-1:]
+        elif self.test_certificates == 'first':
+            chain = chain[:1]
+        for cert in chain:
+            try:
+                x509 = cryptography.x509.load_pem_x509_certificate(to_bytes(cert), cryptography.hazmat.backends.default_backend())
+                matches = True
+                if not self._match_subject(x509.subject, self.subject):
+                    matches = False
+                if not self._match_subject(x509.issuer, self.issuer):
+                    matches = False
+                if self.subject_key_identifier:
+                    try:
+                        ext = x509.extensions.get_extension_for_class(cryptography.x509.SubjectKeyIdentifier)
+                        if self.subject_key_identifier != ext.value.digest:
+                            matches = False
+                    except cryptography.x509.ExtensionNotFound:
+                        matches = False
+                if self.authority_key_identifier:
+                    try:
+                        ext = x509.extensions.get_extension_for_class(cryptography.x509.AuthorityKeyIdentifier)
+                        if self.authority_key_identifier != ext.value.key_identifier:
+                            matches = False
+                    except cryptography.x509.ExtensionNotFound:
+                        matches = False
+                if matches:
+                    return True
+            except Exception as e:
+                self.module.warn('Error while loading certificate {0}: {1}'.format(cert, e))
+        return False
+
+
+class CryptographyBackend(CryptoBackend):
+    def __init__(self, module):
+        super(CryptographyBackend, self).__init__(module)
+
+    def parse_key(self, key_file=None, key_content=None, passphrase=None):
+        '''
+        Parses an RSA or Elliptic Curve key file in PEM format and returns key_data.
+        Raises KeyParsingError in case of errors.
+        '''
+        # If key_content isn't given, read key_file
+        if key_content is None:
+            key_content = read_file(key_file)
+        else:
+            key_content = to_bytes(key_content)
+        # Parse key
+        try:
+            key = cryptography.hazmat.primitives.serialization.load_pem_private_key(
+                key_content,
+                password=to_bytes(passphrase) if passphrase is not None else None,
+                backend=_cryptography_backend)
+        except Exception as e:
+            raise KeyParsingError('error while loading key: {0}'.format(e))
+        if isinstance(key, cryptography.hazmat.primitives.asymmetric.rsa.RSAPrivateKey):
+            pk = key.public_key().public_numbers()
+            return {
+                'key_obj': key,
+                'type': 'rsa',
+                'alg': 'RS256',
+                'jwk': {
+                    "kty": "RSA",
+                    "e": nopad_b64(_convert_int_to_bytes(_count_bytes(pk.e), pk.e)),
+                    "n": nopad_b64(_convert_int_to_bytes(_count_bytes(pk.n), pk.n)),
+                },
+                'hash': 'sha256',
+            }
+        elif isinstance(key, cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePrivateKey):
+            pk = key.public_key().public_numbers()
+            if pk.curve.name == 'secp256r1':
+                bits = 256
+                alg = 'ES256'
+                hashalg = 'sha256'
+                point_size = 32
+                curve = 'P-256'
+            elif pk.curve.name == 'secp384r1':
+                bits = 384
+                alg = 'ES384'
+                hashalg = 'sha384'
+                point_size = 48
+                curve = 'P-384'
+            elif pk.curve.name == 'secp521r1':
+                # Not yet supported on Let's Encrypt side, see
+                # https://github.com/letsencrypt/boulder/issues/2217
+                bits = 521
+                alg = 'ES512'
+                hashalg = 'sha512'
+                point_size = 66
+                curve = 'P-521'
+            else:
+                raise KeyParsingError('unknown elliptic curve: {0}'.format(pk.curve.name))
+            num_bytes = (bits + 7) // 8
+            return {
+                'key_obj': key,
+                'type': 'ec',
+                'alg': alg,
+                'jwk': {
+                    "kty": "EC",
+                    "crv": curve,
+                    "x": nopad_b64(_convert_int_to_bytes(num_bytes, pk.x)),
+                    "y": nopad_b64(_convert_int_to_bytes(num_bytes, pk.y)),
+                },
+                'hash': hashalg,
+                'point_size': point_size,
+            }
+        else:
+            raise KeyParsingError('unknown key type "{0}"'.format(type(key)))
+
+    def sign(self, payload64, protected64, key_data):
+        sign_payload = "{0}.{1}".format(protected64, payload64).encode('utf8')
+        if 'mac_obj' in key_data:
+            mac = key_data['mac_obj']()
+            mac.update(sign_payload)
+            signature = mac.finalize()
+        elif isinstance(key_data['key_obj'], cryptography.hazmat.primitives.asymmetric.rsa.RSAPrivateKey):
+            padding = cryptography.hazmat.primitives.asymmetric.padding.PKCS1v15()
+            hashalg = cryptography.hazmat.primitives.hashes.SHA256
+            signature = key_data['key_obj'].sign(sign_payload, padding, hashalg())
+        elif isinstance(key_data['key_obj'], cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePrivateKey):
+            if key_data['hash'] == 'sha256':
+                hashalg = cryptography.hazmat.primitives.hashes.SHA256
+            elif key_data['hash'] == 'sha384':
+                hashalg = cryptography.hazmat.primitives.hashes.SHA384
+            elif key_data['hash'] == 'sha512':
+                hashalg = cryptography.hazmat.primitives.hashes.SHA512
+            ecdsa = cryptography.hazmat.primitives.asymmetric.ec.ECDSA(hashalg())
+            r, s = cryptography.hazmat.primitives.asymmetric.utils.decode_dss_signature(key_data['key_obj'].sign(sign_payload, ecdsa))
+            rr = _pad_hex(r, 2 * key_data['point_size'])
+            ss = _pad_hex(s, 2 * key_data['point_size'])
+            signature = binascii.unhexlify(rr) + binascii.unhexlify(ss)
+
+        return {
+            "protected": protected64,
+            "payload": payload64,
+            "signature": nopad_b64(signature),
+        }
+
+    def create_mac_key(self, alg, key):
+        '''Create a MAC key.'''
+        if alg == 'HS256':
+            hashalg = cryptography.hazmat.primitives.hashes.SHA256
+            hashbytes = 32
+        elif alg == 'HS384':
+            hashalg = cryptography.hazmat.primitives.hashes.SHA384
+            hashbytes = 48
+        elif alg == 'HS512':
+            hashalg = cryptography.hazmat.primitives.hashes.SHA512
+            hashbytes = 64
+        else:
+            raise BackendException('Unsupported MAC key algorithm for cryptography backend: {0}'.format(alg))
+        key_bytes = base64.urlsafe_b64decode(key)
+        if len(key_bytes) < hashbytes:
+            raise BackendException(
+                '{0} key must be at least {1} bytes long (after Base64 decoding)'.format(alg, hashbytes))
+        return {
+            'mac_obj': lambda: cryptography.hazmat.primitives.hmac.HMAC(
+                key_bytes,
+                hashalg(),
+                _cryptography_backend),
+            'type': 'hmac',
+            'alg': alg,
+            'jwk': {
+                'kty': 'oct',
+                'k': key,
+            },
+        }
+
+    def get_csr_identifiers(self, csr_filename=None, csr_content=None):
+        '''
+        Return a set of requested identifiers (CN and SANs) for the CSR.
+        Each identifier is a pair (type, identifier), where type is either
+        'dns' or 'ip'.
+        '''
+        identifiers = set([])
+        if csr_content is None:
+            csr_content = read_file(csr_filename)
+        else:
+            csr_content = to_bytes(csr_content)
+        csr = cryptography.x509.load_pem_x509_csr(csr_content, _cryptography_backend)
+        for sub in csr.subject:
+            if sub.oid == cryptography.x509.oid.NameOID.COMMON_NAME:
+                identifiers.add(('dns', sub.value))
+        for extension in csr.extensions:
+            if extension.oid == cryptography.x509.oid.ExtensionOID.SUBJECT_ALTERNATIVE_NAME:
+                for name in extension.value:
+                    if isinstance(name, cryptography.x509.DNSName):
+                        identifiers.add(('dns', name.value))
+                    elif isinstance(name, cryptography.x509.IPAddress):
+                        identifiers.add(('ip', name.value.compressed))
+                    else:
+                        raise BackendException('Found unsupported SAN identifier {0}'.format(name))
+        return identifiers
+
+    def get_cert_days(self, cert_filename=None, cert_content=None, now=None):
+        '''
+        Return the days the certificate in cert_filename remains valid and -1
+        if the file was not found. If cert_filename contains more than one
+        certificate, only the first one will be considered.
+
+        If now is not specified, datetime.datetime.now() is used.
+        '''
+        if cert_filename is not None:
+            cert_content = None
+            if os.path.exists(cert_filename):
+                cert_content = read_file(cert_filename)
+        else:
+            cert_content = to_bytes(cert_content)
+
+        if cert_content is None:
+            return -1
+
+        try:
+            cert = cryptography.x509.load_pem_x509_certificate(cert_content, _cryptography_backend)
+        except Exception as e:
+            if cert_filename is None:
+                raise BackendException('Cannot parse certificate: {0}'.format(e))
+            raise BackendException('Cannot parse certificate {0}: {1}'.format(cert_filename, e))
+
+        if now is None:
+            now = datetime.datetime.now()
+        return (cert.not_valid_after - now).days
+
+    def create_chain_matcher(self, criterium):
+        '''
+        Given a Criterium object, creates a ChainMatcher object.
+        '''
+        return CryptographyChainMatcher(criterium, self.module)

plugins/module_utils/acme/backend_openssl_cli.py

@@ -0,0 +1,298 @@
+# -*- coding: utf-8 -*-
+
+# Copyright: (c) 2016 Michael Gruener <michael.gruener@chaosmoon.net>
+# Copyright: (c) 2021 Felix Fontein <felix@fontein.de>
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+
+from __future__ import absolute_import, division, print_function
+__metaclass__ = type
+
+
+import base64
+import binascii
+import datetime
+import os
+import re
+import tempfile
+import traceback
+
+from ansible.module_utils._text import to_native, to_text, to_bytes
+
+from ansible_collections.community.crypto.plugins.module_utils.acme.backends import (
+    CryptoBackend,
+)
+
+from ansible_collections.community.crypto.plugins.module_utils.acme.errors import (
+    BackendException,
+    KeyParsingError,
+)
+
+from ansible_collections.community.crypto.plugins.module_utils.acme.utils import nopad_b64
+
+from ansible_collections.community.crypto.plugins.module_utils.compat import ipaddress as compat_ipaddress
+
+
+_OPENSSL_ENVIRONMENT_UPDATE = dict(LANG='C', LC_ALL='C', LC_MESSAGES='C', LC_CTYPE='C')
+
+
+class OpenSSLCLIBackend(CryptoBackend):
+    def __init__(self, module, openssl_binary=None):
+        super(OpenSSLCLIBackend, self).__init__(module)
+        if openssl_binary is None:
+            openssl_binary = module.get_bin_path('openssl', True)
+        self.openssl_binary = openssl_binary
+
+    def parse_key(self, key_file=None, key_content=None, passphrase=None):
+        '''
+        Parses an RSA or Elliptic Curve key file in PEM format and returns key_data.
+        Raises KeyParsingError in case of errors.
+        '''
+        if passphrase is not None:
+            raise KeyParsingError('openssl backend does not support key passphrases')
+        # If key_file isn't given, but key_content, write that to a temporary file
+        if key_file is None:
+            fd, tmpsrc = tempfile.mkstemp()
+            self.module.add_cleanup_file(tmpsrc)  # Ansible will delete the file on exit
+            f = os.fdopen(fd, 'wb')
+            try:
+                f.write(key_content.encode('utf-8'))
+                key_file = tmpsrc
+            except Exception as err:
+                try:
+                    f.close()
+                except Exception as dummy:
+                    pass
+                raise KeyParsingError("failed to create temporary content file: %s" % to_native(err), exception=traceback.format_exc())
+            f.close()
+        # Parse key
+        account_key_type = None
+        with open(key_file, "rt") as f:
+            for line in f:
+                m = re.match(r"^\s*-{5,}BEGIN\s+(EC|RSA)\s+PRIVATE\s+KEY-{5,}\s*$", line)
+                if m is not None:
+                    account_key_type = m.group(1).lower()
+                    break
+        if account_key_type is None:
+            # This happens for example if openssl_privatekey created this key
+            # (as opposed to the OpenSSL binary). For now, we assume this is
+            # an RSA key.
+            # FIXME: add some kind of auto-detection
+            account_key_type = "rsa"
+        if account_key_type not in ("rsa", "ec"):
+            raise KeyParsingError('unknown key type "%s"' % account_key_type)
+
+        openssl_keydump_cmd = [self.openssl_binary, account_key_type, "-in", key_file, "-noout", "-text"]
+        dummy, out, dummy = self.module.run_command(
+            openssl_keydump_cmd, check_rc=True, environ_update=_OPENSSL_ENVIRONMENT_UPDATE)
+
+        if account_key_type == 'rsa':
+            pub_hex, pub_exp = re.search(
+                r"modulus:\n\s+00:([a-f0-9\:\s]+?)\npublicExponent: ([0-9]+)",
+                to_text(out, errors='surrogate_or_strict'), re.MULTILINE | re.DOTALL).groups()
+            pub_exp = "{0:x}".format(int(pub_exp))
+            if len(pub_exp) % 2:
+                pub_exp = "0{0}".format(pub_exp)
+
+            return {
+                'key_file': key_file,
+                'type': 'rsa',
+                'alg': 'RS256',
+                'jwk': {
+                    "kty": "RSA",
+                    "e": nopad_b64(binascii.unhexlify(pub_exp.encode("utf-8"))),
+                    "n": nopad_b64(binascii.unhexlify(re.sub(r"(\s|:)", "", pub_hex).encode("utf-8"))),
+                },
+                'hash': 'sha256',
+            }
+        elif account_key_type == 'ec':
+            pub_data = re.search(
+                r"pub:\s*\n\s+04:([a-f0-9\:\s]+?)\nASN1 OID: (\S+)(?:\nNIST CURVE: (\S+))?",
+                to_text(out, errors='surrogate_or_strict'), re.MULTILINE | re.DOTALL)
+            if pub_data is None:
+                raise KeyParsingError('cannot parse elliptic curve key')
+            pub_hex = binascii.unhexlify(re.sub(r"(\s|:)", "", pub_data.group(1)).encode("utf-8"))
+            asn1_oid_curve = pub_data.group(2).lower()
+            nist_curve = pub_data.group(3).lower() if pub_data.group(3) else None
+            if asn1_oid_curve == 'prime256v1' or nist_curve == 'p-256':
+                bits = 256
+                alg = 'ES256'
+                hashalg = 'sha256'
+                point_size = 32
+                curve = 'P-256'
+            elif asn1_oid_curve == 'secp384r1' or nist_curve == 'p-384':
+                bits = 384
+                alg = 'ES384'
+                hashalg = 'sha384'
+                point_size = 48
+                curve = 'P-384'
+            elif asn1_oid_curve == 'secp521r1' or nist_curve == 'p-521':
+                # Not yet supported on Let's Encrypt side, see
+                # https://github.com/letsencrypt/boulder/issues/2217
+                bits = 521
+                alg = 'ES512'
+                hashalg = 'sha512'
+                point_size = 66
+                curve = 'P-521'
+            else:
+                raise KeyParsingError('unknown elliptic curve: %s / %s' % (asn1_oid_curve, nist_curve))
+            num_bytes = (bits + 7) // 8
+            if len(pub_hex) != 2 * num_bytes:
+                raise KeyParsingError('bad elliptic curve point (%s / %s)' % (asn1_oid_curve, nist_curve))
+            return {
+                'key_file': key_file,
+                'type': 'ec',
+                'alg': alg,
+                'jwk': {
+                    "kty": "EC",
+                    "crv": curve,
+                    "x": nopad_b64(pub_hex[:num_bytes]),
+                    "y": nopad_b64(pub_hex[num_bytes:]),
+                },
+                'hash': hashalg,
+                'point_size': point_size,
+            }
+
+    def sign(self, payload64, protected64, key_data):
+        sign_payload = "{0}.{1}".format(protected64, payload64).encode('utf8')
+        if key_data['type'] == 'hmac':
+            hex_key = to_native(binascii.hexlify(base64.urlsafe_b64decode(key_data['jwk']['k'])))
+            cmd_postfix = ["-mac", "hmac", "-macopt", "hexkey:{0}".format(hex_key), "-binary"]
+        else:
+            cmd_postfix = ["-sign", key_data['key_file']]
+        openssl_sign_cmd = [self.openssl_binary, "dgst", "-{0}".format(key_data['hash'])] + cmd_postfix
+
+        dummy, out, dummy = self.module.run_command(
+            openssl_sign_cmd, data=sign_payload, check_rc=True, binary_data=True, environ_update=_OPENSSL_ENVIRONMENT_UPDATE)
+
+        if key_data['type'] == 'ec':
+            dummy, der_out, dummy = self.module.run_command(
+                [self.openssl_binary, "asn1parse", "-inform", "DER"],
+                data=out, binary_data=True, environ_update=_OPENSSL_ENVIRONMENT_UPDATE)
+            expected_len = 2 * key_data['point_size']
+            sig = re.findall(
+                r"prim:\s+INTEGER\s+:([0-9A-F]{1,%s})\n" % expected_len,
+                to_text(der_out, errors='surrogate_or_strict'))
+            if len(sig) != 2:
+                raise BackendException(
+                    "failed to generate Elliptic Curve signature; cannot parse DER output: {0}".format(
+                        to_text(der_out, errors='surrogate_or_strict')))
+            sig[0] = (expected_len - len(sig[0])) * '0' + sig[0]
+            sig[1] = (expected_len - len(sig[1])) * '0' + sig[1]
+            out = binascii.unhexlify(sig[0]) + binascii.unhexlify(sig[1])
+
+        return {
+            "protected": protected64,
+            "payload": payload64,
+            "signature": nopad_b64(to_bytes(out)),
+        }
+
+    def create_mac_key(self, alg, key):
+        '''Create a MAC key.'''
+        if alg == 'HS256':
+            hashalg = 'sha256'
+            hashbytes = 32
+        elif alg == 'HS384':
+            hashalg = 'sha384'
+            hashbytes = 48
+        elif alg == 'HS512':
+            hashalg = 'sha512'
+            hashbytes = 64
+        else:
+            raise BackendException('Unsupported MAC key algorithm for OpenSSL backend: {0}'.format(alg))
+        key_bytes = base64.urlsafe_b64decode(key)
+        if len(key_bytes) < hashbytes:
+            raise BackendException(
+                '{0} key must be at least {1} bytes long (after Base64 decoding)'.format(alg, hashbytes))
+        return {
+            'type': 'hmac',
+            'alg': alg,
+            'jwk': {
+                'kty': 'oct',
+                'k': key,
+            },
+            'hash': hashalg,
+        }
+
+    @staticmethod
+    def _normalize_ip(ip):
+        try:
+            return to_native(compat_ipaddress.ip_address(to_text(ip)).compressed)
+        except ValueError:
+            # We don't want to error out on something IPAddress() can't parse
+            return ip
+
+    def get_csr_identifiers(self, csr_filename=None, csr_content=None):
+        '''
+        Return a set of requested identifiers (CN and SANs) for the CSR.
+        Each identifier is a pair (type, identifier), where type is either
+        'dns' or 'ip'.
+        '''
+        filename = csr_filename
+        data = None
+        if csr_content is not None:
+            filename = '-'
+            data = csr_content.encode('utf-8')
+
+        openssl_csr_cmd = [self.openssl_binary, "req", "-in", filename, "-noout", "-text"]
+        dummy, out, dummy = self.module.run_command(
+            openssl_csr_cmd, data=data, check_rc=True, binary_data=True, environ_update=_OPENSSL_ENVIRONMENT_UPDATE)
+
+        identifiers = set([])
+        common_name = re.search(r"Subject:.* CN\s?=\s?([^\s,;/]+)", to_text(out, errors='surrogate_or_strict'))
+        if common_name is not None:
+            identifiers.add(('dns', common_name.group(1)))
+        subject_alt_names = re.search(
+            r"X509v3 Subject Alternative Name: (?:critical)?\n +([^\n]+)\n",
+            to_text(out, errors='surrogate_or_strict'), re.MULTILINE | re.DOTALL)
+        if subject_alt_names is not None:
+            for san in subject_alt_names.group(1).split(", "):
+                if san.lower().startswith("dns:"):
+                    identifiers.add(('dns', san[4:]))
+                elif san.lower().startswith("ip:"):
+                    identifiers.add(('ip', self._normalize_ip(san[3:])))
+                elif san.lower().startswith("ip address:"):
+                    identifiers.add(('ip', self._normalize_ip(san[11:])))
+                else:
+                    raise BackendException('Found unsupported SAN identifier "{0}"'.format(san))
+        return identifiers
+
+    def get_cert_days(self, cert_filename=None, cert_content=None, now=None):
+        '''
+        Return the days the certificate in cert_filename remains valid and -1
+        if the file was not found. If cert_filename contains more than one
+        certificate, only the first one will be considered.
+
+        If now is not specified, datetime.datetime.now() is used.
+        '''
+        filename = cert_filename
+        data = None
+        if cert_content is not None:
+            filename = '-'
+            data = cert_content.encode('utf-8')
+            cert_filename_suffix = ''
+        elif cert_filename is not None:
+            if not os.path.exists(cert_filename):
+                return -1
+            cert_filename_suffix = ' in {0}'.format(cert_filename)
+        else:
+            return -1
+
+        openssl_cert_cmd = [self.openssl_binary, "x509", "-in", filename, "-noout", "-text"]
+        dummy, out, dummy = self.module.run_command(
+            openssl_cert_cmd, data=data, check_rc=True, binary_data=True, environ_update=_OPENSSL_ENVIRONMENT_UPDATE)
+        try:
+            not_after_str = re.search(r"\s+Not After\s*:\s+(.*)", to_text(out, errors='surrogate_or_strict')).group(1)
+            not_after = datetime.datetime.strptime(not_after_str, '%b %d %H:%M:%S %Y %Z')
+        except AttributeError:
+            raise BackendException("No 'Not after' date found{0}".format(cert_filename_suffix))
+        except ValueError:
+            raise BackendException("Failed to parse 'Not after' date{0}".format(cert_filename_suffix))
+        if now is None:
+            now = datetime.datetime.now()
+        return (not_after - now).days
+
+    def create_chain_matcher(self, criterium):
+        '''
+        Given a Criterium object, creates a ChainMatcher object.
+        '''
+        raise BackendException('Alternate chain matching can only be used with the "cryptography" backend.')

plugins/module_utils/acme/backends.py

@@ -0,0 +1,58 @@
+# -*- coding: utf-8 -*-
+
+# Copyright: (c) 2016 Michael Gruener <michael.gruener@chaosmoon.net>
+# Copyright: (c) 2021 Felix Fontein <felix@fontein.de>
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+
+from __future__ import absolute_import, division, print_function
+__metaclass__ = type
+
+
+import abc
+
+from ansible.module_utils import six
+
+
+@six.add_metaclass(abc.ABCMeta)
+class CryptoBackend(object):
+    def __init__(self, module):
+        self.module = module
+
+    @abc.abstractmethod
+    def parse_key(self, key_file=None, key_content=None, passphrase=None):
+        '''
+        Parses an RSA or Elliptic Curve key file in PEM format and returns key_data.
+        Raises KeyParsingError in case of errors.
+        '''
+
+    @abc.abstractmethod
+    def sign(self, payload64, protected64, key_data):
+        pass
+
+    @abc.abstractmethod
+    def create_mac_key(self, alg, key):
+        '''Create a MAC key.'''
+
+    @abc.abstractmethod
+    def get_csr_identifiers(self, csr_filename=None, csr_content=None):
+        '''
+        Return a set of requested identifiers (CN and SANs) for the CSR.
+        Each identifier is a pair (type, identifier), where type is either
+        'dns' or 'ip'.
+        '''
+
+    @abc.abstractmethod
+    def get_cert_days(self, cert_filename=None, cert_content=None, now=None):
+        '''
+        Return the days the certificate in cert_filename remains valid and -1
+        if the file was not found. If cert_filename contains more than one
+        certificate, only the first one will be considered.
+
+        If now is not specified, datetime.datetime.now() is used.
+        '''
+
+    @abc.abstractmethod
+    def create_chain_matcher(self, criterium):
+        '''
+        Given a Criterium object, creates a ChainMatcher object.
+        '''

plugins/module_utils/acme/certificates.py

@@ -0,0 +1,128 @@
+# -*- coding: utf-8 -*-
+
+# Copyright: (c) 2016 Michael Gruener <michael.gruener@chaosmoon.net>
+# Copyright: (c) 2021 Felix Fontein <felix@fontein.de>
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+
+from __future__ import absolute_import, division, print_function
+__metaclass__ = type
+
+
+import abc
+
+from ansible.module_utils import six
+
+from ansible_collections.community.crypto.plugins.module_utils.acme.errors import (
+    ModuleFailException,
+)
+
+from ansible_collections.community.crypto.plugins.module_utils.acme.utils import (
+    der_to_pem,
+    nopad_b64,
+    process_links,
+)
+
+from ansible_collections.community.crypto.plugins.module_utils.crypto.pem import (
+    split_pem_list,
+)
+
+
+class CertificateChain(object):
+    '''
+    Download and parse the certificate chain.
+    https://tools.ietf.org/html/rfc8555#section-7.4.2
+    '''
+
+    def __init__(self, url):
+        self.url = url
+        self.cert = None
+        self.chain = []
+        self.alternates = []
+
+    @classmethod
+    def download(cls, client, url):
+        content, info = client.get_request(url, parse_json_result=False, headers={'Accept': 'application/pem-certificate-chain'})
+
+        if not content or not info['content-type'].startswith('application/pem-certificate-chain'):
+            raise ModuleFailException(
+                "Cannot download certificate chain from {0}, as content type is not application/pem-certificate-chain: {1} (headers: {2})".format(
+                    url, content, info))
+
+        result = cls(url)
+
+        # Parse data
+        certs = split_pem_list(content.decode('utf-8'), keep_inbetween=True)
+        if certs:
+            result.cert = certs[0]
+            result.chain = certs[1:]
+
+        process_links(info, lambda link, relation: result._process_links(client, link, relation))
+
+        if result.cert is None:
+            raise ModuleFailException("Failed to parse certificate chain download from {0}: {1} (headers: {2})".format(url, content, info))
+
+        return result
+
+    def _process_links(self, client, link, relation):
+        if relation == 'up':
+            # Process link-up headers if there was no chain in reply
+            if not self.chain:
+                chain_result, chain_info = client.get_request(link, parse_json_result=False)
+                if chain_info['status'] in [200, 201]:
+                    self.chain.append(der_to_pem(chain_result))
+        elif relation == 'alternate':
+            self.alternates.append(link)
+
+    def to_json(self):
+        cert = self.cert.encode('utf8')
+        chain = ('\n'.join(self.chain)).encode('utf8')
+        return {
+            'cert': cert,
+            'chain': chain,
+            'full_chain': cert + chain,
+        }
+
+
+class Criterium(object):
+    def __init__(self, criterium, index=None):
+        self.index = index
+        self.test_certificates = criterium['test_certificates']
+        self.subject = criterium['subject']
+        self.issuer = criterium['issuer']
+        self.subject_key_identifier = criterium['subject_key_identifier']
+        self.authority_key_identifier = criterium['authority_key_identifier']
+
+
+@six.add_metaclass(abc.ABCMeta)
+class ChainMatcher(object):
+    @abc.abstractmethod
+    def match(self, certificate):
+        '''
+        Check whether a certificate chain (CertificateChain instance) matches.
+        '''
+
+
+def retrieve_acme_v1_certificate(client, csr_der):
+    '''
+    Create a new certificate based on the CSR (ACME v1 protocol).
+    Return the certificate object as dict
+    https://tools.ietf.org/html/draft-ietf-acme-acme-02#section-6.5
+    '''
+    new_cert = {
+        "resource": "new-cert",
+        "csr": nopad_b64(csr_der),
+    }
+    result, info = client.send_signed_request(
+        client.directory['new-cert'], new_cert, error_msg='Failed to receive certificate', expected_status_codes=[200, 201])
+    cert = CertificateChain(info['location'])
+    cert.cert = der_to_pem(result)
+
+    def f(link, relation):
+        if relation == 'up':
+            chain_result, chain_info = client.get_request(link, parse_json_result=False)
+            if chain_info['status'] in [200, 201]:
+                del cert.chain[:]
+                cert.chain.append(der_to_pem(chain_result))
+
+    process_links(info, f)
+    return cert

plugins/module_utils/acme/challenges.py

@@ -0,0 +1,299 @@
+# -*- coding: utf-8 -*-
+
+# Copyright: (c) 2016 Michael Gruener <michael.gruener@chaosmoon.net>
+# Copyright: (c) 2021 Felix Fontein <felix@fontein.de>
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+
+from __future__ import absolute_import, division, print_function
+__metaclass__ = type
+
+
+import base64
+import hashlib
+import json
+import re
+import time
+
+from ansible.module_utils._text import to_bytes
+
+from ansible_collections.community.crypto.plugins.module_utils.compat import ipaddress as compat_ipaddress
+
+from ansible_collections.community.crypto.plugins.module_utils.acme.utils import (
+    nopad_b64,
+)
+
+from ansible_collections.community.crypto.plugins.module_utils.acme.errors import (
+    format_error_problem,
+    ACMEProtocolException,
+    ModuleFailException,
+)
+
+
+def create_key_authorization(client, token):
+    '''
+    Returns the key authorization for the given token
+    https://tools.ietf.org/html/rfc8555#section-8.1
+    '''
+    accountkey_json = json.dumps(client.account_jwk, sort_keys=True, separators=(',', ':'))
+    thumbprint = nopad_b64(hashlib.sha256(accountkey_json.encode('utf8')).digest())
+    return "{0}.{1}".format(token, thumbprint)
+
+
+def combine_identifier(identifier_type, identifier):
+    return '{type}:{identifier}'.format(type=identifier_type, identifier=identifier)
+
+
+def split_identifier(identifier):
+    parts = identifier.split(':', 1)
+    if len(parts) != 2:
+        raise ModuleFailException(
+            'Identifier "{identifier}" is not of the form <type>:<identifier>'.format(identifier=identifier))
+    return parts
+
+
+class Challenge(object):
+    def __init__(self, data, url):
+        self.data = data
+
+        self.type = data['type']
+        self.url = url
+        self.status = data['status']
+        self.token = data.get('token')
+
+    @classmethod
+    def from_json(cls, client, data, url=None):
+        return cls(data, url or (data['uri'] if client.version == 1 else data['url']))
+
+    def call_validate(self, client):
+        challenge_response = {}
+        if client.version == 1:
+            token = re.sub(r"[^A-Za-z0-9_\-]", "_", self.token)
+            key_authorization = create_key_authorization(client, token)
+            challenge_response['resource'] = 'challenge'
+            challenge_response['keyAuthorization'] = key_authorization
+            challenge_response['type'] = self.type
+        client.send_signed_request(
+            self.url,
+            challenge_response,
+            error_msg='Failed to validate challenge',
+            expected_status_codes=[200, 202],
+        )
+
+    def to_json(self):
+        return self.data.copy()
+
+    def get_validation_data(self, client, identifier_type, identifier):
+        token = re.sub(r"[^A-Za-z0-9_\-]", "_", self.token)
+        key_authorization = create_key_authorization(client, token)
+
+        if self.type == 'http-01':
+            # https://tools.ietf.org/html/rfc8555#section-8.3
+            return {
+                'resource': '.well-known/acme-challenge/{token}'.format(token=token),
+                'resource_value': key_authorization,
+            }
+
+        if self.type == 'dns-01':
+            if identifier_type != 'dns':
+                return None
+            # https://tools.ietf.org/html/rfc8555#section-8.4
+            resource = '_acme-challenge'
+            value = nopad_b64(hashlib.sha256(to_bytes(key_authorization)).digest())
+            record = (resource + identifier[1:]) if identifier.startswith('*.') else '{0}.{1}'.format(resource, identifier)
+            return {
+                'resource': resource,
+                'resource_value': value,
+                'record': record,
+            }
+
+        if self.type == 'tls-alpn-01':
+            # https://www.rfc-editor.org/rfc/rfc8737.html#section-3
+            if identifier_type == 'ip':
+                # IPv4/IPv6 address: use reverse mapping (RFC1034, RFC3596)
+                resource = compat_ipaddress.ip_address(identifier).reverse_pointer
+                if not resource.endswith('.'):
+                    resource += '.'
+            else:
+                resource = identifier
+            value = base64.b64encode(hashlib.sha256(to_bytes(key_authorization)).digest())
+            return {
+                'resource': resource,
+                'resource_original': combine_identifier(identifier_type, identifier),
+                'resource_value': value,
+            }
+
+        # Unknown challenge type: ignore
+        return None
+
+
+class Authorization(object):
+    def _setup(self, client, data):
+        data['uri'] = self.url
+        self.data = data
+        self.challenges = [Challenge.from_json(client, challenge) for challenge in data['challenges']]
+        if client.version == 1 and 'status' not in data:
+            # https://tools.ietf.org/html/draft-ietf-acme-acme-02#section-6.1.2
+            # "status (required, string): ...
+            # If this field is missing, then the default value is "pending"."
+            self.status = 'pending'
+        else:
+            self.status = data['status']
+        self.identifier = data['identifier']['value']
+        self.identifier_type = data['identifier']['type']
+        if data.get('wildcard', False):
+            self.identifier = '*.{0}'.format(self.identifier)
+
+    def __init__(self, url):
+        self.url = url
+
+        self.data = None
+        self.challenges = []
+        self.status = None
+        self.identifier_type = None
+        self.identifier = None
+
+    @classmethod
+    def from_json(cls, client, data, url):
+        result = cls(url)
+        result._setup(client, data)
+        return result
+
+    @classmethod
+    def from_url(cls, client, url):
+        result = cls(url)
+        result.refresh(client)
+        return result
+
+    @classmethod
+    def create(cls, client, identifier_type, identifier):
+        '''
+        Create a new authorization for the given identifier.
+        Return the authorization object of the new authorization
+        https://tools.ietf.org/html/draft-ietf-acme-acme-02#section-6.4
+        '''
+        new_authz = {
+            "identifier": {
+                "type": identifier_type,
+                "value": identifier,
+            },
+        }
+        if client.version == 1:
+            url = client.directory['new-authz']
+            new_authz["resource"] = "new-authz"
+        else:
+            if 'newAuthz' not in client.directory.directory:
+                raise ACMEProtocolException(client.module, 'ACME endpoint does not support pre-authorization')
+            url = client.directory['newAuthz']
+
+        result, info = client.send_signed_request(
+            url, new_authz, error_msg='Failed to request challenges', expected_status_codes=[200, 201])
+        return cls.from_json(client, result, info['location'])
+
+    @property
+    def combined_identifier(self):
+        return combine_identifier(self.identifier_type, self.identifier)
+
+    def to_json(self):
+        return self.data.copy()
+
+    def refresh(self, client):
+        result, dummy = client.get_request(self.url)
+        changed = self.data != result
+        self._setup(client, result)
+        return changed
+
+    def get_challenge_data(self, client):
+        '''
+        Returns a dict with the data for all proposed (and supported) challenges
+        of the given authorization.
+        '''
+        data = {}
+        for challenge in self.challenges:
+            validation_data = challenge.get_validation_data(client, self.identifier_type, self.identifier)
+            if validation_data is not None:
+                data[challenge.type] = validation_data
+        return data
+
+    def raise_error(self, error_msg, module=None):
+        '''
+        Aborts with a specific error for a challenge.
+        '''
+        error_details = []
+        # multiple challenges could have failed at this point, gather error
+        # details for all of them before failing
+        for challenge in self.challenges:
+            if challenge.status == 'invalid':
+                msg = 'Challenge {type}'.format(type=challenge.type)
+                if 'error' in challenge.data:
+                    msg = '{msg}: {problem}'.format(
+                        msg=msg,
+                        problem=format_error_problem(challenge.data['error'], subproblem_prefix='{0}.'.format(challenge.type)),
+                    )
+                error_details.append(msg)
+        raise ACMEProtocolException(
+            module,
+            'Failed to validate challenge for {identifier}: {error}. {details}'.format(
+                identifier=self.combined_identifier,
+                error=error_msg,
+                details='; '.join(error_details),
+            ),
+            extras=dict(
+                identifier=self.combined_identifier,
+                authorization=self.data,
+            ),
+        )
+
+    def find_challenge(self, challenge_type):
+        for challenge in self.challenges:
+            if challenge_type == challenge.type:
+                return challenge
+        return None
+
+    def wait_for_validation(self, client, callenge_type):
+        while True:
+            self.refresh(client)
+            if self.status in ['valid', 'invalid', 'revoked']:
+                break
+            time.sleep(2)
+
+        if self.status == 'invalid':
+            self.raise_error('Status is "invalid"', module=client.module)
+
+        return self.status == 'valid'
+
+    def call_validate(self, client, challenge_type, wait=True):
+        '''
+        Validate the authorization provided in the auth dict. Returns True
+        when the validation was successful and False when it was not.
+        '''
+        challenge = self.find_challenge(challenge_type)
+        if challenge is None:
+            raise ModuleFailException('Found no challenge of type "{challenge}" for identifier {identifier}!'.format(
+                challenge=challenge_type,
+                identifier=self.combined_identifier,
+            ))
+
+        challenge.call_validate(client)
+
+        if not wait:
+            return self.status == 'valid'
+        return self.wait_for_validation(client, challenge_type)
+
+    def deactivate(self, client):
+        '''
+        Deactivates this authorization.
+        https://community.letsencrypt.org/t/authorization-deactivation/19860/2
+        https://tools.ietf.org/html/rfc8555#section-7.5.2
+        '''
+        if self.status != 'valid':
+            return
+        authz_deactivate = {
+            'status': 'deactivated'
+        }
+        if client.version == 1:
+            authz_deactivate['resource'] = 'authz'
+        result, info = client.send_signed_request(self.url, authz_deactivate, fail_on_error=False)
+        if 200 <= info['status'] < 300 and result.get('status') == 'deactivated':
+            self.status = 'deactivated'
+            return True
+        return False

plugins/module_utils/acme/errors.py

@@ -0,0 +1,131 @@
+# -*- coding: utf-8 -*-
+
+# Copyright: (c) 2016 Michael Gruener <michael.gruener@chaosmoon.net>
+# Copyright: (c) 2021 Felix Fontein <felix@fontein.de>
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+
+from __future__ import absolute_import, division, print_function
+__metaclass__ = type
+
+from ansible.module_utils.six import binary_type
+from ansible.module_utils._text import to_text
+
+
+def format_error_problem(problem, subproblem_prefix=''):
+    if 'title' in problem:
+        msg = 'Error "{title}" ({type})'.format(
+            type=problem['type'],
+            title=problem['title'],
+        )
+    else:
+        msg = 'Error {type}'.format(type=problem['type'])
+    if 'detail' in problem:
+        msg += ': "{detail}"'.format(detail=problem['detail'])
+    subproblems = problem.get('subproblems')
+    if subproblems is not None:
+        msg = '{msg} Subproblems:'.format(msg=msg)
+        for index, problem in enumerate(subproblems):
+            index_str = '{prefix}{index}'.format(prefix=subproblem_prefix, index=index)
+            msg = '{msg}\n({index}) {problem}'.format(
+                msg=msg,
+                index=index_str,
+                problem=format_error_problem(problem, subproblem_prefix='{0}.'.format(index_str)),
+            )
+    return msg
+
+
+class ModuleFailException(Exception):
+    '''
+    If raised, module.fail_json() will be called with the given parameters after cleanup.
+    '''
+    def __init__(self, msg, **args):
+        super(ModuleFailException, self).__init__(self, msg)
+        self.msg = msg
+        self.module_fail_args = args
+
+    def do_fail(self, module, **arguments):
+        module.fail_json(msg=self.msg, other=self.module_fail_args, **arguments)
+
+
+class ACMEProtocolException(ModuleFailException):
+    def __init__(self, module, msg=None, info=None, response=None, content=None, content_json=None, extras=None):
+        # Try to get hold of content, if response is given and content is not provided
+        if content is None and content_json is None and response is not None:
+            try:
+                content = response.read()
+            except AttributeError:
+                content = info.pop('body', None)
+
+        # Make sure that content_json is None or a dictionary
+        if content_json is not None and not isinstance(content_json, dict):
+            if content is None and isinstance(content_json, binary_type):
+                content = content_json
+            content_json = None
+
+        # Try to get hold of JSON decoded content, when content is given and JSON not provided
+        if content_json is None and content is not None and module is not None:
+            try:
+                content_json = module.from_json(to_text(content))
+            except Exception as e:
+                pass
+
+        extras = extras or dict()
+
+        if msg is None:
+            msg = 'ACME request failed'
+        add_msg = ''
+
+        if info is not None:
+            url = info['url']
+            code = info['status']
+            extras['http_url'] = url
+            extras['http_status'] = code
+            if code is not None and code >= 400 and content_json is not None and 'type' in content_json:
+                if 'status' in content_json and content_json['status'] != code:
+                    code = 'status {problem_code} (HTTP status: {http_code})'.format(http_code=code, problem_code=content_json['status'])
+                else:
+                    code = 'status {problem_code}'.format(problem_code=code)
+                subproblems = content_json.pop('subproblems', None)
+                add_msg = ' {problem}.'.format(problem=format_error_problem(content_json))
+                extras['problem'] = content_json
+                extras['subproblems'] = subproblems or []
+                if subproblems is not None:
+                    add_msg = '{add_msg} Subproblems:'.format(add_msg=add_msg)
+                    for index, problem in enumerate(subproblems):
+                        add_msg = '{add_msg}\n({index}) {problem}.'.format(
+                            add_msg=add_msg,
+                            index=index,
+                            problem=format_error_problem(problem, subproblem_prefix='{0}.'.format(index)),
+                        )
+            else:
+                code = 'HTTP status {code}'.format(code=code)
+                if content_json is not None:
+                    add_msg = ' The JSON error result: {content}'.format(content=content_json)
+                elif content is not None:
+                    add_msg = ' The raw error result: {content}'.format(content=to_text(content))
+            msg = '{msg} for {url} with {code}'.format(msg=msg, url=url, code=code)
+        elif content_json is not None:
+            add_msg = ' The JSON result: {content}'.format(content=content_json)
+        elif content is not None:
+            add_msg = ' The raw result: {content}'.format(content=to_text(content))
+
+        super(ACMEProtocolException, self).__init__(
+            '{msg}.{add_msg}'.format(msg=msg, add_msg=add_msg),
+            **extras
+        )
+        self.problem = {}
+        self.subproblems = []
+        for k, v in extras.items():
+            setattr(self, k, v)
+
+
+class BackendException(ModuleFailException):
+    pass
+
+
+class NetworkException(ModuleFailException):
+    pass
+
+
+class KeyParsingError(ModuleFailException):
+    pass

plugins/module_utils/acme/io.py

@@ -0,0 +1,86 @@
+# -*- coding: utf-8 -*-
+
+# Copyright: (c) 2013, Romeo Theriault <romeot () hawaii.edu>
+# Copyright: (c) 2016 Michael Gruener <michael.gruener@chaosmoon.net>
+# Copyright: (c) 2021 Felix Fontein <felix@fontein.de>
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+
+from __future__ import absolute_import, division, print_function
+__metaclass__ = type
+
+
+import os
+import shutil
+import tempfile
+import traceback
+
+from ansible.module_utils._text import to_native
+
+from ansible_collections.community.crypto.plugins.module_utils.acme.errors import ModuleFailException
+
+
+def read_file(fn, mode='b'):
+    try:
+        with open(fn, 'r' + mode) as f:
+            return f.read()
+    except Exception as e:
+        raise ModuleFailException('Error while reading file "{0}": {1}'.format(fn, e))
+
+
+# This function was adapted from an earlier version of https://github.com/ansible/ansible/blob/devel/lib/ansible/modules/uri.py
+def write_file(module, dest, content):
+    '''
+    Write content to destination file dest, only if the content
+    has changed.
+    '''
+    changed = False
+    # create a tempfile
+    fd, tmpsrc = tempfile.mkstemp(text=False)
+    f = os.fdopen(fd, 'wb')
+    try:
+        f.write(content)
+    except Exception as err:
+        try:
+            f.close()
+        except Exception as dummy:
+            pass
+        os.remove(tmpsrc)
+        raise ModuleFailException("failed to create temporary content file: %s" % to_native(err), exception=traceback.format_exc())
+    f.close()
+    checksum_src = None
+    checksum_dest = None
+    # raise an error if there is no tmpsrc file
+    if not os.path.exists(tmpsrc):
+        try:
+            os.remove(tmpsrc)
+        except Exception as dummy:
+            pass
+        raise ModuleFailException("Source %s does not exist" % (tmpsrc))
+    if not os.access(tmpsrc, os.R_OK):
+        os.remove(tmpsrc)
+        raise ModuleFailException("Source %s not readable" % (tmpsrc))
+    checksum_src = module.sha1(tmpsrc)
+    # check if there is no dest file
+    if os.path.exists(dest):
+        # raise an error if copy has no permission on dest
+        if not os.access(dest, os.W_OK):
+            os.remove(tmpsrc)
+            raise ModuleFailException("Destination %s not writable" % (dest))
+        if not os.access(dest, os.R_OK):
+            os.remove(tmpsrc)
+            raise ModuleFailException("Destination %s not readable" % (dest))
+        checksum_dest = module.sha1(dest)
+    else:
+        dirname = os.path.dirname(dest) or '.'
+        if not os.access(dirname, os.W_OK):
+            os.remove(tmpsrc)
+            raise ModuleFailException("Destination dir %s not writable" % (dirname))
+    if checksum_src != checksum_dest:
+        try:
+            shutil.copyfile(tmpsrc, dest)
+            changed = True
+        except Exception as err:
+            os.remove(tmpsrc)
+            raise ModuleFailException("failed to copy %s to %s: %s" % (tmpsrc, dest, to_native(err)), exception=traceback.format_exc())
+    os.remove(tmpsrc)
+    return changed

plugins/module_utils/acme/orders.py

@@ -0,0 +1,129 @@
+# -*- coding: utf-8 -*-
+
+# Copyright: (c) 2016 Michael Gruener <michael.gruener@chaosmoon.net>
+# Copyright: (c) 2021 Felix Fontein <felix@fontein.de>
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+
+from __future__ import absolute_import, division, print_function
+__metaclass__ = type
+
+
+import time
+
+from ansible_collections.community.crypto.plugins.module_utils.acme.utils import (
+    nopad_b64,
+)
+
+from ansible_collections.community.crypto.plugins.module_utils.acme.errors import (
+    ACMEProtocolException,
+)
+
+from ansible_collections.community.crypto.plugins.module_utils.acme.challenges import (
+    Authorization,
+)
+
+
+class Order(object):
+    def _setup(self, client, data):
+        self.data = data
+
+        self.status = data['status']
+        self.identifiers = []
+        for identifier in data['identifiers']:
+            self.identifiers.append((identifier['type'], identifier['value']))
+        self.finalize_uri = data.get('finalize')
+        self.certificate_uri = data.get('certificate')
+        self.authorization_uris = data['authorizations']
+        self.authorizations = {}
+
+    def __init__(self, url):
+        self.url = url
+
+        self.data = None
+
+        self.status = None
+        self.identifiers = []
+        self.finalize_uri = None
+        self.certificate_uri = None
+        self.authorization_uris = []
+        self.authorizations = {}
+
+    @classmethod
+    def from_json(cls, client, data, url):
+        result = cls(url)
+        result._setup(client, data)
+        return result
+
+    @classmethod
+    def from_url(cls, client, url):
+        result = cls(url)
+        result.refresh(client)
+        return result
+
+    @classmethod
+    def create(cls, client, identifiers):
+        '''
+        Start a new certificate order (ACME v2 protocol).
+        https://tools.ietf.org/html/rfc8555#section-7.4
+        '''
+        acme_identifiers = []
+        for identifier_type, identifier in identifiers:
+            acme_identifiers.append({
+                'type': identifier_type,
+                'value': identifier,
+            })
+        new_order = {
+            "identifiers": acme_identifiers
+        }
+        result, info = client.send_signed_request(
+            client.directory['newOrder'], new_order, error_msg='Failed to start new order', expected_status_codes=[201])
+        return cls.from_json(client, result, info['location'])
+
+    def refresh(self, client):
+        result, dummy = client.get_request(self.url)
+        changed = self.data != result
+        self._setup(client, result)
+        return changed
+
+    def load_authorizations(self, client):
+        for auth_uri in self.authorization_uris:
+            authz = Authorization.from_url(client, auth_uri)
+            self.authorizations[authz.combined_identifier] = authz
+
+    def wait_for_finalization(self, client):
+        while True:
+            self.refresh(client)
+            if self.status in ['valid', 'invalid', 'pending', 'ready']:
+                break
+            time.sleep(2)
+
+        if self.status != 'valid':
+            raise ACMEProtocolException(
+                client.module,
+                'Failed to wait for order to complete; got status "{status}"'.format(status=self.status),
+                content_json=self.data)
+
+    def finalize(self, client, csr_der, wait=True):
+        '''
+        Create a new certificate based on the csr.
+        Return the certificate object as dict
+        https://tools.ietf.org/html/rfc8555#section-7.4
+        '''
+        new_cert = {
+            "csr": nopad_b64(csr_der),
+        }
+        result, info = client.send_signed_request(
+            self.finalize_uri, new_cert, error_msg='Failed to finalizing order', expected_status_codes=[200])
+        # It is not clear from the RFC whether the finalize call returns the order object or not.
+        # Instead of using the result, we call self.refresh(client) below.
+
+        if wait:
+            self.wait_for_finalization(client)
+        else:
+            self.refresh(client)
+            if self.status not in ['procesing', 'valid', 'invalid']:
+                raise ACMEProtocolException(
+                    client.module,
+                    'Failed to finalize order; got status "{status}"'.format(status=self.status),
+                    info=info,
+                    content_json=result)

plugins/module_utils/acme/utils.py

@@ -0,0 +1,71 @@
+# -*- coding: utf-8 -*-
+
+# Copyright: (c) 2016 Michael Gruener <michael.gruener@chaosmoon.net>
+# Copyright: (c) 2021 Felix Fontein <felix@fontein.de>
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+
+from __future__ import absolute_import, division, print_function
+__metaclass__ = type
+
+
+import base64
+import re
+import textwrap
+import traceback
+
+from ansible.module_utils._text import to_native
+from ansible.module_utils.six.moves.urllib.parse import unquote
+
+from ansible_collections.community.crypto.plugins.module_utils.acme.errors import ModuleFailException
+
+
+def nopad_b64(data):
+    return base64.urlsafe_b64encode(data).decode('utf8').replace("=", "")
+
+
+def der_to_pem(der_cert):
+    '''
+    Convert the DER format certificate in der_cert to a PEM format certificate and return it.
+    '''
+    return """-----BEGIN CERTIFICATE-----\n{0}\n-----END CERTIFICATE-----\n""".format(
+        "\n".join(textwrap.wrap(base64.b64encode(der_cert).decode('utf8'), 64)))
+
+
+def pem_to_der(pem_filename=None, pem_content=None):
+    '''
+    Load PEM file, or use PEM file's content, and convert to DER.
+
+    If PEM contains multiple entities, the first entity will be used.
+    '''
+    certificate_lines = []
+    if pem_content is not None:
+        lines = pem_content.splitlines()
+    elif pem_filename is not None:
+        try:
+            with open(pem_filename, "rt") as f:
+                lines = list(f)
+        except Exception as err:
+            raise ModuleFailException("cannot load PEM file {0}: {1}".format(pem_filename, to_native(err)), exception=traceback.format_exc())
+    else:
+        raise ModuleFailException('One of pem_filename and pem_content must be provided')
+    header_line_count = 0
+    for line in lines:
+        if line.startswith('-----'):
+            header_line_count += 1
+            if header_line_count == 2:
+                # If certificate file contains other certs appended
+                # (like intermediate certificates), ignore these.
+                break
+            continue
+        certificate_lines.append(line.strip())
+    return base64.b64decode(''.join(certificate_lines))
+
+
+def process_links(info, callback):
+    '''
+    Process link header, calls callback for every link header with the URL and relation as options.
+    '''
+    if 'link' in info:
+        link = info['link']
+        for url, relation in re.findall(r'<([^>]+)>;\s*rel="(\w+)"', link):
+            callback(unquote(url), relation)

plugins/module_utils/crypto/__init__.py

@@ -55,7 +55,7 @@ from .cryptography_support import (
     cryptography_compare_public_keys,
 )
 
-from .identify import (
+from .pem import (
     identify_private_key_format,
 )
 

plugins/module_utils/crypto/cryptography_support.py

@@ -152,6 +152,36 @@ def _parse_hex(bytesstr):
     return data
 
 
+DN_COMPONENT_START_RE = re.compile(r'^ *([a-zA-z0-9]+) *= *')
+
+
+def _parse_dn_component(name, sep=',', sep_str='\\', decode_remainder=True):
+    m = DN_COMPONENT_START_RE.match(name)
+    if not m:
+        raise OpenSSLObjectError('cannot start part in "{0}"'.format(name))
+    oid = cryptography_name_to_oid(m.group(1))
+    idx = len(m.group(0))
+    decoded_name = []
+    if decode_remainder:
+        length = len(name)
+        while idx < length:
+            i = idx
+            while i < length and name[i] not in sep_str:
+                i += 1
+            if i > idx:
+                decoded_name.append(name[idx:i])
+                idx = i
+            while idx + 1 < length and name[idx] == '\\':
+                decoded_name.append(name[idx + 1])
+                idx += 2
+            if idx < length and name[idx] == sep:
+                break
+    else:
+        decoded_name.append(name[idx:])
+        idx = len(name)
+    return x509.NameAttribute(oid, ''.join(decoded_name)), name[idx:]
+
+
 def _parse_dn(name):
     '''
     Parse a Distinguished Name.
@@ -166,29 +196,12 @@ def _parse_dn(name):
         name = name[1:]
     sep_str = sep + '\\'
     result = []
-    start_re = re.compile(r'^ *([a-zA-z0-9]+) *= *')
     while name:
-        m = start_re.match(name)
-        if not m:
-            raise OpenSSLObjectError('Error while parsing distinguished name "{0}": cannot start part in "{1}"'.format(original_name, name))
-        oid = cryptography_name_to_oid(m.group(1))
-        idx = len(m.group(0))
-        decoded_name = []
-        length = len(name)
-        while idx < length:
-            i = idx
-            while i < length and name[i] not in sep_str:
-                i += 1
-            if i > idx:
-                decoded_name.append(name[idx:i])
-                idx = i
-            while idx + 1 < length and name[idx] == '\\':
-                decoded_name.append(name[idx + 1])
-                idx += 2
-            if idx < length and name[idx] == sep:
-                break
-        result.append(x509.NameAttribute(oid, ''.join(decoded_name)))
-        name = name[idx:]
+        try:
+            attribute, name = _parse_dn_component(name, sep=sep, sep_str=sep_str)
+        except OpenSSLObjectError as e:
+            raise OpenSSLObjectError('Error while parsing distinguished name "{0}": {1}'.format(original_name, e))
+        result.append(attribute)
         if name:
             if name[0] != sep or len(name) < 2:
                 raise OpenSSLObjectError('Error while parsing distinguished name "{0}": unexpected end of string'.format(original_name))
@@ -196,9 +209,19 @@ def _parse_dn(name):
     return result
 
 
-def cryptography_get_name(name):
+def cryptography_parse_relative_distinguished_name(rdn):
+    names = []
+    for part in rdn:
+        try:
+            names.append(_parse_dn_component(to_text(part), decode_remainder=False)[0])
+        except OpenSSLObjectError as e:
+            raise OpenSSLObjectError('Error while parsing relative distinguished name "{0}": {1}'.format(part, e))
+    return cryptography.x509.RelativeDistinguishedName(names)
+
+
+def cryptography_get_name(name, what='Subject Alternative Name'):
     '''
-    Given a name string, returns a cryptography x509.Name object.
+    Given a name string, returns a cryptography x509.GeneralName object.
     Raises an OpenSSLObjectError if the name is unknown or cannot be parsed.
     '''
     try:
@@ -216,7 +239,7 @@ def cryptography_get_name(name):
         if name.startswith('RID:'):
             m = re.match(r'^([0-9]+(?:\.[0-9]+)*)$', to_text(name[4:]))
             if not m:
-                raise OpenSSLObjectError('Cannot parse Subject Alternative Name "{0}"'.format(name))
+                raise OpenSSLObjectError('Cannot parse {what} "{name}"'.format(name=name, what=what))
             return x509.RegisteredID(x509.oid.ObjectIdentifier(m.group(1)))
         if name.startswith('otherName:'):
             # otherName can either be a raw ASN.1 hex string or in the format that OpenSSL works with.
@@ -228,9 +251,9 @@ def cryptography_get_name(name):
             # defailts on the format expected.
             name = to_text(name[10:], errors='surrogate_or_strict')
             if ';' not in name:
-                raise OpenSSLObjectError('Cannot parse Subject Alternative Name otherName "{0}", must be in the '
+                raise OpenSSLObjectError('Cannot parse {what} otherName "{name}", must be in the '
                                          'format "otherName:<OID>;<ASN.1 OpenSSL Encoded String>" or '
-                                         '"otherName:<OID>;<hex string>"'.format(name))
+                                         '"otherName:<OID>;<hex string>"'.format(name=name, what=what))
 
             oid, value = name.split(';', 1)
             b_value = serialize_asn1_string_as_der(value)
@@ -238,10 +261,10 @@ def cryptography_get_name(name):
         if name.startswith('dirName:'):
             return x509.DirectoryName(x509.Name(_parse_dn(to_text(name[8:]))))
     except Exception as e:
-        raise OpenSSLObjectError('Cannot parse Subject Alternative Name "{0}": {1}'.format(name, e))
+        raise OpenSSLObjectError('Cannot parse {what} "{name}": {error}'.format(name=name, what=what, error=e))
     if ':' not in name:
-        raise OpenSSLObjectError('Cannot parse Subject Alternative Name "{0}" (forgot "DNS:" prefix?)'.format(name))
-    raise OpenSSLObjectError('Cannot parse Subject Alternative Name "{0}" (potentially unsupported by cryptography backend)'.format(name))
+        raise OpenSSLObjectError('Cannot parse {what} "{name}" (forgot "DNS:" prefix?)'.format(name=name, what=what))
+    raise OpenSSLObjectError('Cannot parse {what} "{name}" (potentially unsupported by cryptography backend)'.format(name=name, what=what))
 
 
 def _dn_escape_value(value):
@@ -258,7 +281,7 @@ def _dn_escape_value(value):
 
 def cryptography_decode_name(name):
     '''
-    Given a cryptography x509.Name object, returns a string.
+    Given a cryptography x509.GeneralName object, returns a string.
     Raises an OpenSSLObjectError if the name is not supported.
     '''
     if isinstance(name, x509.DNSName):

plugins/module_utils/crypto/module_backends/certificate.py

@@ -0,0 +1,392 @@
+# -*- coding: utf-8 -*-
+
+# Copyright: (c) 2016-2017, Yanis Guenane <yanis+ansible@guenane.org>
+# Copyright: (c) 2017, Markus Teufelberger <mteufelberger+ansible@mgit.at>
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+
+from __future__ import absolute_import, division, print_function
+__metaclass__ = type
+
+
+import abc
+import traceback
+
+from distutils.version import LooseVersion
+
+from ansible.module_utils import six
+from ansible.module_utils.basic import missing_required_lib
+
+from ansible_collections.community.crypto.plugins.module_utils.crypto.module_backends.common import ArgumentSpec
+
+from ansible_collections.community.crypto.plugins.module_utils.crypto.basic import (
+    OpenSSLObjectError,
+    OpenSSLBadPassphraseError,
+)
+
+from ansible_collections.community.crypto.plugins.module_utils.crypto.support import (
+    load_privatekey,
+    load_certificate,
+    load_certificate_request,
+)
+
+from ansible_collections.community.crypto.plugins.module_utils.crypto.cryptography_support import (
+    cryptography_compare_public_keys,
+)
+
+MINIMAL_CRYPTOGRAPHY_VERSION = '1.6'
+MINIMAL_PYOPENSSL_VERSION = '0.15'
+
+PYOPENSSL_IMP_ERR = None
+try:
+    import OpenSSL
+    from OpenSSL import crypto
+    PYOPENSSL_VERSION = LooseVersion(OpenSSL.__version__)
+except ImportError:
+    PYOPENSSL_IMP_ERR = traceback.format_exc()
+    PYOPENSSL_FOUND = False
+else:
+    PYOPENSSL_FOUND = True
+
+CRYPTOGRAPHY_IMP_ERR = None
+CRYPTOGRAPHY_VERSION = None
+try:
+    import cryptography
+    from cryptography import x509
+    CRYPTOGRAPHY_VERSION = LooseVersion(cryptography.__version__)
+except ImportError:
+    CRYPTOGRAPHY_IMP_ERR = traceback.format_exc()
+    CRYPTOGRAPHY_FOUND = False
+else:
+    CRYPTOGRAPHY_FOUND = True
+
+
+class CertificateError(OpenSSLObjectError):
+    pass
+
+
+@six.add_metaclass(abc.ABCMeta)
+class CertificateBackend(object):
+    def __init__(self, module, backend):
+        self.module = module
+        self.backend = backend
+
+        self.force = module.params['force']
+        self.privatekey_path = module.params['privatekey_path']
+        self.privatekey_content = module.params['privatekey_content']
+        if self.privatekey_content is not None:
+            self.privatekey_content = self.privatekey_content.encode('utf-8')
+        self.privatekey_passphrase = module.params['privatekey_passphrase']
+        self.csr_path = module.params['csr_path']
+        self.csr_content = module.params['csr_content']
+        if self.csr_content is not None:
+            self.csr_content = self.csr_content.encode('utf-8')
+
+        # The following are default values which make sure check() works as
+        # before if providers do not explicitly change these properties.
+        self.create_subject_key_identifier = 'never_create'
+        self.create_authority_key_identifier = False
+
+        self.privatekey = None
+        self.csr = None
+        self.cert = None
+        self.existing_certificate = None
+        self.existing_certificate_bytes = None
+
+        self.check_csr_subject = True
+        self.check_csr_extensions = True
+
+    @abc.abstractmethod
+    def generate_certificate(self):
+        """(Re-)Generate certificate."""
+        pass
+
+    @abc.abstractmethod
+    def get_certificate_data(self):
+        """Return bytes for self.cert."""
+        pass
+
+    def set_existing(self, certificate_bytes):
+        """Set existing certificate bytes. None indicates that the key does not exist."""
+        self.existing_certificate_bytes = certificate_bytes
+
+    def has_existing(self):
+        """Query whether an existing certificate is/has been there."""
+        return self.existing_certificate_bytes is not None
+
+    def _ensure_private_key_loaded(self):
+        """Load the provided private key into self.privatekey."""
+        if self.privatekey is not None:
+            return
+        if self.privatekey_path is None and self.privatekey_content is None:
+            return
+        try:
+            self.privatekey = load_privatekey(
+                path=self.privatekey_path,
+                content=self.privatekey_content,
+                passphrase=self.privatekey_passphrase,
+                backend=self.backend,
+            )
+        except OpenSSLBadPassphraseError as exc:
+            raise CertificateError(exc)
+
+    def _ensure_csr_loaded(self):
+        """Load the CSR into self.csr."""
+        if self.csr is not None:
+            return
+        if self.csr_path is None and self.csr_content is None:
+            return
+        self.csr = load_certificate_request(
+            path=self.csr_path,
+            content=self.csr_content,
+            backend=self.backend,
+        )
+
+    def _ensure_existing_certificate_loaded(self):
+        """Load the existing certificate into self.existing_certificate."""
+        if self.existing_certificate is not None:
+            return
+        if self.existing_certificate_bytes is None:
+            return
+        self.existing_certificate = load_certificate(
+            path=None,
+            content=self.existing_certificate_bytes,
+            backend=self.backend,
+        )
+
+    def _check_privatekey(self):
+        """Check whether provided parameters match, assuming self.existing_certificate and self.privatekey have been populated."""
+        if self.backend == 'pyopenssl':
+            ctx = OpenSSL.SSL.Context(OpenSSL.SSL.TLSv1_2_METHOD)
+            ctx.use_privatekey(self.privatekey)
+            ctx.use_certificate(self.existing_certificate)
+            try:
+                ctx.check_privatekey()
+                return True
+            except OpenSSL.SSL.Error:
+                return False
+        elif self.backend == 'cryptography':
+            return cryptography_compare_public_keys(self.existing_certificate.public_key(), self.privatekey.public_key())
+
+    def _check_csr(self):
+        """Check whether provided parameters match, assuming self.existing_certificate and self.csr have been populated."""
+        if self.backend == 'pyopenssl':
+            # Verify that CSR is signed by certificate's private key
+            try:
+                self.csr.verify(self.existing_certificate.get_pubkey())
+            except OpenSSL.crypto.Error:
+                return False
+            # Check subject
+            if self.check_csr_subject and self.csr.get_subject() != self.existing_certificate.get_subject():
+                return False
+            # Check extensions
+            if not self.check_csr_extensions:
+                return True
+            csr_extensions = self.csr.get_extensions()
+            cert_extension_count = self.existing_certificate.get_extension_count()
+            if len(csr_extensions) != cert_extension_count:
+                return False
+            for extension_number in range(0, cert_extension_count):
+                cert_extension = self.existing_certificate.get_extension(extension_number)
+                csr_extension = filter(lambda extension: extension.get_short_name() == cert_extension.get_short_name(), csr_extensions)
+                if cert_extension.get_data() != list(csr_extension)[0].get_data():
+                    return False
+            return True
+        elif self.backend == 'cryptography':
+            # Verify that CSR is signed by certificate's private key
+            if not self.csr.is_signature_valid:
+                return False
+            if not cryptography_compare_public_keys(self.csr.public_key(), self.existing_certificate.public_key()):
+                return False
+            # Check subject
+            if self.check_csr_subject and self.csr.subject != self.existing_certificate.subject:
+                return False
+            # Check extensions
+            if not self.check_csr_extensions:
+                return True
+            cert_exts = list(self.existing_certificate.extensions)
+            csr_exts = list(self.csr.extensions)
+            if self.create_subject_key_identifier != 'never_create':
+                # Filter out SubjectKeyIdentifier extension before comparison
+                cert_exts = list(filter(lambda x: not isinstance(x.value, x509.SubjectKeyIdentifier), cert_exts))
+                csr_exts = list(filter(lambda x: not isinstance(x.value, x509.SubjectKeyIdentifier), csr_exts))
+            if self.create_authority_key_identifier:
+                # Filter out AuthorityKeyIdentifier extension before comparison
+                cert_exts = list(filter(lambda x: not isinstance(x.value, x509.AuthorityKeyIdentifier), cert_exts))
+                csr_exts = list(filter(lambda x: not isinstance(x.value, x509.AuthorityKeyIdentifier), csr_exts))
+            if len(cert_exts) != len(csr_exts):
+                return False
+            for cert_ext in cert_exts:
+                try:
+                    csr_ext = self.csr.extensions.get_extension_for_oid(cert_ext.oid)
+                    if cert_ext != csr_ext:
+                        return False
+                except cryptography.x509.ExtensionNotFound as dummy:
+                    return False
+            return True
+
+    def _check_subject_key_identifier(self):
+        """Check whether Subject Key Identifier matches, assuming self.existing_certificate has been populated."""
+        if self.backend != 'cryptography':
+            # We do not support SKI with pyOpenSSL backend
+            return True
+
+        # Get hold of certificate's SKI
+        try:
+            ext = self.existing_certificate.extensions.get_extension_for_class(x509.SubjectKeyIdentifier)
+        except cryptography.x509.ExtensionNotFound as dummy:
+            return False
+        # Get hold of CSR's SKI for 'create_if_not_provided'
+        csr_ext = None
+        if self.create_subject_key_identifier == 'create_if_not_provided':
+            try:
+                csr_ext = self.csr.extensions.get_extension_for_class(x509.SubjectKeyIdentifier)
+            except cryptography.x509.ExtensionNotFound as dummy:
+                pass
+        if csr_ext is None:
+            # If CSR had no SKI, or we chose to ignore it ('always_create'), compare with created SKI
+            if ext.value.digest != x509.SubjectKeyIdentifier.from_public_key(self.existing_certificate.public_key()).digest:
+                return False
+        else:
+            # If CSR had SKI and we didn't ignore it ('create_if_not_provided'), compare SKIs
+            if ext.value.digest != csr_ext.value.digest:
+                return False
+        return True
+
+    def needs_regeneration(self):
+        """Check whether a regeneration is necessary."""
+        if self.force or self.existing_certificate_bytes is None:
+            return True
+
+        try:
+            self._ensure_existing_certificate_loaded()
+        except Exception as dummy:
+            return True
+
+        # Check whether private key matches
+        self._ensure_private_key_loaded()
+        if self.privatekey is not None and not self._check_privatekey():
+            return True
+
+        # Check whether CSR matches
+        self._ensure_csr_loaded()
+        if self.csr is not None and not self._check_csr():
+            return True
+
+        # Check SubjectKeyIdentifier
+        if self.create_subject_key_identifier != 'never_create' and not self._check_subject_key_identifier():
+            return True
+
+        return False
+
+    def dump(self, include_certificate):
+        """Serialize the object into a dictionary."""
+        result = {
+            'privatekey': self.privatekey_path,
+            'csr': self.csr_path
+        }
+        if include_certificate:
+            # Get hold of certificate bytes
+            certificate_bytes = self.existing_certificate_bytes
+            if self.cert is not None:
+                certificate_bytes = self.get_certificate_data()
+            # Store result
+            result['certificate'] = certificate_bytes.decode('utf-8') if certificate_bytes else None
+        return result
+
+
+@six.add_metaclass(abc.ABCMeta)
+class CertificateProvider(object):
+    @abc.abstractmethod
+    def validate_module_args(self, module):
+        """Check module arguments"""
+
+    @abc.abstractmethod
+    def needs_version_two_certs(self, module):
+        """Whether the provider needs to create a version 2 certificate."""
+
+    def needs_pyopenssl_get_extensions(self, module):
+        """Whether the provider needs to use get_extensions() with pyOpenSSL."""
+        return True
+
+    @abc.abstractmethod
+    def create_backend(self, module, backend):
+        """Create an implementation for a backend.
+
+        Return value must be instance of CertificateBackend.
+        """
+
+
+def select_backend(module, backend, provider):
+    """
+    :type module: AnsibleModule
+    :type backend: str
+    :type provider: CertificateProvider
+    """
+    provider.validate_module_args(module)
+
+    backend = module.params['select_crypto_backend']
+    if backend == 'auto':
+        # Detect what backend we can use
+        can_use_cryptography = CRYPTOGRAPHY_FOUND and CRYPTOGRAPHY_VERSION >= LooseVersion(MINIMAL_CRYPTOGRAPHY_VERSION)
+        can_use_pyopenssl = PYOPENSSL_FOUND and PYOPENSSL_VERSION >= LooseVersion(MINIMAL_PYOPENSSL_VERSION)
+
+        # If cryptography is available we'll use it
+        if can_use_cryptography:
+            backend = 'cryptography'
+        elif can_use_pyopenssl:
+            backend = 'pyopenssl'
+
+        if provider.needs_version_two_certs(module):
+            module.warn('crypto backend forced to pyopenssl. The cryptography library does not support v2 certificates')
+            backend = 'pyopenssl'
+
+        # Fail if no backend has been found
+        if backend == 'auto':
+            module.fail_json(msg=("Can't detect any of the required Python libraries "
+                                  "cryptography (>= {0}) or PyOpenSSL (>= {1})").format(
+                                      MINIMAL_CRYPTOGRAPHY_VERSION,
+                                      MINIMAL_PYOPENSSL_VERSION))
+
+    if backend == 'pyopenssl':
+        module.deprecate('The module is using the PyOpenSSL backend. This backend has been deprecated',
+                         version='2.0.0', collection_name='community.crypto')
+
+        if not PYOPENSSL_FOUND:
+            module.fail_json(msg=missing_required_lib('pyOpenSSL >= {0}'.format(MINIMAL_PYOPENSSL_VERSION)),
+                             exception=PYOPENSSL_IMP_ERR)
+        if provider.needs_pyopenssl_get_extensions(module):
+            try:
+                getattr(crypto.X509Req, 'get_extensions')
+            except AttributeError:
+                module.fail_json(msg='You need to have PyOpenSSL>=0.15')
+
+    elif backend == 'cryptography':
+        if not CRYPTOGRAPHY_FOUND:
+            module.fail_json(msg=missing_required_lib('cryptography >= {0}'.format(MINIMAL_CRYPTOGRAPHY_VERSION)),
+                             exception=CRYPTOGRAPHY_IMP_ERR)
+        if provider.needs_version_two_certs(module):
+            module.fail_json(msg='The cryptography backend does not support v2 certificates, '
+                                 'use select_crypto_backend=pyopenssl for v2 certificates')
+
+    return provider.create_backend(module, backend)
+
+
+def get_certificate_argument_spec():
+    return ArgumentSpec(
+        argument_spec=dict(
+            provider=dict(type='str', choices=[]),  # choices will be filled by add_XXX_provider_to_argument_spec() in certificate_xxx.py
+            force=dict(type='bool', default=False,),
+            csr_path=dict(type='path'),
+            csr_content=dict(type='str'),
+            select_crypto_backend=dict(type='str', default='auto', choices=['auto', 'cryptography', 'pyopenssl']),
+
+            # General properties of a certificate
+            privatekey_path=dict(type='path'),
+            privatekey_content=dict(type='str', no_log=True),
+            privatekey_passphrase=dict(type='str', no_log=True),
+        ),
+        mutually_exclusive=[
+            ['csr_path', 'csr_content'],
+            ['privatekey_path', 'privatekey_content'],
+        ],
+    )

plugins/module_utils/crypto/module_backends/certificate_acme.py

@@ -0,0 +1,119 @@
+# -*- coding: utf-8 -*-
+
+# Copyright: (c) 2016-2017, Yanis Guenane <yanis+ansible@guenane.org>
+# Copyright: (c) 2017, Markus Teufelberger <mteufelberger+ansible@mgit.at>
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+
+from __future__ import absolute_import, division, print_function
+__metaclass__ = type
+
+
+import os
+import tempfile
+import traceback
+
+from ansible.module_utils._text import to_native, to_bytes
+
+from ansible_collections.community.crypto.plugins.module_utils.crypto.module_backends.certificate import (
+    CertificateError,
+    CertificateBackend,
+    CertificateProvider,
+)
+
+
+class AcmeCertificateBackend(CertificateBackend):
+    def __init__(self, module, backend):
+        super(AcmeCertificateBackend, self).__init__(module, backend)
+        self.accountkey_path = module.params['acme_accountkey_path']
+        self.challenge_path = module.params['acme_challenge_path']
+        self.use_chain = module.params['acme_chain']
+        self.acme_directory = module.params['acme_directory']
+
+        if self.csr_content is None and self.csr_path is None:
+            raise CertificateError(
+                'csr_path or csr_content is required for ownca provider'
+            )
+        if self.csr_content is None and not os.path.exists(self.csr_path):
+            raise CertificateError(
+                'The certificate signing request file %s does not exist' % self.csr_path
+            )
+
+        if not os.path.exists(self.accountkey_path):
+            raise CertificateError(
+                'The account key %s does not exist' % self.accountkey_path
+            )
+
+        if not os.path.exists(self.challenge_path):
+            raise CertificateError(
+                'The challenge path %s does not exist' % self.challenge_path
+            )
+
+        self.acme_tiny_path = self.module.get_bin_path('acme-tiny', required=True)
+
+    def generate_certificate(self):
+        """(Re-)Generate certificate."""
+
+        command = [self.acme_tiny_path]
+        if self.use_chain:
+            command.append('--chain')
+        command.extend(['--account-key', self.accountkey_path])
+        if self.csr_content is not None:
+            # We need to temporarily write the CSR to disk
+            fd, tmpsrc = tempfile.mkstemp()
+            self.module.add_cleanup_file(tmpsrc)  # Ansible will delete the file on exit
+            f = os.fdopen(fd, 'wb')
+            try:
+                f.write(self.csr_content)
+            except Exception as err:
+                try:
+                    f.close()
+                except Exception as dummy:
+                    pass
+                self.module.fail_json(
+                    msg="failed to create temporary CSR file: %s" % to_native(err),
+                    exception=traceback.format_exc()
+                )
+            f.close()
+            command.extend(['--csr', tmpsrc])
+        else:
+            command.extend(['--csr', self.csr_path])
+        command.extend(['--acme-dir', self.challenge_path])
+        command.extend(['--directory-url', self.acme_directory])
+
+        try:
+            self.cert = to_bytes(self.module.run_command(command, check_rc=True)[1])
+        except OSError as exc:
+            raise CertificateError(exc)
+
+    def get_certificate_data(self):
+        """Return bytes for self.cert."""
+        return self.cert
+
+    def dump(self, include_certificate):
+        result = super(AcmeCertificateBackend, self).dump(include_certificate)
+        result['accountkey'] = self.accountkey_path
+        return result
+
+
+class AcmeCertificateProvider(CertificateProvider):
+    def validate_module_args(self, module):
+        if module.params['acme_accountkey_path'] is None:
+            module.fail_json(msg='The acme_accountkey_path option must be specified for the acme provider.')
+        if module.params['acme_challenge_path'] is None:
+            module.fail_json(msg='The acme_challenge_path option must be specified for the acme provider.')
+
+    def needs_version_two_certs(self, module):
+        return False
+
+    def create_backend(self, module, backend):
+        return AcmeCertificateBackend(module, backend)
+
+
+def add_acme_provider_to_argument_spec(argument_spec):
+    argument_spec.argument_spec['provider']['choices'].append('acme')
+    argument_spec.argument_spec.update(dict(
+        acme_accountkey_path=dict(type='path'),
+        acme_challenge_path=dict(type='path'),
+        acme_chain=dict(type='bool', default=False),
+        acme_directory=dict(type='str', default="https://acme-v02.api.letsencrypt.org/directory"),
+    ))

plugins/module_utils/crypto/module_backends/certificate_assertonly.py

@@ -0,0 +1,664 @@
+# -*- coding: utf-8 -*-
+
+# Copyright: (c) 2016-2017, Yanis Guenane <yanis+ansible@guenane.org>
+# Copyright: (c) 2017, Markus Teufelberger <mteufelberger+ansible@mgit.at>
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+
+from __future__ import absolute_import, division, print_function
+__metaclass__ = type
+
+
+import abc
+import datetime
+
+from ansible.module_utils._text import to_native, to_bytes, to_text
+
+from ansible_collections.community.crypto.plugins.module_utils.crypto.support import (
+    parse_name_field,
+    get_relative_time_option,
+)
+
+from ansible_collections.community.crypto.plugins.module_utils.crypto.cryptography_support import (
+    cryptography_compare_public_keys,
+    cryptography_get_name,
+    cryptography_name_to_oid,
+    cryptography_parse_key_usage_params,
+)
+
+from ansible_collections.community.crypto.plugins.module_utils.crypto.pyopenssl_support import (
+    pyopenssl_normalize_name_attribute,
+)
+
+from ansible_collections.community.crypto.plugins.module_utils.crypto.module_backends.certificate import (
+    CertificateBackend,
+    CertificateProvider,
+)
+
+try:
+    import OpenSSL
+    from OpenSSL import crypto
+except ImportError:
+    pass
+
+try:
+    import cryptography
+    from cryptography import x509
+    from cryptography.x509 import NameAttribute, Name
+except ImportError:
+    pass
+
+
+def compare_sets(subset, superset, equality=False):
+    if equality:
+        return set(subset) == set(superset)
+    else:
+        return all(x in superset for x in subset)
+
+
+def compare_dicts(subset, superset, equality=False):
+    if equality:
+        return subset == superset
+    else:
+        return all(superset.get(x) == v for x, v in subset.items())
+
+
+NO_EXTENSION = 'no extension'
+
+
+class AssertOnlyCertificateBackend(CertificateBackend):
+    def __init__(self, module, backend):
+        super(AssertOnlyCertificateBackend, self).__init__(module, backend)
+
+        self.signature_algorithms = module.params['signature_algorithms']
+        if module.params['subject']:
+            self.subject = parse_name_field(module.params['subject'])
+        else:
+            self.subject = []
+        self.subject_strict = module.params['subject_strict']
+        if module.params['issuer']:
+            self.issuer = parse_name_field(module.params['issuer'])
+        else:
+            self.issuer = []
+        self.issuer_strict = module.params['issuer_strict']
+        self.has_expired = module.params['has_expired']
+        self.version = module.params['version']
+        self.key_usage = module.params['key_usage']
+        self.key_usage_strict = module.params['key_usage_strict']
+        self.extended_key_usage = module.params['extended_key_usage']
+        self.extended_key_usage_strict = module.params['extended_key_usage_strict']
+        self.subject_alt_name = module.params['subject_alt_name']
+        self.subject_alt_name_strict = module.params['subject_alt_name_strict']
+        self.not_before = module.params['not_before']
+        self.not_after = module.params['not_after']
+        self.valid_at = module.params['valid_at']
+        self.invalid_at = module.params['invalid_at']
+        self.valid_in = module.params['valid_in']
+        if self.valid_in and not self.valid_in.startswith("+") and not self.valid_in.startswith("-"):
+            try:
+                int(self.valid_in)
+            except ValueError:
+                module.fail_json(msg='The supplied value for "valid_in" (%s) is not an integer or a valid timespec' % self.valid_in)
+            self.valid_in = "+" + self.valid_in + "s"
+
+        # Load objects
+        self._ensure_private_key_loaded()
+        self._ensure_csr_loaded()
+
+    @abc.abstractmethod
+    def _validate_privatekey(self):
+        pass
+
+    @abc.abstractmethod
+    def _validate_csr_signature(self):
+        pass
+
+    @abc.abstractmethod
+    def _validate_csr_subject(self):
+        pass
+
+    @abc.abstractmethod
+    def _validate_csr_extensions(self):
+        pass
+
+    @abc.abstractmethod
+    def _validate_signature_algorithms(self):
+        pass
+
+    @abc.abstractmethod
+    def _validate_subject(self):
+        pass
+
+    @abc.abstractmethod
+    def _validate_issuer(self):
+        pass
+
+    @abc.abstractmethod
+    def _validate_has_expired(self):
+        pass
+
+    @abc.abstractmethod
+    def _validate_version(self):
+        pass
+
+    @abc.abstractmethod
+    def _validate_key_usage(self):
+        pass
+
+    @abc.abstractmethod
+    def _validate_extended_key_usage(self):
+        pass
+
+    @abc.abstractmethod
+    def _validate_subject_alt_name(self):
+        pass
+
+    @abc.abstractmethod
+    def _validate_not_before(self):
+        pass
+
+    @abc.abstractmethod
+    def _validate_not_after(self):
+        pass
+
+    @abc.abstractmethod
+    def _validate_valid_at(self):
+        pass
+
+    @abc.abstractmethod
+    def _validate_invalid_at(self):
+        pass
+
+    @abc.abstractmethod
+    def _validate_valid_in(self):
+        pass
+
+    def assertonly(self):
+        messages = []
+        if self.privatekey_path is not None or self.privatekey_content is not None:
+            if not self._validate_privatekey():
+                messages.append(
+                    'Certificate %s and private key %s do not match' %
+                    (self.path, self.privatekey_path or '(provided in module options)')
+                )
+
+        if self.csr_path is not None or self.csr_content is not None:
+            if not self._validate_csr_signature():
+                messages.append(
+                    'Certificate %s and CSR %s do not match: private key mismatch' %
+                    (self.path, self.csr_path or '(provided in module options)')
+                )
+            if not self._validate_csr_subject():
+                messages.append(
+                    'Certificate %s and CSR %s do not match: subject mismatch' %
+                    (self.path, self.csr_path or '(provided in module options)')
+                )
+            if not self._validate_csr_extensions():
+                messages.append(
+                    'Certificate %s and CSR %s do not match: extensions mismatch' %
+                    (self.path, self.csr_path or '(provided in module options)')
+                )
+
+        if self.signature_algorithms is not None:
+            wrong_alg = self._validate_signature_algorithms()
+            if wrong_alg:
+                messages.append(
+                    'Invalid signature algorithm (got %s, expected one of %s)' %
+                    (wrong_alg, self.signature_algorithms)
+                )
+
+        if self.subject is not None:
+            failure = self._validate_subject()
+            if failure:
+                dummy, cert_subject = failure
+                messages.append(
+                    'Invalid subject component (got %s, expected all of %s to be present)' %
+                    (cert_subject, self.subject)
+                )
+
+        if self.issuer is not None:
+            failure = self._validate_issuer()
+            if failure:
+                dummy, cert_issuer = failure
+                messages.append(
+                    'Invalid issuer component (got %s, expected all of %s to be present)' % (cert_issuer, self.issuer)
+                )
+
+        if self.has_expired is not None:
+            cert_expired = self._validate_has_expired()
+            if cert_expired != self.has_expired:
+                messages.append(
+                    'Certificate expiration check failed (certificate expiration is %s, expected %s)' %
+                    (cert_expired, self.has_expired)
+                )
+
+        if self.version is not None:
+            cert_version = self._validate_version()
+            if cert_version != self.version:
+                messages.append(
+                    'Invalid certificate version number (got %s, expected %s)' %
+                    (cert_version, self.version)
+                )
+
+        if self.key_usage is not None:
+            failure = self._validate_key_usage()
+            if failure == NO_EXTENSION:
+                messages.append('Found no keyUsage extension')
+            elif failure:
+                dummy, cert_key_usage = failure
+                messages.append(
+                    'Invalid keyUsage components (got %s, expected all of %s to be present)' %
+                    (cert_key_usage, self.key_usage)
+                )
+
+        if self.extended_key_usage is not None:
+            failure = self._validate_extended_key_usage()
+            if failure == NO_EXTENSION:
+                messages.append('Found no extendedKeyUsage extension')
+            elif failure:
+                dummy, ext_cert_key_usage = failure
+                messages.append(
+                    'Invalid extendedKeyUsage component (got %s, expected all of %s to be present)' % (ext_cert_key_usage, self.extended_key_usage)
+                )
+
+        if self.subject_alt_name is not None:
+            failure = self._validate_subject_alt_name()
+            if failure == NO_EXTENSION:
+                messages.append('Found no subjectAltName extension')
+            elif failure:
+                dummy, cert_san = failure
+                messages.append(
+                    'Invalid subjectAltName component (got %s, expected all of %s to be present)' %
+                    (cert_san, self.subject_alt_name)
+                )
+
+        if self.not_before is not None:
+            cert_not_valid_before = self._validate_not_before()
+            if cert_not_valid_before != get_relative_time_option(self.not_before, 'not_before', backend=self.backend):
+                messages.append(
+                    'Invalid not_before component (got %s, expected %s to be present)' %
+                    (cert_not_valid_before, self.not_before)
+                )
+
+        if self.not_after is not None:
+            cert_not_valid_after = self._validate_not_after()
+            if cert_not_valid_after != get_relative_time_option(self.not_after, 'not_after', backend=self.backend):
+                messages.append(
+                    'Invalid not_after component (got %s, expected %s to be present)' %
+                    (cert_not_valid_after, self.not_after)
+                )
+
+        if self.valid_at is not None:
+            not_before, valid_at, not_after = self._validate_valid_at()
+            if not (not_before <= valid_at <= not_after):
+                messages.append(
+                    'Certificate is not valid for the specified date (%s) - not_before: %s - not_after: %s' %
+                    (self.valid_at, not_before, not_after)
+                )
+
+        if self.invalid_at is not None:
+            not_before, invalid_at, not_after = self._validate_invalid_at()
+            if not_before <= invalid_at <= not_after:
+                messages.append(
+                    'Certificate is not invalid for the specified date (%s) - not_before: %s - not_after: %s' %
+                    (self.invalid_at, not_before, not_after)
+                )
+
+        if self.valid_in is not None:
+            not_before, valid_in, not_after = self._validate_valid_in()
+            if not not_before <= valid_in <= not_after:
+                messages.append(
+                    'Certificate is not valid in %s from now (that would be %s) - not_before: %s - not_after: %s' %
+                    (self.valid_in, valid_in, not_before, not_after)
+                )
+        return messages
+
+    def needs_regeneration(self):
+        self._ensure_existing_certificate_loaded()
+        if self.existing_certificate is None:
+            self.messages = ['Certificate not provided']
+        else:
+            self.messages = self.assertonly()
+
+        return len(self.messages) != 0
+
+    def generate_certificate(self):
+        self.module.fail_json(msg=' | '.join(self.messages))
+
+    def get_certificate_data(self):
+        return self.existing_certificate_bytes
+
+
+class AssertOnlyCertificateBackendCryptography(AssertOnlyCertificateBackend):
+    """Validate the supplied cert, using the cryptography backend"""
+    def __init__(self, module):
+        super(AssertOnlyCertificateBackendCryptography, self).__init__(module, 'cryptography')
+
+    def _validate_privatekey(self):
+        return cryptography_compare_public_keys(self.existing_certificate.public_key(), self.privatekey.public_key())
+
+    def _validate_csr_signature(self):
+        if not self.csr.is_signature_valid:
+            return False
+        return cryptography_compare_public_keys(self.csr.public_key(), self.existing_certificate.public_key())
+
+    def _validate_csr_subject(self):
+        return self.csr.subject == self.existing_certificate.subject
+
+    def _validate_csr_extensions(self):
+        cert_exts = self.existing_certificate.extensions
+        csr_exts = self.csr.extensions
+        if len(cert_exts) != len(csr_exts):
+            return False
+        for cert_ext in cert_exts:
+            try:
+                csr_ext = csr_exts.get_extension_for_oid(cert_ext.oid)
+                if cert_ext != csr_ext:
+                    return False
+            except cryptography.x509.ExtensionNotFound as dummy:
+                return False
+        return True
+
+    def _validate_signature_algorithms(self):
+        if self.existing_certificate.signature_algorithm_oid._name not in self.signature_algorithms:
+            return self.existing_certificate.signature_algorithm_oid._name
+
+    def _validate_subject(self):
+        expected_subject = Name([NameAttribute(oid=cryptography_name_to_oid(sub[0]), value=to_text(sub[1]))
+                                 for sub in self.subject])
+        cert_subject = self.existing_certificate.subject
+        if not compare_sets(expected_subject, cert_subject, self.subject_strict):
+            return expected_subject, cert_subject
+
+    def _validate_issuer(self):
+        expected_issuer = Name([NameAttribute(oid=cryptography_name_to_oid(iss[0]), value=to_text(iss[1]))
+                                for iss in self.issuer])
+        cert_issuer = self.existing_certificate.issuer
+        if not compare_sets(expected_issuer, cert_issuer, self.issuer_strict):
+            return self.issuer, cert_issuer
+
+    def _validate_has_expired(self):
+        cert_not_after = self.existing_certificate.not_valid_after
+        cert_expired = cert_not_after < datetime.datetime.utcnow()
+        return cert_expired
+
+    def _validate_version(self):
+        if self.existing_certificate.version == x509.Version.v1:
+            return 1
+        if self.existing_certificate.version == x509.Version.v3:
+            return 3
+        return "unknown"
+
+    def _validate_key_usage(self):
+        try:
+            current_key_usage = self.existing_certificate.extensions.get_extension_for_class(x509.KeyUsage).value
+            test_key_usage = dict(
+                digital_signature=current_key_usage.digital_signature,
+                content_commitment=current_key_usage.content_commitment,
+                key_encipherment=current_key_usage.key_encipherment,
+                data_encipherment=current_key_usage.data_encipherment,
+                key_agreement=current_key_usage.key_agreement,
+                key_cert_sign=current_key_usage.key_cert_sign,
+                crl_sign=current_key_usage.crl_sign,
+                encipher_only=False,
+                decipher_only=False
+            )
+            if test_key_usage['key_agreement']:
+                test_key_usage.update(dict(
+                    encipher_only=current_key_usage.encipher_only,
+                    decipher_only=current_key_usage.decipher_only
+                ))
+
+            key_usages = cryptography_parse_key_usage_params(self.key_usage)
+            if not compare_dicts(key_usages, test_key_usage, self.key_usage_strict):
+                return self.key_usage, [k for k, v in test_key_usage.items() if v is True]
+
+        except cryptography.x509.ExtensionNotFound:
+            # This is only bad if the user specified a non-empty list
+            if self.key_usage:
+                return NO_EXTENSION
+
+    def _validate_extended_key_usage(self):
+        try:
+            current_ext_keyusage = self.existing_certificate.extensions.get_extension_for_class(x509.ExtendedKeyUsage).value
+            usages = [cryptography_name_to_oid(usage) for usage in self.extended_key_usage]
+            expected_ext_keyusage = x509.ExtendedKeyUsage(usages)
+            if not compare_sets(expected_ext_keyusage, current_ext_keyusage, self.extended_key_usage_strict):
+                return [eku.value for eku in expected_ext_keyusage], [eku.value for eku in current_ext_keyusage]
+
+        except cryptography.x509.ExtensionNotFound:
+            # This is only bad if the user specified a non-empty list
+            if self.extended_key_usage:
+                return NO_EXTENSION
+
+    def _validate_subject_alt_name(self):
+        try:
+            current_san = self.existing_certificate.extensions.get_extension_for_class(x509.SubjectAlternativeName).value
+            expected_san = [cryptography_get_name(san) for san in self.subject_alt_name]
+            if not compare_sets(expected_san, current_san, self.subject_alt_name_strict):
+                return self.subject_alt_name, current_san
+        except cryptography.x509.ExtensionNotFound:
+            # This is only bad if the user specified a non-empty list
+            if self.subject_alt_name:
+                return NO_EXTENSION
+
+    def _validate_not_before(self):
+        return self.existing_certificate.not_valid_before
+
+    def _validate_not_after(self):
+        return self.existing_certificate.not_valid_after
+
+    def _validate_valid_at(self):
+        rt = get_relative_time_option(self.valid_at, 'valid_at', backend=self.backend)
+        return self.existing_certificate.not_valid_before, rt, self.existing_certificate.not_valid_after
+
+    def _validate_invalid_at(self):
+        rt = get_relative_time_option(self.invalid_at, 'invalid_at', backend=self.backend)
+        return self.existing_certificate.not_valid_before, rt, self.existing_certificate.not_valid_after
+
+    def _validate_valid_in(self):
+        valid_in_date = get_relative_time_option(self.valid_in, "valid_in", backend=self.backend)
+        return self.existing_certificate.not_valid_before, valid_in_date, self.existing_certificate.not_valid_after
+
+
+class AssertOnlyCertificateBackendPyOpenSSL(AssertOnlyCertificateBackend):
+    """validate the supplied certificate."""
+
+    def __init__(self, module):
+        super(AssertOnlyCertificateBackendPyOpenSSL, self).__init__(module, 'pyopenssl')
+
+        # Ensure inputs are properly sanitized before comparison.
+        for param in ['signature_algorithms', 'key_usage', 'extended_key_usage',
+                      'subject_alt_name', 'subject', 'issuer', 'not_before',
+                      'not_after', 'valid_at', 'invalid_at']:
+            attr = getattr(self, param)
+            if isinstance(attr, list) and attr:
+                if isinstance(attr[0], str):
+                    setattr(self, param, [to_bytes(item) for item in attr])
+                elif isinstance(attr[0], tuple):
+                    setattr(self, param, [(to_bytes(item[0]), to_bytes(item[1])) for item in attr])
+            elif isinstance(attr, tuple):
+                setattr(self, param, dict((to_bytes(k), to_bytes(v)) for (k, v) in attr.items()))
+            elif isinstance(attr, dict):
+                setattr(self, param, dict((to_bytes(k), to_bytes(v)) for (k, v) in attr.items()))
+            elif isinstance(attr, str):
+                setattr(self, param, to_bytes(attr))
+
+    def _validate_privatekey(self):
+        ctx = OpenSSL.SSL.Context(OpenSSL.SSL.TLSv1_2_METHOD)
+        ctx.use_privatekey(self.privatekey)
+        ctx.use_certificate(self.existing_certificate)
+        try:
+            ctx.check_privatekey()
+            return True
+        except OpenSSL.SSL.Error:
+            return False
+
+    def _validate_csr_signature(self):
+        try:
+            self.csr.verify(self.existing_certificate.get_pubkey())
+        except OpenSSL.crypto.Error:
+            return False
+
+    def _validate_csr_subject(self):
+        if self.csr.get_subject() != self.existing_certificate.get_subject():
+            return False
+
+    def _validate_csr_extensions(self):
+        csr_extensions = self.csr.get_extensions()
+        cert_extension_count = self.existing_certificate.get_extension_count()
+        if len(csr_extensions) != cert_extension_count:
+            return False
+        for extension_number in range(0, cert_extension_count):
+            cert_extension = self.existing_certificate.get_extension(extension_number)
+            csr_extension = filter(lambda extension: extension.get_short_name() == cert_extension.get_short_name(), csr_extensions)
+            if cert_extension.get_data() != list(csr_extension)[0].get_data():
+                return False
+        return True
+
+    def _validate_signature_algorithms(self):
+        if self.existing_certificate.get_signature_algorithm() not in self.signature_algorithms:
+            return self.existing_certificate.get_signature_algorithm()
+
+    def _validate_subject(self):
+        expected_subject = [(OpenSSL._util.lib.OBJ_txt2nid(sub[0]), sub[1]) for sub in self.subject]
+        cert_subject = self.existing_certificate.get_subject().get_components()
+        current_subject = [(OpenSSL._util.lib.OBJ_txt2nid(sub[0]), sub[1]) for sub in cert_subject]
+        if not compare_sets(expected_subject, current_subject, self.subject_strict):
+            return expected_subject, current_subject
+
+    def _validate_issuer(self):
+        expected_issuer = [(OpenSSL._util.lib.OBJ_txt2nid(iss[0]), iss[1]) for iss in self.issuer]
+        cert_issuer = self.existing_certificate.get_issuer().get_components()
+        current_issuer = [(OpenSSL._util.lib.OBJ_txt2nid(iss[0]), iss[1]) for iss in cert_issuer]
+        if not compare_sets(expected_issuer, current_issuer, self.issuer_strict):
+            return self.issuer, cert_issuer
+
+    def _validate_has_expired(self):
+        # The following 3 lines are the same as the current PyOpenSSL code for cert.has_expired().
+        # Older version of PyOpenSSL have a buggy implementation,
+        # to avoid issues with those we added the code from a more recent release here.
+
+        time_string = to_native(self.existing_certificate.get_notAfter())
+        not_after = datetime.datetime.strptime(time_string, "%Y%m%d%H%M%SZ")
+        cert_expired = not_after < datetime.datetime.utcnow()
+        return cert_expired
+
+    def _validate_version(self):
+        # Version numbers in certs are off by one:
+        # v1: 0, v2: 1, v3: 2 ...
+        return self.existing_certificate.get_version() + 1
+
+    def _validate_key_usage(self):
+        found = False
+        for extension_idx in range(0, self.existing_certificate.get_extension_count()):
+            extension = self.existing_certificate.get_extension(extension_idx)
+            if extension.get_short_name() == b'keyUsage':
+                found = True
+                expected_extension = crypto.X509Extension(b"keyUsage", False, b', '.join(self.key_usage))
+                key_usage = [usage.strip() for usage in to_text(expected_extension, errors='surrogate_or_strict').split(',')]
+                current_ku = [usage.strip() for usage in to_text(extension, errors='surrogate_or_strict').split(',')]
+                if not compare_sets(key_usage, current_ku, self.key_usage_strict):
+                    return self.key_usage, str(extension).split(', ')
+        if not found:
+            # This is only bad if the user specified a non-empty list
+            if self.key_usage:
+                return NO_EXTENSION
+
+    def _validate_extended_key_usage(self):
+        found = False
+        for extension_idx in range(0, self.existing_certificate.get_extension_count()):
+            extension = self.existing_certificate.get_extension(extension_idx)
+            if extension.get_short_name() == b'extendedKeyUsage':
+                found = True
+                extKeyUsage = [OpenSSL._util.lib.OBJ_txt2nid(keyUsage) for keyUsage in self.extended_key_usage]
+                current_xku = [OpenSSL._util.lib.OBJ_txt2nid(usage.strip()) for usage in
+                               to_bytes(extension, errors='surrogate_or_strict').split(b',')]
+                if not compare_sets(extKeyUsage, current_xku, self.extended_key_usage_strict):
+                    return self.extended_key_usage, str(extension).split(', ')
+        if not found:
+            # This is only bad if the user specified a non-empty list
+            if self.extended_key_usage:
+                return NO_EXTENSION
+
+    def _validate_subject_alt_name(self):
+        found = False
+        for extension_idx in range(0, self.existing_certificate.get_extension_count()):
+            extension = self.existing_certificate.get_extension(extension_idx)
+            if extension.get_short_name() == b'subjectAltName':
+                found = True
+                l_altnames = [pyopenssl_normalize_name_attribute(altname.strip()) for altname in
+                              to_text(extension, errors='surrogate_or_strict').split(', ')]
+                sans = [pyopenssl_normalize_name_attribute(to_text(san, errors='surrogate_or_strict')) for san in self.subject_alt_name]
+                if not compare_sets(sans, l_altnames, self.subject_alt_name_strict):
+                    return self.subject_alt_name, l_altnames
+        if not found:
+            # This is only bad if the user specified a non-empty list
+            if self.subject_alt_name:
+                return NO_EXTENSION
+
+    def _validate_not_before(self):
+        return self.existing_certificate.get_notBefore()
+
+    def _validate_not_after(self):
+        return self.existing_certificate.get_notAfter()
+
+    def _validate_valid_at(self):
+        rt = get_relative_time_option(self.valid_at, "valid_at", backend=self.backend)
+        rt = to_bytes(rt, errors='surrogate_or_strict')
+        return self.existing_certificate.get_notBefore(), rt, self.existing_certificate.get_notAfter()
+
+    def _validate_invalid_at(self):
+        rt = get_relative_time_option(self.invalid_at, "invalid_at", backend=self.backend)
+        rt = to_bytes(rt, errors='surrogate_or_strict')
+        return self.existing_certificate.get_notBefore(), rt, self.existing_certificate.get_notAfter()
+
+    def _validate_valid_in(self):
+        valid_in_asn1 = get_relative_time_option(self.valid_in, "valid_in", backend=self.backend)
+        valid_in_date = to_bytes(valid_in_asn1, errors='surrogate_or_strict')
+        return self.existing_certificate.get_notBefore(), valid_in_date, self.existing_certificate.get_notAfter()
+
+
+class AssertOnlyCertificateProvider(CertificateProvider):
+    def validate_module_args(self, module):
+        module.deprecate("The 'assertonly' provider is deprecated; please see the examples of "
+                         "the 'x509_certificate' module on how to replace it with other modules",
+                         version='2.0.0', collection_name='community.crypto')
+
+    def needs_version_two_certs(self, module):
+        return False
+
+    def create_backend(self, module, backend):
+        if backend == 'cryptography':
+            return AssertOnlyCertificateBackendCryptography(module)
+        if backend == 'pyopenssl':
+            return AssertOnlyCertificateBackendPyOpenSSL(module)
+
+
+def add_assertonly_provider_to_argument_spec(argument_spec):
+    argument_spec.argument_spec['provider']['choices'].append('assertonly')
+    argument_spec.argument_spec.update(dict(
+        signature_algorithms=dict(type='list', elements='str', removed_in_version='2.0.0', removed_from_collection='community.crypto'),
+        subject=dict(type='dict', removed_in_version='2.0.0', removed_from_collection='community.crypto'),
+        subject_strict=dict(type='bool', default=False, removed_in_version='2.0.0', removed_from_collection='community.crypto'),
+        issuer=dict(type='dict', removed_in_version='2.0.0', removed_from_collection='community.crypto'),
+        issuer_strict=dict(type='bool', default=False, removed_in_version='2.0.0', removed_from_collection='community.crypto'),
+        has_expired=dict(type='bool', default=False, removed_in_version='2.0.0', removed_from_collection='community.crypto'),
+        version=dict(type='int', removed_in_version='2.0.0', removed_from_collection='community.crypto'),
+        key_usage=dict(type='list', elements='str', aliases=['keyUsage'],
+                       removed_in_version='2.0.0', removed_from_collection='community.crypto'),
+        key_usage_strict=dict(type='bool', default=False, aliases=['keyUsage_strict'],
+                              removed_in_version='2.0.0', removed_from_collection='community.crypto'),
+        extended_key_usage=dict(type='list', elements='str', aliases=['extendedKeyUsage'],
+                                removed_in_version='2.0.0', removed_from_collection='community.crypto'),
+        extended_key_usage_strict=dict(type='bool', default=False, aliases=['extendedKeyUsage_strict'],
+                                       removed_in_version='2.0.0', removed_from_collection='community.crypto'),
+        subject_alt_name=dict(type='list', elements='str', aliases=['subjectAltName'],
+                              removed_in_version='2.0.0', removed_from_collection='community.crypto'),
+        subject_alt_name_strict=dict(type='bool', default=False, aliases=['subjectAltName_strict'],
+                                     removed_in_version='2.0.0', removed_from_collection='community.crypto'),
+        not_before=dict(type='str', aliases=['notBefore'], removed_in_version='2.0.0', removed_from_collection='community.crypto'),
+        not_after=dict(type='str', aliases=['notAfter'], removed_in_version='2.0.0', removed_from_collection='community.crypto'),
+        valid_at=dict(type='str', removed_in_version='2.0.0', removed_from_collection='community.crypto'),
+        invalid_at=dict(type='str', removed_in_version='2.0.0', removed_from_collection='community.crypto'),
+        valid_in=dict(type='str', removed_in_version='2.0.0', removed_from_collection='community.crypto'),
+    ))

plugins/module_utils/crypto/module_backends/certificate_entrust.py

@@ -0,0 +1,225 @@
+# -*- coding: utf-8 -*-
+
+# Copyright: (c) 2016-2017, Yanis Guenane <yanis+ansible@guenane.org>
+# Copyright: (c) 2017, Markus Teufelberger <mteufelberger+ansible@mgit.at>
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+
+from __future__ import absolute_import, division, print_function
+__metaclass__ = type
+
+
+import datetime
+import time
+import os
+
+from ansible.module_utils._text import to_native, to_bytes
+
+from ansible_collections.community.crypto.plugins.module_utils.ecs.api import ECSClient, RestOperationException, SessionConfigurationException
+
+from ansible_collections.community.crypto.plugins.module_utils.crypto.support import (
+    load_certificate,
+    get_relative_time_option,
+)
+
+from ansible_collections.community.crypto.plugins.module_utils.crypto.cryptography_support import (
+    cryptography_serial_number_of_cert,
+)
+
+from ansible_collections.community.crypto.plugins.module_utils.crypto.module_backends.certificate import (
+    CertificateError,
+    CertificateBackend,
+    CertificateProvider,
+)
+
+try:
+    from cryptography.x509.oid import NameOID
+except ImportError:
+    pass
+
+
+class EntrustCertificateBackend(CertificateBackend):
+    def __init__(self, module, backend):
+        super(EntrustCertificateBackend, self).__init__(module, backend)
+        self.trackingId = None
+        self.notAfter = get_relative_time_option(module.params['entrust_not_after'], 'entrust_not_after', backend=self.backend)
+
+        if self.csr_content is None and self.csr_path is None:
+            raise CertificateError(
+                'csr_path or csr_content is required for entrust provider'
+            )
+        if self.csr_content is None and not os.path.exists(self.csr_path):
+            raise CertificateError(
+                'The certificate signing request file {0} does not exist'.format(self.csr_path)
+            )
+
+        self._ensure_csr_loaded()
+
+        # ECS API defaults to using the validated organization tied to the account.
+        # We want to always force behavior of trying to use the organization provided in the CSR.
+        # To that end we need to parse out the organization from the CSR.
+        self.csr_org = None
+        if self.backend == 'pyopenssl':
+            csr_subject = self.csr.get_subject()
+            csr_subject_components = csr_subject.get_components()
+            for k, v in csr_subject_components:
+                if k.upper() == 'O':
+                    # Entrust does not support multiple validated organizations in a single certificate
+                    if self.csr_org is not None:
+                        self.module.fail_json(msg=("Entrust provider does not currently support multiple validated organizations. Multiple organizations "
+                                                   "found in Subject DN: '{0}'. ".format(csr_subject)))
+                    else:
+                        self.csr_org = v
+        elif self.backend == 'cryptography':
+            csr_subject_orgs = self.csr.subject.get_attributes_for_oid(NameOID.ORGANIZATION_NAME)
+            if len(csr_subject_orgs) == 1:
+                self.csr_org = csr_subject_orgs[0].value
+            elif len(csr_subject_orgs) > 1:
+                self.module.fail_json(msg=("Entrust provider does not currently support multiple validated organizations. Multiple organizations found in "
+                                           "Subject DN: '{0}'. ".format(self.csr.subject)))
+        # If no organization in the CSR, explicitly tell ECS that it should be blank in issued cert, not defaulted to
+        # organization tied to the account.
+        if self.csr_org is None:
+            self.csr_org = ''
+
+        try:
+            self.ecs_client = ECSClient(
+                entrust_api_user=self.module.params['entrust_api_user'],
+                entrust_api_key=self.module.params['entrust_api_key'],
+                entrust_api_cert=self.module.params['entrust_api_client_cert_path'],
+                entrust_api_cert_key=self.module.params['entrust_api_client_cert_key_path'],
+                entrust_api_specification_path=self.module.params['entrust_api_specification_path']
+            )
+        except SessionConfigurationException as e:
+            module.fail_json(msg='Failed to initialize Entrust Provider: {0}'.format(to_native(e.message)))
+
+    def generate_certificate(self):
+        """(Re-)Generate certificate."""
+        body = {}
+
+        # Read the CSR that was generated for us
+        if self.csr_content is not None:
+            # csr_content contains bytes
+            body['csr'] = to_native(self.csr_content)
+        else:
+            with open(self.csr_path, 'r') as csr_file:
+                body['csr'] = csr_file.read()
+
+        body['certType'] = self.module.params['entrust_cert_type']
+
+        # Handle expiration (30 days if not specified)
+        expiry = self.notAfter
+        if not expiry:
+            gmt_now = datetime.datetime.fromtimestamp(time.mktime(time.gmtime()))
+            expiry = gmt_now + datetime.timedelta(days=365)
+
+        expiry_iso3339 = expiry.strftime("%Y-%m-%dT%H:%M:%S.00Z")
+        body['certExpiryDate'] = expiry_iso3339
+        body['org'] = self.csr_org
+        body['tracking'] = {
+            'requesterName': self.module.params['entrust_requester_name'],
+            'requesterEmail': self.module.params['entrust_requester_email'],
+            'requesterPhone': self.module.params['entrust_requester_phone'],
+        }
+
+        try:
+            result = self.ecs_client.NewCertRequest(Body=body)
+            self.trackingId = result.get('trackingId')
+        except RestOperationException as e:
+            self.module.fail_json(msg='Failed to request new certificate from Entrust Certificate Services (ECS): {0}'.format(to_native(e.message)))
+
+        self.cert_bytes = to_bytes(result.get('endEntityCert'))
+        self.cert = load_certificate(path=None, content=self.cert_bytes, backend=self.backend)
+
+    def get_certificate_data(self):
+        """Return bytes for self.cert."""
+        return self.cert_bytes
+
+    def needs_regeneration(self):
+        parent_check = super(EntrustCertificateBackend, self).needs_regeneration()
+
+        try:
+            cert_details = self._get_cert_details()
+        except RestOperationException as e:
+            self.module.fail_json(msg='Failed to get status of existing certificate from Entrust Certificate Services (ECS): {0}.'.format(to_native(e.message)))
+
+        # Always issue a new certificate if the certificate is expired, suspended or revoked
+        status = cert_details.get('status', False)
+        if status == 'EXPIRED' or status == 'SUSPENDED' or status == 'REVOKED':
+            return True
+
+        # If the requested cert type was specified and it is for a different certificate type than the initial certificate, a new one is needed
+        if self.module.params['entrust_cert_type'] and cert_details.get('certType') and self.module.params['entrust_cert_type'] != cert_details.get('certType'):
+            return True
+
+        return parent_check
+
+    def _get_cert_details(self):
+        cert_details = {}
+        try:
+            self._ensure_existing_certificate_loaded()
+        except Exception as dummy:
+            return
+        if self.existing_certificate:
+            serial_number = None
+            expiry = None
+            if self.backend == 'pyopenssl':
+                serial_number = "{0:X}".format(self.existing_certificate.get_serial_number())
+                time_string = to_native(self.existing_certificate.get_notAfter())
+                expiry = datetime.datetime.strptime(time_string, "%Y%m%d%H%M%SZ")
+            elif self.backend == 'cryptography':
+                serial_number = "{0:X}".format(cryptography_serial_number_of_cert(self.existing_certificate))
+                expiry = self.existing_certificate.not_valid_after
+
+            # get some information about the expiry of this certificate
+            expiry_iso3339 = expiry.strftime("%Y-%m-%dT%H:%M:%S.00Z")
+            cert_details['expiresAfter'] = expiry_iso3339
+
+            # If a trackingId is not already defined (from the result of a generate)
+            # use the serial number to identify the tracking Id
+            if self.trackingId is None and serial_number is not None:
+                cert_results = self.ecs_client.GetCertificates(serialNumber=serial_number).get('certificates', {})
+
+                # Finding 0 or more than 1 result is a very unlikely use case, it simply means we cannot perform additional checks
+                # on the 'state' as returned by Entrust Certificate Services (ECS). The general certificate validity is
+                # still checked as it is in the rest of the module.
+                if len(cert_results) == 1:
+                    self.trackingId = cert_results[0].get('trackingId')
+
+        if self.trackingId is not None:
+            cert_details.update(self.ecs_client.GetCertificate(trackingId=self.trackingId))
+
+        return cert_details
+
+
+class EntrustCertificateProvider(CertificateProvider):
+    def validate_module_args(self, module):
+        pass
+
+    def needs_version_two_certs(self, module):
+        return False
+
+    def create_backend(self, module, backend):
+        return EntrustCertificateBackend(module, backend)
+
+
+def add_entrust_provider_to_argument_spec(argument_spec):
+    argument_spec.argument_spec['provider']['choices'].append('entrust')
+    argument_spec.argument_spec.update(dict(
+        entrust_cert_type=dict(type='str', default='STANDARD_SSL',
+                               choices=['STANDARD_SSL', 'ADVANTAGE_SSL', 'UC_SSL', 'EV_SSL', 'WILDCARD_SSL',
+                                        'PRIVATE_SSL', 'PD_SSL', 'CDS_ENT_LITE', 'CDS_ENT_PRO', 'SMIME_ENT']),
+        entrust_requester_email=dict(type='str'),
+        entrust_requester_name=dict(type='str'),
+        entrust_requester_phone=dict(type='str'),
+        entrust_api_user=dict(type='str'),
+        entrust_api_key=dict(type='str', no_log=True),
+        entrust_api_client_cert_path=dict(type='path'),
+        entrust_api_client_cert_key_path=dict(type='path', no_log=True),
+        entrust_api_specification_path=dict(type='path', default='https://cloud.entrust.net/EntrustCloud/documentation/cms-api-2.1.0.yaml'),
+        entrust_not_after=dict(type='str', default='+365d'),
+    ))
+    argument_spec.required_if.append(
+        ['provider', 'entrust', ['entrust_requester_email', 'entrust_requester_name', 'entrust_requester_phone',
+                                 'entrust_api_user', 'entrust_api_key', 'entrust_api_client_cert_path',
+                                 'entrust_api_client_cert_key_path']]
+    )

plugins/module_utils/crypto/module_backends/certificate_ownca.py

@@ -0,0 +1,363 @@
+# -*- coding: utf-8 -*-
+
+# Copyright: (c) 2016-2017, Yanis Guenane <yanis+ansible@guenane.org>
+# Copyright: (c) 2017, Markus Teufelberger <mteufelberger+ansible@mgit.at>
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+
+from __future__ import absolute_import, division, print_function
+__metaclass__ = type
+
+
+import os
+
+from distutils.version import LooseVersion
+from random import randrange
+
+from ansible.module_utils._text import to_bytes
+
+from ansible_collections.community.crypto.plugins.module_utils.crypto.basic import (
+    OpenSSLBadPassphraseError,
+)
+
+from ansible_collections.community.crypto.plugins.module_utils.crypto.support import (
+    load_privatekey,
+    load_certificate,
+    get_relative_time_option,
+    select_message_digest,
+)
+
+from ansible_collections.community.crypto.plugins.module_utils.crypto.cryptography_support import (
+    cryptography_key_needs_digest_for_signing,
+    cryptography_serial_number_of_cert,
+)
+
+from ansible_collections.community.crypto.plugins.module_utils.crypto.module_backends.certificate import (
+    CRYPTOGRAPHY_VERSION,
+    CertificateError,
+    CertificateBackend,
+    CertificateProvider,
+)
+
+try:
+    from OpenSSL import crypto
+except ImportError:
+    pass
+
+try:
+    import cryptography
+    from cryptography import x509
+    from cryptography.hazmat.backends import default_backend
+    from cryptography.hazmat.primitives.serialization import Encoding
+except ImportError:
+    pass
+
+
+class OwnCACertificateBackendCryptography(CertificateBackend):
+    def __init__(self, module):
+        super(OwnCACertificateBackendCryptography, self).__init__(module, 'cryptography')
+
+        self.create_subject_key_identifier = module.params['ownca_create_subject_key_identifier']
+        self.create_authority_key_identifier = module.params['ownca_create_authority_key_identifier']
+        self.notBefore = get_relative_time_option(module.params['ownca_not_before'], 'ownca_not_before', backend=self.backend)
+        self.notAfter = get_relative_time_option(module.params['ownca_not_after'], 'ownca_not_after', backend=self.backend)
+        self.digest = select_message_digest(module.params['ownca_digest'])
+        self.version = module.params['ownca_version']
+        self.serial_number = x509.random_serial_number()
+        self.ca_cert_path = module.params['ownca_path']
+        self.ca_cert_content = module.params['ownca_content']
+        if self.ca_cert_content is not None:
+            self.ca_cert_content = self.ca_cert_content.encode('utf-8')
+        self.ca_privatekey_path = module.params['ownca_privatekey_path']
+        self.ca_privatekey_content = module.params['ownca_privatekey_content']
+        if self.ca_privatekey_content is not None:
+            self.ca_privatekey_content = self.ca_privatekey_content.encode('utf-8')
+        self.ca_privatekey_passphrase = module.params['ownca_privatekey_passphrase']
+
+        if self.csr_content is None and self.csr_path is None:
+            raise CertificateError(
+                'csr_path or csr_content is required for ownca provider'
+            )
+        if self.csr_content is None and not os.path.exists(self.csr_path):
+            raise CertificateError(
+                'The certificate signing request file {0} does not exist'.format(self.csr_path)
+            )
+        if self.ca_cert_content is None and not os.path.exists(self.ca_cert_path):
+            raise CertificateError(
+                'The CA certificate file {0} does not exist'.format(self.ca_cert_path)
+            )
+        if self.ca_privatekey_content is None and not os.path.exists(self.ca_privatekey_path):
+            raise CertificateError(
+                'The CA private key file {0} does not exist'.format(self.ca_privatekey_path)
+            )
+
+        self._ensure_csr_loaded()
+        self.ca_cert = load_certificate(
+            path=self.ca_cert_path,
+            content=self.ca_cert_content,
+            backend=self.backend
+        )
+        try:
+            self.ca_private_key = load_privatekey(
+                path=self.ca_privatekey_path,
+                content=self.ca_privatekey_content,
+                passphrase=self.ca_privatekey_passphrase,
+                backend=self.backend
+            )
+        except OpenSSLBadPassphraseError as exc:
+            module.fail_json(msg=str(exc))
+
+        if cryptography_key_needs_digest_for_signing(self.ca_private_key):
+            if self.digest is None:
+                raise CertificateError(
+                    'The digest %s is not supported with the cryptography backend' % module.params['ownca_digest']
+                )
+        else:
+            self.digest = None
+
+    def generate_certificate(self):
+        """(Re-)Generate certificate."""
+        cert_builder = x509.CertificateBuilder()
+        cert_builder = cert_builder.subject_name(self.csr.subject)
+        cert_builder = cert_builder.issuer_name(self.ca_cert.subject)
+        cert_builder = cert_builder.serial_number(self.serial_number)
+        cert_builder = cert_builder.not_valid_before(self.notBefore)
+        cert_builder = cert_builder.not_valid_after(self.notAfter)
+        cert_builder = cert_builder.public_key(self.csr.public_key())
+        has_ski = False
+        for extension in self.csr.extensions:
+            if isinstance(extension.value, x509.SubjectKeyIdentifier):
+                if self.create_subject_key_identifier == 'always_create':
+                    continue
+                has_ski = True
+            if self.create_authority_key_identifier and isinstance(extension.value, x509.AuthorityKeyIdentifier):
+                continue
+            cert_builder = cert_builder.add_extension(extension.value, critical=extension.critical)
+        if not has_ski and self.create_subject_key_identifier != 'never_create':
+            cert_builder = cert_builder.add_extension(
+                x509.SubjectKeyIdentifier.from_public_key(self.csr.public_key()),
+                critical=False
+            )
+        if self.create_authority_key_identifier:
+            try:
+                ext = self.ca_cert.extensions.get_extension_for_class(x509.SubjectKeyIdentifier)
+                cert_builder = cert_builder.add_extension(
+                    x509.AuthorityKeyIdentifier.from_issuer_subject_key_identifier(ext.value)
+                    if CRYPTOGRAPHY_VERSION >= LooseVersion('2.7') else
+                    x509.AuthorityKeyIdentifier.from_issuer_subject_key_identifier(ext),
+                    critical=False
+                )
+            except cryptography.x509.ExtensionNotFound:
+                cert_builder = cert_builder.add_extension(
+                    x509.AuthorityKeyIdentifier.from_issuer_public_key(self.ca_cert.public_key()),
+                    critical=False
+                )
+
+        try:
+            certificate = cert_builder.sign(
+                private_key=self.ca_private_key, algorithm=self.digest,
+                backend=default_backend()
+            )
+        except TypeError as e:
+            if str(e) == 'Algorithm must be a registered hash algorithm.' and self.digest is None:
+                self.module.fail_json(msg='Signing with Ed25519 and Ed448 keys requires cryptography 2.8 or newer.')
+            raise
+
+        self.cert = certificate
+
+    def get_certificate_data(self):
+        """Return bytes for self.cert."""
+        return self.cert.public_bytes(Encoding.PEM)
+
+    def needs_regeneration(self):
+        if super(OwnCACertificateBackendCryptography, self).needs_regeneration():
+            return True
+
+        # Check AuthorityKeyIdentifier
+        if self.create_authority_key_identifier:
+            try:
+                ext = self.ca_cert.extensions.get_extension_for_class(x509.SubjectKeyIdentifier)
+                expected_ext = (
+                    x509.AuthorityKeyIdentifier.from_issuer_subject_key_identifier(ext.value)
+                    if CRYPTOGRAPHY_VERSION >= LooseVersion('2.7') else
+                    x509.AuthorityKeyIdentifier.from_issuer_subject_key_identifier(ext)
+                )
+            except cryptography.x509.ExtensionNotFound:
+                expected_ext = x509.AuthorityKeyIdentifier.from_issuer_public_key(self.ca_cert.public_key())
+
+            self._ensure_existing_certificate_loaded()
+            try:
+                ext = self.existing_certificate.extensions.get_extension_for_class(x509.AuthorityKeyIdentifier)
+                if ext.value != expected_ext:
+                    return True
+            except cryptography.x509.ExtensionNotFound as dummy:
+                return True
+
+        return False
+
+    def dump(self, include_certificate):
+        result = super(OwnCACertificateBackendCryptography, self).dump(include_certificate)
+        result.update({
+            'ca_cert': self.ca_cert_path,
+            'ca_privatekey': self.ca_privatekey_path,
+        })
+
+        if self.module.check_mode:
+            result.update({
+                'notBefore': self.notBefore.strftime("%Y%m%d%H%M%SZ"),
+                'notAfter': self.notAfter.strftime("%Y%m%d%H%M%SZ"),
+                'serial_number': self.serial_number,
+            })
+        else:
+            if self.cert is None:
+                self.cert = self.existing_certificate
+            result.update({
+                'notBefore': self.cert.not_valid_before.strftime("%Y%m%d%H%M%SZ"),
+                'notAfter': self.cert.not_valid_after.strftime("%Y%m%d%H%M%SZ"),
+                'serial_number': cryptography_serial_number_of_cert(self.cert),
+            })
+
+        return result
+
+
+def generate_serial_number():
+    """Generate a serial number for a certificate"""
+    while True:
+        result = randrange(0, 1 << 160)
+        if result >= 1000:
+            return result
+
+
+class OwnCACertificateBackendPyOpenSSL(CertificateBackend):
+    def __init__(self, module):
+        super(OwnCACertificateBackendPyOpenSSL, self).__init__(module, 'pyopenssl')
+
+        self.notBefore = get_relative_time_option(self.module.params['ownca_not_before'], 'ownca_not_before', backend=self.backend)
+        self.notAfter = get_relative_time_option(self.module.params['ownca_not_after'], 'ownca_not_after', backend=self.backend)
+        self.digest = self.module.params['ownca_digest']
+        self.version = self.module.params['ownca_version']
+        self.serial_number = generate_serial_number()
+        if self.module.params['ownca_create_subject_key_identifier'] != 'create_if_not_provided':
+            self.module.fail_json(msg='ownca_create_subject_key_identifier cannot be used with the pyOpenSSL backend!')
+        if self.module.params['ownca_create_authority_key_identifier']:
+            self.module.warn('ownca_create_authority_key_identifier is ignored by the pyOpenSSL backend!')
+        self.ca_cert_path = self.module.params['ownca_path']
+        self.ca_cert_content = self.module.params['ownca_content']
+        if self.ca_cert_content is not None:
+            self.ca_cert_content = self.ca_cert_content.encode('utf-8')
+        self.ca_privatekey_path = self.module.params['ownca_privatekey_path']
+        self.ca_privatekey_content = self.module.params['ownca_privatekey_content']
+        if self.ca_privatekey_content is not None:
+            self.ca_privatekey_content = self.ca_privatekey_content.encode('utf-8')
+        self.ca_privatekey_passphrase = self.module.params['ownca_privatekey_passphrase']
+
+        if self.csr_content is None and not os.path.exists(self.csr_path):
+            raise CertificateError(
+                'The certificate signing request file {0} does not exist'.format(self.csr_path)
+            )
+        if self.ca_cert_content is None and not os.path.exists(self.ca_cert_path):
+            raise CertificateError(
+                'The CA certificate file {0} does not exist'.format(self.ca_cert_path)
+            )
+        if self.ca_privatekey_content is None and not os.path.exists(self.ca_privatekey_path):
+            raise CertificateError(
+                'The CA private key file {0} does not exist'.format(self.ca_privatekey_path)
+            )
+
+        self._ensure_csr_loaded()
+        self.ca_cert = load_certificate(
+            path=self.ca_cert_path,
+            content=self.ca_cert_content,
+        )
+        try:
+            self.ca_privatekey = load_privatekey(
+                path=self.ca_privatekey_path,
+                content=self.ca_privatekey_content,
+                passphrase=self.ca_privatekey_passphrase
+            )
+        except OpenSSLBadPassphraseError as exc:
+            self.module.fail_json(msg=str(exc))
+
+    def generate_certificate(self):
+        """(Re-)Generate certificate."""
+        cert = crypto.X509()
+        cert.set_serial_number(self.serial_number)
+        cert.set_notBefore(to_bytes(self.notBefore))
+        cert.set_notAfter(to_bytes(self.notAfter))
+        cert.set_subject(self.csr.get_subject())
+        cert.set_issuer(self.ca_cert.get_subject())
+        cert.set_version(self.version - 1)
+        cert.set_pubkey(self.csr.get_pubkey())
+        cert.add_extensions(self.csr.get_extensions())
+
+        cert.sign(self.ca_privatekey, self.digest)
+        self.cert = cert
+
+    def get_certificate_data(self):
+        """Return bytes for self.cert."""
+        return crypto.dump_certificate(crypto.FILETYPE_PEM, self.cert)
+
+    def dump(self, include_certificate):
+        result = super(OwnCACertificateBackendPyOpenSSL, self).dump(include_certificate)
+        result.update({
+            'ca_cert': self.ca_cert_path,
+            'ca_privatekey': self.ca_privatekey_path,
+        })
+
+        if self.module.check_mode:
+            result.update({
+                'notBefore': self.notBefore,
+                'notAfter': self.notAfter,
+                'serial_number': self.serial_number,
+            })
+        else:
+            if self.cert is None:
+                self.cert = self.existing_certificate
+            result.update({
+                'notBefore': self.cert.get_notBefore(),
+                'notAfter': self.cert.get_notAfter(),
+                'serial_number': self.cert.get_serial_number(),
+            })
+
+        return result
+
+
+class OwnCACertificateProvider(CertificateProvider):
+    def validate_module_args(self, module):
+        if module.params['ownca_path'] is None and module.params['ownca_content'] is None:
+            module.fail_json(msg='One of ownca_path and ownca_content must be specified for the ownca provider.')
+        if module.params['ownca_privatekey_path'] is None and module.params['ownca_privatekey_content'] is None:
+            module.fail_json(msg='One of ownca_privatekey_path and ownca_privatekey_content must be specified for the ownca provider.')
+
+    def needs_version_two_certs(self, module):
+        return module.params['ownca_version'] == 2
+
+    def create_backend(self, module, backend):
+        if backend == 'cryptography':
+            return OwnCACertificateBackendCryptography(module)
+        if backend == 'pyopenssl':
+            return OwnCACertificateBackendPyOpenSSL(module)
+
+
+def add_ownca_provider_to_argument_spec(argument_spec):
+    argument_spec.argument_spec['provider']['choices'].append('ownca')
+    argument_spec.argument_spec.update(dict(
+        ownca_path=dict(type='path'),
+        ownca_content=dict(type='str'),
+        ownca_privatekey_path=dict(type='path'),
+        ownca_privatekey_content=dict(type='str', no_log=True),
+        ownca_privatekey_passphrase=dict(type='str', no_log=True),
+        ownca_digest=dict(type='str', default='sha256'),
+        ownca_version=dict(type='int', default=3),
+        ownca_not_before=dict(type='str', default='+0s'),
+        ownca_not_after=dict(type='str', default='+3650d'),
+        ownca_create_subject_key_identifier=dict(
+            type='str',
+            default='create_if_not_provided',
+            choices=['create_if_not_provided', 'always_create', 'never_create']
+        ),
+        ownca_create_authority_key_identifier=dict(type='bool', default=True),
+    ))
+    argument_spec.mutually_exclusive.extend([
+        ['ownca_path', 'ownca_content'],
+        ['ownca_privatekey_path', 'ownca_privatekey_content'],
+    ])

plugins/module_utils/crypto/module_backends/certificate_selfsigned.py

@@ -0,0 +1,263 @@
+# -*- coding: utf-8 -*-
+
+# Copyright: (c) 2016-2017, Yanis Guenane <yanis+ansible@guenane.org>
+# Copyright: (c) 2017, Markus Teufelberger <mteufelberger+ansible@mgit.at>
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+
+from __future__ import absolute_import, division, print_function
+__metaclass__ = type
+
+
+import os
+
+from random import randrange
+
+from ansible.module_utils._text import to_bytes
+
+from ansible_collections.community.crypto.plugins.module_utils.crypto.support import (
+    get_relative_time_option,
+    select_message_digest,
+)
+
+from ansible_collections.community.crypto.plugins.module_utils.crypto.cryptography_support import (
+    cryptography_key_needs_digest_for_signing,
+    cryptography_serial_number_of_cert,
+)
+
+from ansible_collections.community.crypto.plugins.module_utils.crypto.module_backends.certificate import (
+    CertificateError,
+    CertificateBackend,
+    CertificateProvider,
+)
+
+try:
+    from OpenSSL import crypto
+except ImportError:
+    pass
+
+try:
+    import cryptography
+    from cryptography import x509
+    from cryptography.hazmat.backends import default_backend
+    from cryptography.hazmat.primitives.serialization import Encoding
+except ImportError:
+    pass
+
+
+class SelfSignedCertificateBackendCryptography(CertificateBackend):
+    def __init__(self, module):
+        super(SelfSignedCertificateBackendCryptography, self).__init__(module, 'cryptography')
+
+        self.create_subject_key_identifier = module.params['selfsigned_create_subject_key_identifier']
+        self.notBefore = get_relative_time_option(module.params['selfsigned_not_before'], 'selfsigned_not_before', backend=self.backend)
+        self.notAfter = get_relative_time_option(module.params['selfsigned_not_after'], 'selfsigned_not_after', backend=self.backend)
+        self.digest = select_message_digest(module.params['selfsigned_digest'])
+        self.version = module.params['selfsigned_version']
+        self.serial_number = x509.random_serial_number()
+
+        if self.csr_path is not None and not os.path.exists(self.csr_path):
+            raise CertificateError(
+                'The certificate signing request file {0} does not exist'.format(self.csr_path)
+            )
+        if self.privatekey_content is None and not os.path.exists(self.privatekey_path):
+            raise CertificateError(
+                'The private key file {0} does not exist'.format(self.privatekey_path)
+            )
+
+        self._module = module
+
+        self._ensure_private_key_loaded()
+
+        self._ensure_csr_loaded()
+        if self.csr is None:
+            # Create empty CSR on the fly
+            csr = cryptography.x509.CertificateSigningRequestBuilder()
+            csr = csr.subject_name(cryptography.x509.Name([]))
+            digest = None
+            if cryptography_key_needs_digest_for_signing(self.privatekey):
+                digest = self.digest
+                if digest is None:
+                    self.module.fail_json(msg='Unsupported digest "{0}"'.format(module.params['selfsigned_digest']))
+            try:
+                self.csr = csr.sign(self.privatekey, digest, default_backend())
+            except TypeError as e:
+                if str(e) == 'Algorithm must be a registered hash algorithm.' and digest is None:
+                    self.module.fail_json(msg='Signing with Ed25519 and Ed448 keys requires cryptography 2.8 or newer.')
+                raise
+
+        if cryptography_key_needs_digest_for_signing(self.privatekey):
+            if self.digest is None:
+                raise CertificateError(
+                    'The digest %s is not supported with the cryptography backend' % module.params['selfsigned_digest']
+                )
+        else:
+            self.digest = None
+
+    def generate_certificate(self):
+        """(Re-)Generate certificate."""
+        try:
+            cert_builder = x509.CertificateBuilder()
+            cert_builder = cert_builder.subject_name(self.csr.subject)
+            cert_builder = cert_builder.issuer_name(self.csr.subject)
+            cert_builder = cert_builder.serial_number(self.serial_number)
+            cert_builder = cert_builder.not_valid_before(self.notBefore)
+            cert_builder = cert_builder.not_valid_after(self.notAfter)
+            cert_builder = cert_builder.public_key(self.privatekey.public_key())
+            has_ski = False
+            for extension in self.csr.extensions:
+                if isinstance(extension.value, x509.SubjectKeyIdentifier):
+                    if self.create_subject_key_identifier == 'always_create':
+                        continue
+                    has_ski = True
+                cert_builder = cert_builder.add_extension(extension.value, critical=extension.critical)
+            if not has_ski and self.create_subject_key_identifier != 'never_create':
+                cert_builder = cert_builder.add_extension(
+                    x509.SubjectKeyIdentifier.from_public_key(self.privatekey.public_key()),
+                    critical=False
+                )
+        except ValueError as e:
+            raise CertificateError(str(e))
+
+        try:
+            certificate = cert_builder.sign(
+                private_key=self.privatekey, algorithm=self.digest,
+                backend=default_backend()
+            )
+        except TypeError as e:
+            if str(e) == 'Algorithm must be a registered hash algorithm.' and self.digest is None:
+                self.module.fail_json(msg='Signing with Ed25519 and Ed448 keys requires cryptography 2.8 or newer.')
+            raise
+
+        self.cert = certificate
+
+    def get_certificate_data(self):
+        """Return bytes for self.cert."""
+        return self.cert.public_bytes(Encoding.PEM)
+
+    def dump(self, include_certificate):
+        result = super(SelfSignedCertificateBackendCryptography, self).dump(include_certificate)
+
+        if self.module.check_mode:
+            result.update({
+                'notBefore': self.notBefore.strftime("%Y%m%d%H%M%SZ"),
+                'notAfter': self.notAfter.strftime("%Y%m%d%H%M%SZ"),
+                'serial_number': self.serial_number,
+            })
+        else:
+            if self.cert is None:
+                self.cert = self.existing_certificate
+            result.update({
+                'notBefore': self.cert.not_valid_before.strftime("%Y%m%d%H%M%SZ"),
+                'notAfter': self.cert.not_valid_after.strftime("%Y%m%d%H%M%SZ"),
+                'serial_number': cryptography_serial_number_of_cert(self.cert),
+            })
+
+        return result
+
+
+def generate_serial_number():
+    """Generate a serial number for a certificate"""
+    while True:
+        result = randrange(0, 1 << 160)
+        if result >= 1000:
+            return result
+
+
+class SelfSignedCertificateBackendPyOpenSSL(CertificateBackend):
+    def __init__(self, module):
+        super(SelfSignedCertificateBackendPyOpenSSL, self).__init__(module, 'pyopenssl')
+
+        if module.params['selfsigned_create_subject_key_identifier'] != 'create_if_not_provided':
+            module.fail_json(msg='selfsigned_create_subject_key_identifier cannot be used with the pyOpenSSL backend!')
+        self.notBefore = get_relative_time_option(module.params['selfsigned_not_before'], 'selfsigned_not_before', backend=self.backend)
+        self.notAfter = get_relative_time_option(module.params['selfsigned_not_after'], 'selfsigned_not_after', backend=self.backend)
+        self.digest = module.params['selfsigned_digest']
+        self.version = module.params['selfsigned_version']
+        self.serial_number = generate_serial_number()
+
+        if self.csr_path is not None and not os.path.exists(self.csr_path):
+            raise CertificateError(
+                'The certificate signing request file {0} does not exist'.format(self.csr_path)
+            )
+        if self.privatekey_content is None and not os.path.exists(self.privatekey_path):
+            raise CertificateError(
+                'The private key file {0} does not exist'.format(self.privatekey_path)
+            )
+
+        self._ensure_private_key_loaded()
+
+        self._ensure_csr_loaded()
+        if self.csr is None:
+            # Create empty CSR on the fly
+            self.csr = crypto.X509Req()
+            self.csr.set_pubkey(self.privatekey)
+            self.csr.sign(self.privatekey, self.digest)
+
+    def generate_certificate(self):
+        """(Re-)Generate certificate."""
+        cert = crypto.X509()
+        cert.set_serial_number(self.serial_number)
+        cert.set_notBefore(to_bytes(self.notBefore))
+        cert.set_notAfter(to_bytes(self.notAfter))
+        cert.set_subject(self.csr.get_subject())
+        cert.set_issuer(self.csr.get_subject())
+        cert.set_version(self.version - 1)
+        cert.set_pubkey(self.csr.get_pubkey())
+        cert.add_extensions(self.csr.get_extensions())
+
+        cert.sign(self.privatekey, self.digest)
+        self.cert = cert
+
+    def get_certificate_data(self):
+        """Return bytes for self.cert."""
+        return crypto.dump_certificate(crypto.FILETYPE_PEM, self.cert)
+
+    def dump(self, include_certificate):
+        result = super(SelfSignedCertificateBackendPyOpenSSL, self).dump(include_certificate)
+
+        if self.module.check_mode:
+            result.update({
+                'notBefore': self.notBefore,
+                'notAfter': self.notAfter,
+                'serial_number': self.serial_number,
+            })
+        else:
+            if self.cert is None:
+                self.cert = self.existing_certificate
+            result.update({
+                'notBefore': self.cert.get_notBefore(),
+                'notAfter': self.cert.get_notAfter(),
+                'serial_number': self.cert.get_serial_number(),
+            })
+
+        return result
+
+
+class SelfSignedCertificateProvider(CertificateProvider):
+    def validate_module_args(self, module):
+        if module.params['privatekey_path'] is None and module.params['privatekey_content'] is None:
+            module.fail_json(msg='One of privatekey_path and privatekey_content must be specified for the selfsigned provider.')
+
+    def needs_version_two_certs(self, module):
+        return module.params['selfsigned_version'] == 2
+
+    def create_backend(self, module, backend):
+        if backend == 'cryptography':
+            return SelfSignedCertificateBackendCryptography(module)
+        if backend == 'pyopenssl':
+            return SelfSignedCertificateBackendPyOpenSSL(module)
+
+
+def add_selfsigned_provider_to_argument_spec(argument_spec):
+    argument_spec.argument_spec['provider']['choices'].append('selfsigned')
+    argument_spec.argument_spec.update(dict(
+        selfsigned_version=dict(type='int', default=3),
+        selfsigned_digest=dict(type='str', default='sha256'),
+        selfsigned_not_before=dict(type='str', default='+0s', aliases=['selfsigned_notBefore']),
+        selfsigned_not_after=dict(type='str', default='+3650d', aliases=['selfsigned_notAfter']),
+        selfsigned_create_subject_key_identifier=dict(
+            type='str',
+            default='create_if_not_provided',
+            choices=['create_if_not_provided', 'always_create', 'never_create']
+        ),
+    ))

plugins/module_utils/crypto/module_backends/common.py

@@ -0,0 +1,34 @@
+# -*- coding: utf-8 -*-
+#
+# Copyright: (c) 2020, Felix Fontein <felix@fontein.de>
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+
+from __future__ import absolute_import, division, print_function
+__metaclass__ = type
+
+
+from ansible.module_utils.basic import AnsibleModule
+
+
+class ArgumentSpec:
+    def __init__(self, argument_spec, mutually_exclusive=None, required_together=None, required_one_of=None, required_if=None, required_by=None):
+        self.argument_spec = argument_spec
+        self.mutually_exclusive = mutually_exclusive or []
+        self.required_together = required_together or []
+        self.required_one_of = required_one_of or []
+        self.required_if = required_if or []
+        self.required_by = required_by or {}
+
+    def create_ansible_module_helper(self, clazz, args, **kwargs):
+        return clazz(
+            *args,
+            argument_spec=self.argument_spec,
+            mutually_exclusive=self.mutually_exclusive,
+            required_together=self.required_together,
+            required_one_of=self.required_one_of,
+            required_if=self.required_if,
+            required_by=self.required_by,
+            **kwargs)
+
+    def create_ansible_module(self, **kwargs):
+        return self.create_ansible_module_helper(AnsibleModule, (), **kwargs)

plugins/module_utils/crypto/module_backends/csr.py

@@ -0,0 +1,842 @@
+# -*- coding: utf-8 -*-
+#
+# Copyright: (c) 2016, Yanis Guenane <yanis+ansible@guenane.org>
+# Copyright: (c) 2020, Felix Fontein <felix@fontein.de>
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+
+from __future__ import absolute_import, division, print_function
+__metaclass__ = type
+
+
+import abc
+import binascii
+import traceback
+
+from distutils.version import LooseVersion
+
+from ansible.module_utils import six
+from ansible.module_utils.basic import missing_required_lib
+from ansible.module_utils._text import to_bytes, to_text
+
+from ansible_collections.community.crypto.plugins.module_utils.crypto.basic import (
+    OpenSSLObjectError,
+    OpenSSLBadPassphraseError,
+)
+
+from ansible_collections.community.crypto.plugins.module_utils.crypto.support import (
+    load_privatekey,
+    load_certificate_request,
+    parse_name_field,
+    select_message_digest,
+)
+
+from ansible_collections.community.crypto.plugins.module_utils.crypto.cryptography_support import (
+    cryptography_get_basic_constraints,
+    cryptography_get_name,
+    cryptography_name_to_oid,
+    cryptography_key_needs_digest_for_signing,
+    cryptography_parse_key_usage_params,
+    cryptography_parse_relative_distinguished_name,
+)
+
+from ansible_collections.community.crypto.plugins.module_utils.crypto.cryptography_crl import (
+    REVOCATION_REASON_MAP,
+)
+
+from ansible_collections.community.crypto.plugins.module_utils.crypto.pyopenssl_support import (
+    pyopenssl_normalize_name_attribute,
+    pyopenssl_parse_name_constraints,
+)
+
+from ansible_collections.community.crypto.plugins.module_utils.crypto.module_backends.common import ArgumentSpec
+
+
+MINIMAL_PYOPENSSL_VERSION = '0.15'
+MINIMAL_CRYPTOGRAPHY_VERSION = '1.3'
+
+PYOPENSSL_IMP_ERR = None
+try:
+    import OpenSSL
+    from OpenSSL import crypto
+    PYOPENSSL_VERSION = LooseVersion(OpenSSL.__version__)
+except ImportError:
+    PYOPENSSL_IMP_ERR = traceback.format_exc()
+    PYOPENSSL_FOUND = False
+else:
+    PYOPENSSL_FOUND = True
+    if OpenSSL.SSL.OPENSSL_VERSION_NUMBER >= 0x10100000:
+        # OpenSSL 1.1.0 or newer
+        OPENSSL_MUST_STAPLE_NAME = b"tlsfeature"
+        OPENSSL_MUST_STAPLE_VALUE = b"status_request"
+    else:
+        # OpenSSL 1.0.x or older
+        OPENSSL_MUST_STAPLE_NAME = b"1.3.6.1.5.5.7.1.24"
+        OPENSSL_MUST_STAPLE_VALUE = b"DER:30:03:02:01:05"
+
+CRYPTOGRAPHY_IMP_ERR = None
+try:
+    import cryptography
+    import cryptography.x509
+    import cryptography.x509.oid
+    import cryptography.exceptions
+    import cryptography.hazmat.backends
+    import cryptography.hazmat.primitives.serialization
+    import cryptography.hazmat.primitives.hashes
+    CRYPTOGRAPHY_VERSION = LooseVersion(cryptography.__version__)
+except ImportError:
+    CRYPTOGRAPHY_IMP_ERR = traceback.format_exc()
+    CRYPTOGRAPHY_FOUND = False
+else:
+    CRYPTOGRAPHY_FOUND = True
+    CRYPTOGRAPHY_MUST_STAPLE_NAME = cryptography.x509.oid.ObjectIdentifier("1.3.6.1.5.5.7.1.24")
+    CRYPTOGRAPHY_MUST_STAPLE_VALUE = b"\x30\x03\x02\x01\x05"
+
+
+class CertificateSigningRequestError(OpenSSLObjectError):
+    pass
+
+
+# From the object called `module`, only the following properties are used:
+#
+#  - module.params[]
+#  - module.warn(msg: str)
+#  - module.fail_json(msg: str, **kwargs)
+
+
+@six.add_metaclass(abc.ABCMeta)
+class CertificateSigningRequestBackend(object):
+    def __init__(self, module, backend):
+        self.module = module
+        self.backend = backend
+        self.digest = module.params['digest']
+        self.privatekey_path = module.params['privatekey_path']
+        self.privatekey_content = module.params['privatekey_content']
+        if self.privatekey_content is not None:
+            self.privatekey_content = self.privatekey_content.encode('utf-8')
+        self.privatekey_passphrase = module.params['privatekey_passphrase']
+        self.version = module.params['version']
+        self.subjectAltName = module.params['subject_alt_name']
+        self.subjectAltName_critical = module.params['subject_alt_name_critical']
+        self.keyUsage = module.params['key_usage']
+        self.keyUsage_critical = module.params['key_usage_critical']
+        self.extendedKeyUsage = module.params['extended_key_usage']
+        self.extendedKeyUsage_critical = module.params['extended_key_usage_critical']
+        self.basicConstraints = module.params['basic_constraints']
+        self.basicConstraints_critical = module.params['basic_constraints_critical']
+        self.ocspMustStaple = module.params['ocsp_must_staple']
+        self.ocspMustStaple_critical = module.params['ocsp_must_staple_critical']
+        self.name_constraints_permitted = module.params['name_constraints_permitted'] or []
+        self.name_constraints_excluded = module.params['name_constraints_excluded'] or []
+        self.name_constraints_critical = module.params['name_constraints_critical']
+        self.create_subject_key_identifier = module.params['create_subject_key_identifier']
+        self.subject_key_identifier = module.params['subject_key_identifier']
+        self.authority_key_identifier = module.params['authority_key_identifier']
+        self.authority_cert_issuer = module.params['authority_cert_issuer']
+        self.authority_cert_serial_number = module.params['authority_cert_serial_number']
+        self.crl_distribution_points = module.params['crl_distribution_points']
+        self.csr = None
+        self.privatekey = None
+
+        if self.create_subject_key_identifier and self.subject_key_identifier is not None:
+            module.fail_json(msg='subject_key_identifier cannot be specified if create_subject_key_identifier is true')
+
+        self.subject = [
+            ('C', module.params['country_name']),
+            ('ST', module.params['state_or_province_name']),
+            ('L', module.params['locality_name']),
+            ('O', module.params['organization_name']),
+            ('OU', module.params['organizational_unit_name']),
+            ('CN', module.params['common_name']),
+            ('emailAddress', module.params['email_address']),
+        ]
+
+        if module.params['subject']:
+            self.subject = self.subject + parse_name_field(module.params['subject'])
+        self.subject = [(entry[0], entry[1]) for entry in self.subject if entry[1]]
+
+        self.using_common_name_for_san = False
+        if not self.subjectAltName and module.params['use_common_name_for_san']:
+            for sub in self.subject:
+                if sub[0] in ('commonName', 'CN'):
+                    self.subjectAltName = ['DNS:%s' % sub[1]]
+                    self.using_common_name_for_san = True
+                    break
+
+        if self.subject_key_identifier is not None:
+            try:
+                self.subject_key_identifier = binascii.unhexlify(self.subject_key_identifier.replace(':', ''))
+            except Exception as e:
+                raise CertificateSigningRequestError('Cannot parse subject_key_identifier: {0}'.format(e))
+
+        if self.authority_key_identifier is not None:
+            try:
+                self.authority_key_identifier = binascii.unhexlify(self.authority_key_identifier.replace(':', ''))
+            except Exception as e:
+                raise CertificateSigningRequestError('Cannot parse authority_key_identifier: {0}'.format(e))
+
+        self.existing_csr = None
+        self.existing_csr_bytes = None
+
+    @abc.abstractmethod
+    def generate_csr(self):
+        """(Re-)Generate CSR."""
+        pass
+
+    @abc.abstractmethod
+    def get_csr_data(self):
+        """Return bytes for self.csr."""
+        pass
+
+    def set_existing(self, csr_bytes):
+        """Set existing CSR bytes. None indicates that the CSR does not exist."""
+        self.existing_csr_bytes = csr_bytes
+
+    def has_existing(self):
+        """Query whether an existing CSR is/has been there."""
+        return self.existing_csr_bytes is not None
+
+    def _ensure_private_key_loaded(self):
+        """Load the provided private key into self.privatekey."""
+        if self.privatekey is not None:
+            return
+        try:
+            self.privatekey = load_privatekey(
+                path=self.privatekey_path,
+                content=self.privatekey_content,
+                passphrase=self.privatekey_passphrase,
+                backend=self.backend,
+            )
+        except OpenSSLBadPassphraseError as exc:
+            raise CertificateSigningRequestError(exc)
+
+    @abc.abstractmethod
+    def _check_csr(self):
+        """Check whether provided parameters, assuming self.existing_csr and self.privatekey have been populated."""
+        pass
+
+    def needs_regeneration(self):
+        """Check whether a regeneration is necessary."""
+        if self.existing_csr_bytes is None:
+            return True
+        try:
+            self.existing_csr = load_certificate_request(None, content=self.existing_csr_bytes, backend=self.backend)
+        except Exception as dummy:
+            return True
+        self._ensure_private_key_loaded()
+        return not self._check_csr()
+
+    def dump(self, include_csr):
+        """Serialize the object into a dictionary."""
+        result = {
+            'privatekey': self.privatekey_path,
+            'subject': self.subject,
+            'subjectAltName': self.subjectAltName,
+            'keyUsage': self.keyUsage,
+            'extendedKeyUsage': self.extendedKeyUsage,
+            'basicConstraints': self.basicConstraints,
+            'ocspMustStaple': self.ocspMustStaple,
+            'name_constraints_permitted': self.name_constraints_permitted,
+            'name_constraints_excluded': self.name_constraints_excluded,
+        }
+        if include_csr:
+            # Get hold of CSR bytes
+            csr_bytes = self.existing_csr_bytes
+            if self.csr is not None:
+                csr_bytes = self.get_csr_data()
+            # Store result
+            result['csr'] = csr_bytes.decode('utf-8') if csr_bytes else None
+        return result
+
+
+# Implementation with using pyOpenSSL
+class CertificateSigningRequestPyOpenSSLBackend(CertificateSigningRequestBackend):
+    def __init__(self, module):
+        for o in ('create_subject_key_identifier', ):
+            if module.params[o]:
+                module.fail_json(msg='You cannot use {0} with the pyOpenSSL backend!'.format(o))
+        for o in ('subject_key_identifier', 'authority_key_identifier', 'authority_cert_issuer', 'authority_cert_serial_number', 'crl_distribution_points'):
+            if module.params[o] is not None:
+                module.fail_json(msg='You cannot use {0} with the pyOpenSSL backend!'.format(o))
+        super(CertificateSigningRequestPyOpenSSLBackend, self).__init__(module, 'pyopenssl')
+
+    def generate_csr(self):
+        """(Re-)Generate CSR."""
+        self._ensure_private_key_loaded()
+
+        req = crypto.X509Req()
+        req.set_version(self.version - 1)
+        subject = req.get_subject()
+        for entry in self.subject:
+            if entry[1] is not None:
+                # Workaround for https://github.com/pyca/pyopenssl/issues/165
+                nid = OpenSSL._util.lib.OBJ_txt2nid(to_bytes(entry[0]))
+                if nid == 0:
+                    raise CertificateSigningRequestError('Unknown subject field identifier "{0}"'.format(entry[0]))
+                res = OpenSSL._util.lib.X509_NAME_add_entry_by_NID(subject._name, nid, OpenSSL._util.lib.MBSTRING_UTF8, to_bytes(entry[1]), -1, -1, 0)
+                if res == 0:
+                    raise CertificateSigningRequestError('Invalid value for subject field identifier "{0}": {1}'.format(entry[0], entry[1]))
+
+        extensions = []
+        if self.subjectAltName:
+            altnames = ', '.join(self.subjectAltName)
+            try:
+                extensions.append(crypto.X509Extension(b"subjectAltName", self.subjectAltName_critical, altnames.encode('ascii')))
+            except OpenSSL.crypto.Error as e:
+                raise CertificateSigningRequestError(
+                    'Error while parsing Subject Alternative Names {0} (check for missing type prefix, such as "DNS:"!): {1}'.format(
+                        ', '.join(["{0}".format(san) for san in self.subjectAltName]), str(e)
+                    )
+                )
+
+        if self.keyUsage:
+            usages = ', '.join(self.keyUsage)
+            extensions.append(crypto.X509Extension(b"keyUsage", self.keyUsage_critical, usages.encode('ascii')))
+
+        if self.extendedKeyUsage:
+            usages = ', '.join(self.extendedKeyUsage)
+            extensions.append(crypto.X509Extension(b"extendedKeyUsage", self.extendedKeyUsage_critical, usages.encode('ascii')))
+
+        if self.basicConstraints:
+            usages = ', '.join(self.basicConstraints)
+            extensions.append(crypto.X509Extension(b"basicConstraints", self.basicConstraints_critical, usages.encode('ascii')))
+
+        if self.name_constraints_permitted or self.name_constraints_excluded:
+            usages = ', '.join(
+                ['permitted;{0}'.format(name) for name in self.name_constraints_permitted] +
+                ['excluded;{0}'.format(name) for name in self.name_constraints_excluded]
+            )
+            extensions.append(crypto.X509Extension(b"nameConstraints", self.name_constraints_critical, usages.encode('ascii')))
+
+        if self.ocspMustStaple:
+            extensions.append(crypto.X509Extension(OPENSSL_MUST_STAPLE_NAME, self.ocspMustStaple_critical, OPENSSL_MUST_STAPLE_VALUE))
+
+        if extensions:
+            req.add_extensions(extensions)
+
+        req.set_pubkey(self.privatekey)
+        req.sign(self.privatekey, self.digest)
+        self.csr = req
+
+    def get_csr_data(self):
+        """Return bytes for self.csr."""
+        return crypto.dump_certificate_request(crypto.FILETYPE_PEM, self.csr)
+
+    def _check_csr(self):
+        def _check_subject(csr):
+            subject = [(OpenSSL._util.lib.OBJ_txt2nid(to_bytes(sub[0])), to_bytes(sub[1])) for sub in self.subject]
+            current_subject = [(OpenSSL._util.lib.OBJ_txt2nid(to_bytes(sub[0])), to_bytes(sub[1])) for sub in csr.get_subject().get_components()]
+            if not set(subject) == set(current_subject):
+                return False
+
+            return True
+
+        def _check_subjectAltName(extensions):
+            altnames_ext = next((ext for ext in extensions if ext.get_short_name() == b'subjectAltName'), '')
+            altnames = [pyopenssl_normalize_name_attribute(altname.strip()) for altname in
+                        to_text(altnames_ext, errors='surrogate_or_strict').split(',') if altname.strip()]
+            if self.subjectAltName:
+                if (set(altnames) != set([pyopenssl_normalize_name_attribute(to_text(name)) for name in self.subjectAltName]) or
+                        altnames_ext.get_critical() != self.subjectAltName_critical):
+                    return False
+            else:
+                if altnames:
+                    return False
+
+            return True
+
+        def _check_keyUsage_(extensions, extName, expected, critical):
+            usages_ext = [ext for ext in extensions if ext.get_short_name() == extName]
+            if (not usages_ext and expected) or (usages_ext and not expected):
+                return False
+            elif not usages_ext and not expected:
+                return True
+            else:
+                current = [OpenSSL._util.lib.OBJ_txt2nid(to_bytes(usage.strip())) for usage in str(usages_ext[0]).split(',')]
+                expected = [OpenSSL._util.lib.OBJ_txt2nid(to_bytes(usage)) for usage in expected]
+                return set(current) == set(expected) and usages_ext[0].get_critical() == critical
+
+        def _check_keyUsage(extensions):
+            usages_ext = [ext for ext in extensions if ext.get_short_name() == b'keyUsage']
+            if (not usages_ext and self.keyUsage) or (usages_ext and not self.keyUsage):
+                return False
+            elif not usages_ext and not self.keyUsage:
+                return True
+            else:
+                # OpenSSL._util.lib.OBJ_txt2nid() always returns 0 for all keyUsage values
+                # (since keyUsage has a fixed bitfield for these values and is not extensible).
+                # Therefore, we create an extension for the wanted values, and compare the
+                # data of the extensions (which is the serialized bitfield).
+                expected_ext = crypto.X509Extension(b"keyUsage", False, ', '.join(self.keyUsage).encode('ascii'))
+                return usages_ext[0].get_data() == expected_ext.get_data() and usages_ext[0].get_critical() == self.keyUsage_critical
+
+        def _check_extenededKeyUsage(extensions):
+            return _check_keyUsage_(extensions, b'extendedKeyUsage', self.extendedKeyUsage, self.extendedKeyUsage_critical)
+
+        def _check_basicConstraints(extensions):
+            return _check_keyUsage_(extensions, b'basicConstraints', self.basicConstraints, self.basicConstraints_critical)
+
+        def _check_nameConstraints(extensions):
+            nc_ext = next((ext for ext in extensions if ext.get_short_name() == b'nameConstraints'), '')
+            permitted, excluded = pyopenssl_parse_name_constraints(nc_ext)
+            if self.name_constraints_permitted or self.name_constraints_excluded:
+                if set(permitted) != set([pyopenssl_normalize_name_attribute(to_text(name)) for name in self.name_constraints_permitted]):
+                    return False
+                if set(excluded) != set([pyopenssl_normalize_name_attribute(to_text(name)) for name in self.name_constraints_excluded]):
+                    return False
+                if nc_ext.get_critical() != self.name_constraints_critical:
+                    return False
+            else:
+                if permitted or excluded:
+                    return False
+
+            return True
+
+        def _check_ocspMustStaple(extensions):
+            oms_ext = [ext for ext in extensions if to_bytes(ext.get_short_name()) == OPENSSL_MUST_STAPLE_NAME and to_bytes(ext) == OPENSSL_MUST_STAPLE_VALUE]
+            if OpenSSL.SSL.OPENSSL_VERSION_NUMBER < 0x10100000:
+                # Older versions of libssl don't know about OCSP Must Staple
+                oms_ext.extend([ext for ext in extensions if ext.get_short_name() == b'UNDEF' and ext.get_data() == b'\x30\x03\x02\x01\x05'])
+            if self.ocspMustStaple:
+                return len(oms_ext) > 0 and oms_ext[0].get_critical() == self.ocspMustStaple_critical
+            else:
+                return len(oms_ext) == 0
+
+        def _check_extensions(csr):
+            extensions = csr.get_extensions()
+            return (_check_subjectAltName(extensions) and _check_keyUsage(extensions) and
+                    _check_extenededKeyUsage(extensions) and _check_basicConstraints(extensions) and
+                    _check_ocspMustStaple(extensions) and _check_nameConstraints(extensions))
+
+        def _check_signature(csr):
+            try:
+                return csr.verify(self.privatekey)
+            except crypto.Error:
+                return False
+
+        return _check_subject(self.existing_csr) and _check_extensions(self.existing_csr) and _check_signature(self.existing_csr)
+
+
+def parse_crl_distribution_points(module, crl_distribution_points):
+    result = []
+    for index, parse_crl_distribution_point in enumerate(crl_distribution_points):
+        try:
+            params = dict(
+                full_name=None,
+                relative_name=None,
+                crl_issuer=None,
+                reasons=None,
+            )
+            if parse_crl_distribution_point['full_name'] is not None:
+                params['full_name'] = [cryptography_get_name(name, 'full name') for name in parse_crl_distribution_point['full_name']]
+            if parse_crl_distribution_point['relative_name'] is not None:
+                try:
+                    params['relative_name'] = cryptography_parse_relative_distinguished_name(parse_crl_distribution_point['relative_name'])
+                except Exception:
+                    # If cryptography's version is < 1.6, the error is probably caused by that
+                    if CRYPTOGRAPHY_VERSION < LooseVersion('1.6'):
+                        raise OpenSSLObjectError('Cannot specify relative_name for cryptography < 1.6')
+                    raise
+            if parse_crl_distribution_point['crl_issuer'] is not None:
+                params['crl_issuer'] = [cryptography_get_name(name, 'CRL issuer') for name in parse_crl_distribution_point['crl_issuer']]
+            if parse_crl_distribution_point['reasons'] is not None:
+                reasons = []
+                for reason in parse_crl_distribution_point['reasons']:
+                    reasons.append(REVOCATION_REASON_MAP[reason])
+                params['reasons'] = frozenset(reasons)
+            result.append(cryptography.x509.DistributionPoint(**params))
+        except OpenSSLObjectError as e:
+            raise OpenSSLObjectError('Error while parsing CRL distribution point #{index}: {error}'.format(index=index, error=e))
+    return result
+
+
+# Implementation with using cryptography
+class CertificateSigningRequestCryptographyBackend(CertificateSigningRequestBackend):
+    def __init__(self, module):
+        super(CertificateSigningRequestCryptographyBackend, self).__init__(module, 'cryptography')
+        self.cryptography_backend = cryptography.hazmat.backends.default_backend()
+        if self.version != 1:
+            module.warn('The cryptography backend only supports version 1. (The only valid value according to RFC 2986.)')
+
+        if self.crl_distribution_points:
+            self.crl_distribution_points = parse_crl_distribution_points(module, self.crl_distribution_points)
+
+    def generate_csr(self):
+        """(Re-)Generate CSR."""
+        self._ensure_private_key_loaded()
+
+        csr = cryptography.x509.CertificateSigningRequestBuilder()
+        try:
+            csr = csr.subject_name(cryptography.x509.Name([
+                cryptography.x509.NameAttribute(cryptography_name_to_oid(entry[0]), to_text(entry[1])) for entry in self.subject
+            ]))
+        except ValueError as e:
+            raise CertificateSigningRequestError(e)
+
+        if self.subjectAltName:
+            csr = csr.add_extension(cryptography.x509.SubjectAlternativeName([
+                cryptography_get_name(name) for name in self.subjectAltName
+            ]), critical=self.subjectAltName_critical)
+
+        if self.keyUsage:
+            params = cryptography_parse_key_usage_params(self.keyUsage)
+            csr = csr.add_extension(cryptography.x509.KeyUsage(**params), critical=self.keyUsage_critical)
+
+        if self.extendedKeyUsage:
+            usages = [cryptography_name_to_oid(usage) for usage in self.extendedKeyUsage]
+            csr = csr.add_extension(cryptography.x509.ExtendedKeyUsage(usages), critical=self.extendedKeyUsage_critical)
+
+        if self.basicConstraints:
+            params = {}
+            ca, path_length = cryptography_get_basic_constraints(self.basicConstraints)
+            csr = csr.add_extension(cryptography.x509.BasicConstraints(ca, path_length), critical=self.basicConstraints_critical)
+
+        if self.ocspMustStaple:
+            try:
+                # This only works with cryptography >= 2.1
+                csr = csr.add_extension(cryptography.x509.TLSFeature([cryptography.x509.TLSFeatureType.status_request]), critical=self.ocspMustStaple_critical)
+            except AttributeError as dummy:
+                csr = csr.add_extension(
+                    cryptography.x509.UnrecognizedExtension(CRYPTOGRAPHY_MUST_STAPLE_NAME, CRYPTOGRAPHY_MUST_STAPLE_VALUE),
+                    critical=self.ocspMustStaple_critical
+                )
+
+        if self.name_constraints_permitted or self.name_constraints_excluded:
+            try:
+                csr = csr.add_extension(cryptography.x509.NameConstraints(
+                    [cryptography_get_name(name, 'name constraints permitted') for name in self.name_constraints_permitted],
+                    [cryptography_get_name(name, 'name constraints excluded') for name in self.name_constraints_excluded],
+                ), critical=self.name_constraints_critical)
+            except TypeError as e:
+                raise OpenSSLObjectError('Error while parsing name constraint: {0}'.format(e))
+
+        if self.create_subject_key_identifier:
+            csr = csr.add_extension(
+                cryptography.x509.SubjectKeyIdentifier.from_public_key(self.privatekey.public_key()),
+                critical=False
+            )
+        elif self.subject_key_identifier is not None:
+            csr = csr.add_extension(cryptography.x509.SubjectKeyIdentifier(self.subject_key_identifier), critical=False)
+
+        if self.authority_key_identifier is not None or self.authority_cert_issuer is not None or self.authority_cert_serial_number is not None:
+            issuers = None
+            if self.authority_cert_issuer is not None:
+                issuers = [cryptography_get_name(n, 'authority cert issuer') for n in self.authority_cert_issuer]
+            csr = csr.add_extension(
+                cryptography.x509.AuthorityKeyIdentifier(self.authority_key_identifier, issuers, self.authority_cert_serial_number),
+                critical=False
+            )
+
+        if self.crl_distribution_points:
+            csr = csr.add_extension(
+                cryptography.x509.CRLDistributionPoints(self.crl_distribution_points),
+                critical=False
+            )
+
+        digest = None
+        if cryptography_key_needs_digest_for_signing(self.privatekey):
+            digest = select_message_digest(self.digest)
+            if digest is None:
+                raise CertificateSigningRequestError('Unsupported digest "{0}"'.format(self.digest))
+        try:
+            self.csr = csr.sign(self.privatekey, digest, self.cryptography_backend)
+        except TypeError as e:
+            if str(e) == 'Algorithm must be a registered hash algorithm.' and digest is None:
+                self.module.fail_json(msg='Signing with Ed25519 and Ed448 keys requires cryptography 2.8 or newer.')
+            raise
+        except UnicodeError as e:
+            # This catches IDNAErrors, which happens when a bad name is passed as a SAN
+            # (https://github.com/ansible-collections/community.crypto/issues/105).
+            # For older cryptography versions, this is handled by idna, which raises
+            # an idna.core.IDNAError. Later versions of cryptography deprecated and stopped
+            # requiring idna, whence we cannot easily handle this error. Fortunately, in
+            # most versions of idna, IDNAError extends UnicodeError. There is only version
+            # 2.3 where it extends Exception instead (see
+            # https://github.com/kjd/idna/commit/ebefacd3134d0f5da4745878620a6a1cba86d130
+            # and then
+            # https://github.com/kjd/idna/commit/ea03c7b5db7d2a99af082e0239da2b68aeea702a).
+            msg = 'Error while creating CSR: {0}\n'.format(e)
+            if self.using_common_name_for_san:
+                self.module.fail_json(msg=msg + 'This is probably caused because the Common Name is used as a SAN.'
+                                      ' Specifying use_common_name_for_san=false might fix this.')
+            self.module.fail_json(msg=msg + 'This is probably caused by an invalid Subject Alternative DNS Name.')
+
+    def get_csr_data(self):
+        """Return bytes for self.csr."""
+        return self.csr.public_bytes(cryptography.hazmat.primitives.serialization.Encoding.PEM)
+
+    def _check_csr(self):
+        """Check whether provided parameters, assuming self.existing_csr and self.privatekey have been populated."""
+        def _check_subject(csr):
+            subject = [(cryptography_name_to_oid(entry[0]), entry[1]) for entry in self.subject]
+            current_subject = [(sub.oid, sub.value) for sub in csr.subject]
+            return set(subject) == set(current_subject)
+
+        def _find_extension(extensions, exttype):
+            return next(
+                (ext for ext in extensions if isinstance(ext.value, exttype)),
+                None
+            )
+
+        def _check_subjectAltName(extensions):
+            current_altnames_ext = _find_extension(extensions, cryptography.x509.SubjectAlternativeName)
+            current_altnames = [str(altname) for altname in current_altnames_ext.value] if current_altnames_ext else []
+            altnames = [str(cryptography_get_name(altname)) for altname in self.subjectAltName] if self.subjectAltName else []
+            if set(altnames) != set(current_altnames):
+                return False
+            if altnames:
+                if current_altnames_ext.critical != self.subjectAltName_critical:
+                    return False
+            return True
+
+        def _check_keyUsage(extensions):
+            current_keyusage_ext = _find_extension(extensions, cryptography.x509.KeyUsage)
+            if not self.keyUsage:
+                return current_keyusage_ext is None
+            elif current_keyusage_ext is None:
+                return False
+            params = cryptography_parse_key_usage_params(self.keyUsage)
+            for param in params:
+                if getattr(current_keyusage_ext.value, '_' + param) != params[param]:
+                    return False
+            if current_keyusage_ext.critical != self.keyUsage_critical:
+                return False
+            return True
+
+        def _check_extenededKeyUsage(extensions):
+            current_usages_ext = _find_extension(extensions, cryptography.x509.ExtendedKeyUsage)
+            current_usages = [str(usage) for usage in current_usages_ext.value] if current_usages_ext else []
+            usages = [str(cryptography_name_to_oid(usage)) for usage in self.extendedKeyUsage] if self.extendedKeyUsage else []
+            if set(current_usages) != set(usages):
+                return False
+            if usages:
+                if current_usages_ext.critical != self.extendedKeyUsage_critical:
+                    return False
+            return True
+
+        def _check_basicConstraints(extensions):
+            bc_ext = _find_extension(extensions, cryptography.x509.BasicConstraints)
+            current_ca = bc_ext.value.ca if bc_ext else False
+            current_path_length = bc_ext.value.path_length if bc_ext else None
+            ca, path_length = cryptography_get_basic_constraints(self.basicConstraints)
+            # Check CA flag
+            if ca != current_ca:
+                return False
+            # Check path length
+            if path_length != current_path_length:
+                return False
+            # Check criticality
+            if self.basicConstraints:
+                return bc_ext is not None and bc_ext.critical == self.basicConstraints_critical
+            else:
+                return bc_ext is None
+
+        def _check_ocspMustStaple(extensions):
+            try:
+                # This only works with cryptography >= 2.1
+                tlsfeature_ext = _find_extension(extensions, cryptography.x509.TLSFeature)
+                has_tlsfeature = True
+            except AttributeError as dummy:
+                tlsfeature_ext = next(
+                    (ext for ext in extensions if ext.value.oid == CRYPTOGRAPHY_MUST_STAPLE_NAME),
+                    None
+                )
+                has_tlsfeature = False
+            if self.ocspMustStaple:
+                if not tlsfeature_ext or tlsfeature_ext.critical != self.ocspMustStaple_critical:
+                    return False
+                if has_tlsfeature:
+                    return cryptography.x509.TLSFeatureType.status_request in tlsfeature_ext.value
+                else:
+                    return tlsfeature_ext.value.value == CRYPTOGRAPHY_MUST_STAPLE_VALUE
+            else:
+                return tlsfeature_ext is None
+
+        def _check_nameConstraints(extensions):
+            current_nc_ext = _find_extension(extensions, cryptography.x509.NameConstraints)
+            current_nc_perm = [str(altname) for altname in current_nc_ext.value.permitted_subtrees] if current_nc_ext else []
+            current_nc_excl = [str(altname) for altname in current_nc_ext.value.excluded_subtrees] if current_nc_ext else []
+            nc_perm = [str(cryptography_get_name(altname, 'name constraints permitted')) for altname in self.name_constraints_permitted]
+            nc_excl = [str(cryptography_get_name(altname, 'name constraints excluded')) for altname in self.name_constraints_excluded]
+            if set(nc_perm) != set(current_nc_perm) or set(nc_excl) != set(current_nc_excl):
+                return False
+            if nc_perm or nc_excl:
+                if current_nc_ext.critical != self.name_constraints_critical:
+                    return False
+            return True
+
+        def _check_subject_key_identifier(extensions):
+            ext = _find_extension(extensions, cryptography.x509.SubjectKeyIdentifier)
+            if self.create_subject_key_identifier or self.subject_key_identifier is not None:
+                if not ext or ext.critical:
+                    return False
+                if self.create_subject_key_identifier:
+                    digest = cryptography.x509.SubjectKeyIdentifier.from_public_key(self.privatekey.public_key()).digest
+                    return ext.value.digest == digest
+                else:
+                    return ext.value.digest == self.subject_key_identifier
+            else:
+                return ext is None
+
+        def _check_authority_key_identifier(extensions):
+            ext = _find_extension(extensions, cryptography.x509.AuthorityKeyIdentifier)
+            if self.authority_key_identifier is not None or self.authority_cert_issuer is not None or self.authority_cert_serial_number is not None:
+                if not ext or ext.critical:
+                    return False
+                aci = None
+                csr_aci = None
+                if self.authority_cert_issuer is not None:
+                    aci = [str(cryptography_get_name(n, 'authority cert issuer')) for n in self.authority_cert_issuer]
+                if ext.value.authority_cert_issuer is not None:
+                    csr_aci = [str(n) for n in ext.value.authority_cert_issuer]
+                return (ext.value.key_identifier == self.authority_key_identifier
+                        and csr_aci == aci
+                        and ext.value.authority_cert_serial_number == self.authority_cert_serial_number)
+            else:
+                return ext is None
+
+        def _check_crl_distribution_points(extensions):
+            ext = _find_extension(extensions, cryptography.x509.CRLDistributionPoints)
+            if self.crl_distribution_points is None:
+                return ext is None
+            if not ext:
+                return False
+            return list(ext.value) == self.crl_distribution_points
+
+        def _check_extensions(csr):
+            extensions = csr.extensions
+            return (_check_subjectAltName(extensions) and _check_keyUsage(extensions) and
+                    _check_extenededKeyUsage(extensions) and _check_basicConstraints(extensions) and
+                    _check_ocspMustStaple(extensions) and _check_subject_key_identifier(extensions) and
+                    _check_authority_key_identifier(extensions) and _check_nameConstraints(extensions) and
+                    _check_crl_distribution_points(extensions))
+
+        def _check_signature(csr):
+            if not csr.is_signature_valid:
+                return False
+            # To check whether public key of CSR belongs to private key,
+            # encode both public keys and compare PEMs.
+            key_a = csr.public_key().public_bytes(
+                cryptography.hazmat.primitives.serialization.Encoding.PEM,
+                cryptography.hazmat.primitives.serialization.PublicFormat.SubjectPublicKeyInfo
+            )
+            key_b = self.privatekey.public_key().public_bytes(
+                cryptography.hazmat.primitives.serialization.Encoding.PEM,
+                cryptography.hazmat.primitives.serialization.PublicFormat.SubjectPublicKeyInfo
+            )
+            return key_a == key_b
+
+        return _check_subject(self.existing_csr) and _check_extensions(self.existing_csr) and _check_signature(self.existing_csr)
+
+
+def select_backend(module, backend):
+    if module.params['version'] != 1:
+        module.deprecate('The version option will only support allowed values from community.crypto 2.0.0 on. '
+                         'Currently, only the value 1 is allowed by RFC 2986',
+                         version='2.0.0', collection_name='community.crypto')
+
+    if backend == 'auto':
+        # Detection what is possible
+        can_use_cryptography = CRYPTOGRAPHY_FOUND and CRYPTOGRAPHY_VERSION >= LooseVersion(MINIMAL_CRYPTOGRAPHY_VERSION)
+        can_use_pyopenssl = PYOPENSSL_FOUND and PYOPENSSL_VERSION >= LooseVersion(MINIMAL_PYOPENSSL_VERSION)
+
+        # First try cryptography, then pyOpenSSL
+        if can_use_cryptography:
+            backend = 'cryptography'
+        elif can_use_pyopenssl:
+            backend = 'pyopenssl'
+
+        # Success?
+        if backend == 'auto':
+            module.fail_json(msg=("Can't detect any of the required Python libraries "
+                                  "cryptography (>= {0}) or PyOpenSSL (>= {1})").format(
+                                      MINIMAL_CRYPTOGRAPHY_VERSION,
+                                      MINIMAL_PYOPENSSL_VERSION))
+
+    if backend == 'pyopenssl':
+        if not PYOPENSSL_FOUND:
+            module.fail_json(msg=missing_required_lib('pyOpenSSL >= {0}'.format(MINIMAL_PYOPENSSL_VERSION)),
+                             exception=PYOPENSSL_IMP_ERR)
+        try:
+            getattr(crypto.X509Req, 'get_extensions')
+        except AttributeError:
+            module.fail_json(msg='You need to have PyOpenSSL>=0.15 to generate CSRs')
+
+        module.deprecate('The module is using the PyOpenSSL backend. This backend has been deprecated',
+                         version='2.0.0', collection_name='community.crypto')
+        return backend, CertificateSigningRequestPyOpenSSLBackend(module)
+    elif backend == 'cryptography':
+        if not CRYPTOGRAPHY_FOUND:
+            module.fail_json(msg=missing_required_lib('cryptography >= {0}'.format(MINIMAL_CRYPTOGRAPHY_VERSION)),
+                             exception=CRYPTOGRAPHY_IMP_ERR)
+        return backend, CertificateSigningRequestCryptographyBackend(module)
+    else:
+        raise Exception('Unsupported value for backend: {0}'.format(backend))
+
+
+def get_csr_argument_spec():
+    return ArgumentSpec(
+        argument_spec=dict(
+            digest=dict(type='str', default='sha256'),
+            privatekey_path=dict(type='path'),
+            privatekey_content=dict(type='str', no_log=True),
+            privatekey_passphrase=dict(type='str', no_log=True),
+            version=dict(type='int', default=1),
+            subject=dict(type='dict'),
+            country_name=dict(type='str', aliases=['C', 'countryName']),
+            state_or_province_name=dict(type='str', aliases=['ST', 'stateOrProvinceName']),
+            locality_name=dict(type='str', aliases=['L', 'localityName']),
+            organization_name=dict(type='str', aliases=['O', 'organizationName']),
+            organizational_unit_name=dict(type='str', aliases=['OU', 'organizationalUnitName']),
+            common_name=dict(type='str', aliases=['CN', 'commonName']),
+            email_address=dict(type='str', aliases=['E', 'emailAddress']),
+            subject_alt_name=dict(type='list', elements='str', aliases=['subjectAltName']),
+            subject_alt_name_critical=dict(type='bool', default=False, aliases=['subjectAltName_critical']),
+            use_common_name_for_san=dict(type='bool', default=True, aliases=['useCommonNameForSAN']),
+            key_usage=dict(type='list', elements='str', aliases=['keyUsage']),
+            key_usage_critical=dict(type='bool', default=False, aliases=['keyUsage_critical']),
+            extended_key_usage=dict(type='list', elements='str', aliases=['extKeyUsage', 'extendedKeyUsage']),
+            extended_key_usage_critical=dict(type='bool', default=False, aliases=['extKeyUsage_critical', 'extendedKeyUsage_critical']),
+            basic_constraints=dict(type='list', elements='str', aliases=['basicConstraints']),
+            basic_constraints_critical=dict(type='bool', default=False, aliases=['basicConstraints_critical']),
+            ocsp_must_staple=dict(type='bool', default=False, aliases=['ocspMustStaple']),
+            ocsp_must_staple_critical=dict(type='bool', default=False, aliases=['ocspMustStaple_critical']),
+            name_constraints_permitted=dict(type='list', elements='str'),
+            name_constraints_excluded=dict(type='list', elements='str'),
+            name_constraints_critical=dict(type='bool', default=False),
+            create_subject_key_identifier=dict(type='bool', default=False),
+            subject_key_identifier=dict(type='str'),
+            authority_key_identifier=dict(type='str'),
+            authority_cert_issuer=dict(type='list', elements='str'),
+            authority_cert_serial_number=dict(type='int'),
+            crl_distribution_points=dict(
+                type='list',
+                elements='dict',
+                options=dict(
+                    full_name=dict(type='list', elements='str'),
+                    relative_name=dict(type='list', elements='str'),
+                    crl_issuer=dict(type='list', elements='str'),
+                    reasons=dict(type='list', elements='str', choices=[
+                        'key_compromise',
+                        'ca_compromise',
+                        'affiliation_changed',
+                        'superseded',
+                        'cessation_of_operation',
+                        'certificate_hold',
+                        'privilege_withdrawn',
+                        'aa_compromise',
+                    ]),
+                ),
+                mutually_exclusive=[('full_name', 'relative_name')]
+            ),
+            select_crypto_backend=dict(type='str', default='auto', choices=['auto', 'cryptography', 'pyopenssl']),
+        ),
+        required_together=[
+            ['authority_cert_issuer', 'authority_cert_serial_number'],
+        ],
+        mutually_exclusive=[
+            ['privatekey_path', 'privatekey_content'],
+        ],
+        required_one_of=[
+            ['privatekey_path', 'privatekey_content'],
+        ],
+    )

plugins/module_utils/crypto/module_backends/privatekey.py

@@ -0,0 +1,590 @@
+# -*- coding: utf-8 -*-
+#
+# Copyright: (c) 2016, Yanis Guenane <yanis+ansible@guenane.org>
+# Copyright: (c) 2020, Felix Fontein <felix@fontein.de>
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+
+from __future__ import absolute_import, division, print_function
+__metaclass__ = type
+
+
+import abc
+import base64
+import traceback
+
+from distutils.version import LooseVersion
+
+from ansible.module_utils import six
+from ansible.module_utils.basic import missing_required_lib
+from ansible.module_utils._text import to_bytes
+
+from ansible_collections.community.crypto.plugins.module_utils.crypto.basic import (
+    CRYPTOGRAPHY_HAS_X25519,
+    CRYPTOGRAPHY_HAS_X25519_FULL,
+    CRYPTOGRAPHY_HAS_X448,
+    CRYPTOGRAPHY_HAS_ED25519,
+    CRYPTOGRAPHY_HAS_ED448,
+    OpenSSLObjectError,
+    OpenSSLBadPassphraseError,
+)
+
+from ansible_collections.community.crypto.plugins.module_utils.crypto.support import (
+    load_privatekey,
+    get_fingerprint_of_privatekey,
+)
+
+from ansible_collections.community.crypto.plugins.module_utils.crypto.pem import (
+    identify_private_key_format,
+)
+
+from ansible_collections.community.crypto.plugins.module_utils.crypto.module_backends.common import ArgumentSpec
+
+
+MINIMAL_PYOPENSSL_VERSION = '0.6'
+MINIMAL_CRYPTOGRAPHY_VERSION = '1.2.3'
+
+PYOPENSSL_IMP_ERR = None
+try:
+    import OpenSSL
+    from OpenSSL import crypto
+    PYOPENSSL_VERSION = LooseVersion(OpenSSL.__version__)
+except ImportError:
+    PYOPENSSL_IMP_ERR = traceback.format_exc()
+    PYOPENSSL_FOUND = False
+else:
+    PYOPENSSL_FOUND = True
+
+CRYPTOGRAPHY_IMP_ERR = None
+try:
+    import cryptography
+    import cryptography.exceptions
+    import cryptography.hazmat.backends
+    import cryptography.hazmat.primitives.serialization
+    import cryptography.hazmat.primitives.asymmetric.rsa
+    import cryptography.hazmat.primitives.asymmetric.dsa
+    import cryptography.hazmat.primitives.asymmetric.ec
+    import cryptography.hazmat.primitives.asymmetric.utils
+    CRYPTOGRAPHY_VERSION = LooseVersion(cryptography.__version__)
+except ImportError:
+    CRYPTOGRAPHY_IMP_ERR = traceback.format_exc()
+    CRYPTOGRAPHY_FOUND = False
+else:
+    CRYPTOGRAPHY_FOUND = True
+
+
+class PrivateKeyError(OpenSSLObjectError):
+    pass
+
+
+# From the object called `module`, only the following properties are used:
+#
+#  - module.params[]
+#  - module.warn(msg: str)
+#  - module.fail_json(msg: str, **kwargs)
+
+
+@six.add_metaclass(abc.ABCMeta)
+class PrivateKeyBackend:
+    def __init__(self, module, backend):
+        self.module = module
+        self.type = module.params['type']
+        self.size = module.params['size']
+        self.curve = module.params['curve']
+        self.passphrase = module.params['passphrase']
+        self.cipher = module.params['cipher']
+        self.format = module.params['format']
+        self.format_mismatch = module.params.get('format_mismatch', 'regenerate')
+        self.regenerate = module.params.get('regenerate', 'full_idempotence')
+        self.backend = backend
+
+        self.private_key = None
+
+        self.existing_private_key = None
+        self.existing_private_key_bytes = None
+
+    @abc.abstractmethod
+    def generate_private_key(self):
+        """(Re-)Generate private key."""
+        pass
+
+    def convert_private_key(self):
+        """Convert existing private key (self.existing_private_key) to new private key (self.private_key).
+
+        This is effectively a copy without active conversion. The conversion is done
+        during load and store; get_private_key_data() uses the destination format to
+        serialize the key.
+        """
+        self._ensure_existing_private_key_loaded()
+        self.private_key = self.existing_private_key
+
+    @abc.abstractmethod
+    def get_private_key_data(self):
+        """Return bytes for self.private_key."""
+        pass
+
+    def set_existing(self, privatekey_bytes):
+        """Set existing private key bytes. None indicates that the key does not exist."""
+        self.existing_private_key_bytes = privatekey_bytes
+
+    def has_existing(self):
+        """Query whether an existing private key is/has been there."""
+        return self.existing_private_key_bytes is not None
+
+    @abc.abstractmethod
+    def _check_passphrase(self):
+        """Check whether provided passphrase matches, assuming self.existing_private_key_bytes has been populated."""
+        pass
+
+    @abc.abstractmethod
+    def _ensure_existing_private_key_loaded(self):
+        """Make sure that self.existing_private_key is populated from self.existing_private_key_bytes."""
+        pass
+
+    @abc.abstractmethod
+    def _check_size_and_type(self):
+        """Check whether provided size and type matches, assuming self.existing_private_key has been populated."""
+        pass
+
+    @abc.abstractmethod
+    def _check_format(self):
+        """Check whether the key file format, assuming self.existing_private_key and self.existing_private_key_bytes has been populated."""
+        pass
+
+    def needs_regeneration(self):
+        """Check whether a regeneration is necessary."""
+        if self.regenerate == 'always':
+            return True
+        if not self.has_existing():
+            # key does not exist
+            return True
+        if not self._check_passphrase():
+            if self.regenerate == 'full_idempotence':
+                return True
+            self.module.fail_json(msg='Unable to read the key. The key is protected with a another passphrase / no passphrase or broken.'
+                                  ' Will not proceed. To force regeneration, call the module with `generate`'
+                                  ' set to `full_idempotence` or `always`, or with `force=yes`.')
+        self._ensure_existing_private_key_loaded()
+        if self.regenerate != 'never':
+            if not self._check_size_and_type():
+                if self.regenerate in ('partial_idempotence', 'full_idempotence'):
+                    return True
+                self.module.fail_json(msg='Key has wrong type and/or size.'
+                                      ' Will not proceed. To force regeneration, call the module with `generate`'
+                                      ' set to `partial_idempotence`, `full_idempotence` or `always`, or with `force=yes`.')
+        # During generation step, regenerate if format does not match and format_mismatch == 'regenerate'
+        if self.format_mismatch == 'regenerate' and self.regenerate != 'never':
+            if not self._check_format():
+                if self.regenerate in ('partial_idempotence', 'full_idempotence'):
+                    return True
+                self.module.fail_json(msg='Key has wrong format.'
+                                      ' Will not proceed. To force regeneration, call the module with `generate`'
+                                      ' set to `partial_idempotence`, `full_idempotence` or `always`, or with `force=yes`.'
+                                      ' To convert the key, set `format_mismatch` to `convert`.')
+        return False
+
+    def needs_conversion(self):
+        """Check whether a conversion is necessary. Must only be called if needs_regeneration() returned False."""
+        # During conversion step, convert if format does not match and format_mismatch == 'convert'
+        self._ensure_existing_private_key_loaded()
+        return self.has_existing() and self.format_mismatch == 'convert' and not self._check_format()
+
+    def _get_fingerprint(self):
+        if self.private_key:
+            return get_fingerprint_of_privatekey(self.private_key, backend=self.backend)
+        try:
+            self._ensure_existing_private_key_loaded()
+        except Exception as dummy:
+            # Ignore errors
+            pass
+        if self.existing_private_key:
+            return get_fingerprint_of_privatekey(self.existing_private_key, backend=self.backend)
+
+    def dump(self, include_key):
+        """Serialize the object into a dictionary."""
+
+        if not self.private_key:
+            try:
+                self._ensure_existing_private_key_loaded()
+            except Exception as dummy:
+                # Ignore errors
+                pass
+        result = {
+            'type': self.type,
+            'size': self.size,
+            'fingerprint': self._get_fingerprint(),
+        }
+        if self.type == 'ECC':
+            result['curve'] = self.curve
+        if include_key:
+            # Get hold of private key bytes
+            pk_bytes = self.existing_private_key_bytes
+            if self.private_key is not None:
+                pk_bytes = self.get_private_key_data()
+            # Store result
+            if pk_bytes:
+                if identify_private_key_format(pk_bytes) == 'raw':
+                    result['privatekey'] = base64.b64encode(pk_bytes)
+                else:
+                    result['privatekey'] = pk_bytes.decode('utf-8')
+            else:
+                result['privatekey'] = None
+
+        return result
+
+
+# Implementation with using pyOpenSSL
+class PrivateKeyPyOpenSSLBackend(PrivateKeyBackend):
+
+    def __init__(self, module):
+        super(PrivateKeyPyOpenSSLBackend, self).__init__(module=module, backend='pyopenssl')
+
+        if self.type == 'RSA':
+            self.openssl_type = crypto.TYPE_RSA
+        elif self.type == 'DSA':
+            self.openssl_type = crypto.TYPE_DSA
+        else:
+            self.module.fail_json(msg="PyOpenSSL backend only supports RSA and DSA keys.")
+
+        if self.format != 'auto_ignore':
+            self.module.fail_json(msg="PyOpenSSL backend only supports auto_ignore format.")
+
+    def generate_private_key(self):
+        """(Re-)Generate private key."""
+        self.private_key = crypto.PKey()
+        try:
+            self.private_key.generate_key(self.openssl_type, self.size)
+        except (TypeError, ValueError) as exc:
+            raise PrivateKeyError(exc)
+
+    def _ensure_existing_private_key_loaded(self):
+        if self.existing_private_key is None and self.has_existing():
+            try:
+                self.existing_private_key = load_privatekey(
+                    None, self.passphrase, content=self.existing_private_key_bytes, backend=self.backend)
+            except OpenSSLBadPassphraseError as exc:
+                raise PrivateKeyError(exc)
+
+    def get_private_key_data(self):
+        """Return bytes for self.private_key"""
+        if self.cipher and self.passphrase:
+            return crypto.dump_privatekey(crypto.FILETYPE_PEM, self.private_key,
+                                          self.cipher, to_bytes(self.passphrase))
+        else:
+            return crypto.dump_privatekey(crypto.FILETYPE_PEM, self.private_key)
+
+    def _check_passphrase(self):
+        try:
+            load_privatekey(None, self.passphrase, content=self.existing_private_key_bytes, backend=self.backend)
+            return True
+        except Exception as dummy:
+            return False
+
+    def _check_size_and_type(self):
+        return self.size == self.existing_private_key.bits() and self.openssl_type == self.existing_private_key.type()
+
+    def _check_format(self):
+        # Not supported by this backend
+        return True
+
+
+# Implementation with using cryptography
+class PrivateKeyCryptographyBackend(PrivateKeyBackend):
+
+    def _get_ec_class(self, ectype):
+        ecclass = cryptography.hazmat.primitives.asymmetric.ec.__dict__.get(ectype)
+        if ecclass is None:
+            self.module.fail_json(msg='Your cryptography version does not support {0}'.format(ectype))
+        return ecclass
+
+    def _add_curve(self, name, ectype, deprecated=False):
+        def create(size):
+            ecclass = self._get_ec_class(ectype)
+            return ecclass()
+
+        def verify(privatekey):
+            ecclass = self._get_ec_class(ectype)
+            return isinstance(privatekey.private_numbers().public_numbers.curve, ecclass)
+
+        self.curves[name] = {
+            'create': create,
+            'verify': verify,
+            'deprecated': deprecated,
+        }
+
+    def __init__(self, module):
+        super(PrivateKeyCryptographyBackend, self).__init__(module=module, backend='cryptography')
+
+        self.curves = dict()
+        self._add_curve('secp224r1', 'SECP224R1')
+        self._add_curve('secp256k1', 'SECP256K1')
+        self._add_curve('secp256r1', 'SECP256R1')
+        self._add_curve('secp384r1', 'SECP384R1')
+        self._add_curve('secp521r1', 'SECP521R1')
+        self._add_curve('secp192r1', 'SECP192R1', deprecated=True)
+        self._add_curve('sect163k1', 'SECT163K1', deprecated=True)
+        self._add_curve('sect163r2', 'SECT163R2', deprecated=True)
+        self._add_curve('sect233k1', 'SECT233K1', deprecated=True)
+        self._add_curve('sect233r1', 'SECT233R1', deprecated=True)
+        self._add_curve('sect283k1', 'SECT283K1', deprecated=True)
+        self._add_curve('sect283r1', 'SECT283R1', deprecated=True)
+        self._add_curve('sect409k1', 'SECT409K1', deprecated=True)
+        self._add_curve('sect409r1', 'SECT409R1', deprecated=True)
+        self._add_curve('sect571k1', 'SECT571K1', deprecated=True)
+        self._add_curve('sect571r1', 'SECT571R1', deprecated=True)
+        self._add_curve('brainpoolP256r1', 'BrainpoolP256R1', deprecated=True)
+        self._add_curve('brainpoolP384r1', 'BrainpoolP384R1', deprecated=True)
+        self._add_curve('brainpoolP512r1', 'BrainpoolP512R1', deprecated=True)
+
+        self.cryptography_backend = cryptography.hazmat.backends.default_backend()
+
+        if not CRYPTOGRAPHY_HAS_X25519 and self.type == 'X25519':
+            self.module.fail_json(msg='Your cryptography version does not support X25519')
+        if not CRYPTOGRAPHY_HAS_X25519_FULL and self.type == 'X25519':
+            self.module.fail_json(msg='Your cryptography version does not support X25519 serialization')
+        if not CRYPTOGRAPHY_HAS_X448 and self.type == 'X448':
+            self.module.fail_json(msg='Your cryptography version does not support X448')
+        if not CRYPTOGRAPHY_HAS_ED25519 and self.type == 'Ed25519':
+            self.module.fail_json(msg='Your cryptography version does not support Ed25519')
+        if not CRYPTOGRAPHY_HAS_ED448 and self.type == 'Ed448':
+            self.module.fail_json(msg='Your cryptography version does not support Ed448')
+
+    def _get_wanted_format(self):
+        if self.format not in ('auto', 'auto_ignore'):
+            return self.format
+        if self.type in ('X25519', 'X448', 'Ed25519', 'Ed448'):
+            return 'pkcs8'
+        else:
+            return 'pkcs1'
+
+    def generate_private_key(self):
+        """(Re-)Generate private key."""
+        try:
+            if self.type == 'RSA':
+                self.private_key = cryptography.hazmat.primitives.asymmetric.rsa.generate_private_key(
+                    public_exponent=65537,  # OpenSSL always uses this
+                    key_size=self.size,
+                    backend=self.cryptography_backend
+                )
+            if self.type == 'DSA':
+                self.private_key = cryptography.hazmat.primitives.asymmetric.dsa.generate_private_key(
+                    key_size=self.size,
+                    backend=self.cryptography_backend
+                )
+            if CRYPTOGRAPHY_HAS_X25519_FULL and self.type == 'X25519':
+                self.private_key = cryptography.hazmat.primitives.asymmetric.x25519.X25519PrivateKey.generate()
+            if CRYPTOGRAPHY_HAS_X448 and self.type == 'X448':
+                self.private_key = cryptography.hazmat.primitives.asymmetric.x448.X448PrivateKey.generate()
+            if CRYPTOGRAPHY_HAS_ED25519 and self.type == 'Ed25519':
+                self.private_key = cryptography.hazmat.primitives.asymmetric.ed25519.Ed25519PrivateKey.generate()
+            if CRYPTOGRAPHY_HAS_ED448 and self.type == 'Ed448':
+                self.private_key = cryptography.hazmat.primitives.asymmetric.ed448.Ed448PrivateKey.generate()
+            if self.type == 'ECC' and self.curve in self.curves:
+                if self.curves[self.curve]['deprecated']:
+                    self.module.warn('Elliptic curves of type {0} should not be used for new keys!'.format(self.curve))
+                self.private_key = cryptography.hazmat.primitives.asymmetric.ec.generate_private_key(
+                    curve=self.curves[self.curve]['create'](self.size),
+                    backend=self.cryptography_backend
+                )
+        except cryptography.exceptions.UnsupportedAlgorithm as dummy:
+            self.module.fail_json(msg='Cryptography backend does not support the algorithm required for {0}'.format(self.type))
+
+    def get_private_key_data(self):
+        """Return bytes for self.private_key"""
+        # Select export format and encoding
+        try:
+            export_format = self._get_wanted_format()
+            export_encoding = cryptography.hazmat.primitives.serialization.Encoding.PEM
+            if export_format == 'pkcs1':
+                # "TraditionalOpenSSL" format is PKCS1
+                export_format = cryptography.hazmat.primitives.serialization.PrivateFormat.TraditionalOpenSSL
+            elif export_format == 'pkcs8':
+                export_format = cryptography.hazmat.primitives.serialization.PrivateFormat.PKCS8
+            elif export_format == 'raw':
+                export_format = cryptography.hazmat.primitives.serialization.PrivateFormat.Raw
+                export_encoding = cryptography.hazmat.primitives.serialization.Encoding.Raw
+        except AttributeError:
+            self.module.fail_json(msg='Cryptography backend does not support the selected output format "{0}"'.format(self.format))
+
+        # Select key encryption
+        encryption_algorithm = cryptography.hazmat.primitives.serialization.NoEncryption()
+        if self.cipher and self.passphrase:
+            if self.cipher == 'auto':
+                encryption_algorithm = cryptography.hazmat.primitives.serialization.BestAvailableEncryption(to_bytes(self.passphrase))
+            else:
+                self.module.fail_json(msg='Cryptography backend can only use "auto" for cipher option.')
+
+        # Serialize key
+        try:
+            return self.private_key.private_bytes(
+                encoding=export_encoding,
+                format=export_format,
+                encryption_algorithm=encryption_algorithm
+            )
+        except ValueError as dummy:
+            self.module.fail_json(
+                msg='Cryptography backend cannot serialize the private key in the required format "{0}"'.format(self.format)
+            )
+        except Exception as dummy:
+            self.module.fail_json(
+                msg='Error while serializing the private key in the required format "{0}"'.format(self.format),
+                exception=traceback.format_exc()
+            )
+
+    def _load_privatekey(self):
+        data = self.existing_private_key_bytes
+        try:
+            # Interpret bytes depending on format.
+            format = identify_private_key_format(data)
+            if format == 'raw':
+                if len(data) == 56 and CRYPTOGRAPHY_HAS_X448:
+                    return cryptography.hazmat.primitives.asymmetric.x448.X448PrivateKey.from_private_bytes(data)
+                if len(data) == 57 and CRYPTOGRAPHY_HAS_ED448:
+                    return cryptography.hazmat.primitives.asymmetric.ed448.Ed448PrivateKey.from_private_bytes(data)
+                if len(data) == 32:
+                    if CRYPTOGRAPHY_HAS_X25519 and (self.type == 'X25519' or not CRYPTOGRAPHY_HAS_ED25519):
+                        return cryptography.hazmat.primitives.asymmetric.x25519.X25519PrivateKey.from_private_bytes(data)
+                    if CRYPTOGRAPHY_HAS_ED25519 and (self.type == 'Ed25519' or not CRYPTOGRAPHY_HAS_X25519):
+                        return cryptography.hazmat.primitives.asymmetric.ed25519.Ed25519PrivateKey.from_private_bytes(data)
+                    if CRYPTOGRAPHY_HAS_X25519 and CRYPTOGRAPHY_HAS_ED25519:
+                        try:
+                            return cryptography.hazmat.primitives.asymmetric.x25519.X25519PrivateKey.from_private_bytes(data)
+                        except Exception:
+                            return cryptography.hazmat.primitives.asymmetric.ed25519.Ed25519PrivateKey.from_private_bytes(data)
+                raise PrivateKeyError('Cannot load raw key')
+            else:
+                return cryptography.hazmat.primitives.serialization.load_pem_private_key(
+                    data,
+                    None if self.passphrase is None else to_bytes(self.passphrase),
+                    backend=self.cryptography_backend
+                )
+        except Exception as e:
+            raise PrivateKeyError(e)
+
+    def _ensure_existing_private_key_loaded(self):
+        if self.existing_private_key is None and self.has_existing():
+            self.existing_private_key = self._load_privatekey()
+
+    def _check_passphrase(self):
+        try:
+            format = identify_private_key_format(self.existing_private_key_bytes)
+            if format == 'raw':
+                # Raw keys cannot be encrypted. To avoid incompatibilities, we try to
+                # actually load the key (and return False when this fails).
+                self._load_privatekey()
+                # Loading the key succeeded. Only return True when no passphrase was
+                # provided.
+                return self.passphrase is None
+            else:
+                return cryptography.hazmat.primitives.serialization.load_pem_private_key(
+                    self.existing_private_key_bytes,
+                    None if self.passphrase is None else to_bytes(self.passphrase),
+                    backend=self.cryptography_backend
+                )
+        except Exception as dummy:
+            return False
+
+    def _check_size_and_type(self):
+        if isinstance(self.existing_private_key, cryptography.hazmat.primitives.asymmetric.rsa.RSAPrivateKey):
+            return self.type == 'RSA' and self.size == self.existing_private_key.key_size
+        if isinstance(self.existing_private_key, cryptography.hazmat.primitives.asymmetric.dsa.DSAPrivateKey):
+            return self.type == 'DSA' and self.size == self.existing_private_key.key_size
+        if CRYPTOGRAPHY_HAS_X25519 and isinstance(self.existing_private_key, cryptography.hazmat.primitives.asymmetric.x25519.X25519PrivateKey):
+            return self.type == 'X25519'
+        if CRYPTOGRAPHY_HAS_X448 and isinstance(self.existing_private_key, cryptography.hazmat.primitives.asymmetric.x448.X448PrivateKey):
+            return self.type == 'X448'
+        if CRYPTOGRAPHY_HAS_ED25519 and isinstance(self.existing_private_key, cryptography.hazmat.primitives.asymmetric.ed25519.Ed25519PrivateKey):
+            return self.type == 'Ed25519'
+        if CRYPTOGRAPHY_HAS_ED448 and isinstance(self.existing_private_key, cryptography.hazmat.primitives.asymmetric.ed448.Ed448PrivateKey):
+            return self.type == 'Ed448'
+        if isinstance(self.existing_private_key, cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePrivateKey):
+            if self.type != 'ECC':
+                return False
+            if self.curve not in self.curves:
+                return False
+            return self.curves[self.curve]['verify'](self.existing_private_key)
+
+        return False
+
+    def _check_format(self):
+        if self.format == 'auto_ignore':
+            return True
+        try:
+            format = identify_private_key_format(self.existing_private_key_bytes)
+            return format == self._get_wanted_format()
+        except Exception as dummy:
+            return False
+
+
+def select_backend(module, backend):
+    if backend == 'auto':
+        # Detection what is possible
+        can_use_cryptography = CRYPTOGRAPHY_FOUND and CRYPTOGRAPHY_VERSION >= LooseVersion(MINIMAL_CRYPTOGRAPHY_VERSION)
+        can_use_pyopenssl = PYOPENSSL_FOUND and PYOPENSSL_VERSION >= LooseVersion(MINIMAL_PYOPENSSL_VERSION)
+
+        # Decision
+        if module.params['cipher'] and module.params['passphrase'] and module.params['cipher'] != 'auto':
+            # First try pyOpenSSL, then cryptography
+            if can_use_pyopenssl:
+                backend = 'pyopenssl'
+            elif can_use_cryptography:
+                backend = 'cryptography'
+        else:
+            # First try cryptography, then pyOpenSSL
+            if can_use_cryptography:
+                backend = 'cryptography'
+            elif can_use_pyopenssl:
+                backend = 'pyopenssl'
+
+        # Success?
+        if backend == 'auto':
+            module.fail_json(msg=("Can't detect any of the required Python libraries "
+                                  "cryptography (>= {0}) or PyOpenSSL (>= {1})").format(
+                                      MINIMAL_CRYPTOGRAPHY_VERSION,
+                                      MINIMAL_PYOPENSSL_VERSION))
+    if backend == 'pyopenssl':
+        if not PYOPENSSL_FOUND:
+            module.fail_json(msg=missing_required_lib('pyOpenSSL >= {0}'.format(MINIMAL_PYOPENSSL_VERSION)),
+                             exception=PYOPENSSL_IMP_ERR)
+        module.deprecate('The module is using the PyOpenSSL backend. This backend has been deprecated',
+                         version='2.0.0', collection_name='community.crypto')
+        return backend, PrivateKeyPyOpenSSLBackend(module)
+    elif backend == 'cryptography':
+        if not CRYPTOGRAPHY_FOUND:
+            module.fail_json(msg=missing_required_lib('cryptography >= {0}'.format(MINIMAL_CRYPTOGRAPHY_VERSION)),
+                             exception=CRYPTOGRAPHY_IMP_ERR)
+        return backend, PrivateKeyCryptographyBackend(module)
+    else:
+        raise Exception('Unsupported value for backend: {0}'.format(backend))
+
+
+def get_privatekey_argument_spec():
+    return ArgumentSpec(
+        argument_spec=dict(
+            size=dict(type='int', default=4096),
+            type=dict(type='str', default='RSA', choices=[
+                'DSA', 'ECC', 'Ed25519', 'Ed448', 'RSA', 'X25519', 'X448'
+            ]),
+            curve=dict(type='str', choices=[
+                'secp224r1', 'secp256k1', 'secp256r1', 'secp384r1', 'secp521r1',
+                'secp192r1', 'brainpoolP256r1', 'brainpoolP384r1', 'brainpoolP512r1',
+                'sect163k1', 'sect163r2', 'sect233k1', 'sect233r1', 'sect283k1',
+                'sect283r1', 'sect409k1', 'sect409r1', 'sect571k1', 'sect571r1',
+            ]),
+            passphrase=dict(type='str', no_log=True),
+            cipher=dict(type='str'),
+            format=dict(type='str', default='auto_ignore', choices=['pkcs1', 'pkcs8', 'raw', 'auto', 'auto_ignore']),
+            format_mismatch=dict(type='str', default='regenerate', choices=['regenerate', 'convert']),
+            select_crypto_backend=dict(type='str', choices=['auto', 'pyopenssl', 'cryptography'], default='auto'),
+            regenerate=dict(
+                type='str',
+                default='full_idempotence',
+                choices=['never', 'fail', 'partial_idempotence', 'full_idempotence', 'always']
+            ),
+        ),
+        required_together=[
+            ['cipher', 'passphrase']
+        ],
+        required_if=[
+            ['type', 'ECC', ['curve']],
+        ],
+    )

plugins/module_utils/crypto/openssh.py

@@ -0,0 +1,36 @@
+# -*- coding: utf-8 -*-
+#
+# (c) 2020, Doug Stanley <doug+ansible@technologixllc.com>
+#
+# Ansible is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# Ansible is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Ansible.  If not, see <http://www.gnu.org/licenses/>.
+
+from __future__ import absolute_import, division, print_function
+__metaclass__ = type
+
+
+import re
+
+
+def parse_openssh_version(version_string):
+    """Parse the version output of ssh -V and return version numbers that can be compared"""
+
+    parsed_result = re.match(
+        r"^.*openssh_(?P<version>[0-9.]+)(p?[0-9]+)[^0-9]*.*$", version_string.lower()
+    )
+    if parsed_result is not None:
+        version = parsed_result.group("version").strip()
+    else:
+        version = None
+
+    return version

plugins/module_utils/crypto/pem.py

@@ -54,3 +54,21 @@ def identify_private_key_format(content):
     except UnicodeDecodeError:
         pass
     return 'raw'
+
+
+def split_pem_list(text, keep_inbetween=False):
+    '''
+    Split concatenated PEM objects into a list of strings, where each is one PEM object.
+    '''
+    result = []
+    current = [] if keep_inbetween else None
+    for line in text.splitlines(True):
+        if line.strip():
+            if not keep_inbetween and line.startswith('-----BEGIN '):
+                current = []
+            if current is not None:
+                current.append(line)
+                if line.startswith('-----END '):
+                    result.append(''.join(current))
+                    current = [] if keep_inbetween else None
+    return result

plugins/module_utils/crypto/support.py

@@ -83,11 +83,9 @@ def get_fingerprint_of_bytes(source):
     return fingerprint
 
 
-def get_fingerprint(path, passphrase=None, content=None, backend='pyopenssl'):
+def get_fingerprint_of_privatekey(privatekey, backend='pyopenssl'):
     """Generate the fingerprint of the public key. """
 
-    privatekey = load_privatekey(path, passphrase=passphrase, content=content, check_passphrase=False, backend=backend)
-
     if backend == 'pyopenssl':
         try:
             publickey = crypto.dump_publickey(crypto.FILETYPE_ASN1, privatekey)
@@ -112,6 +110,14 @@ def get_fingerprint(path, passphrase=None, content=None, backend='pyopenssl'):
     return get_fingerprint_of_bytes(publickey)
 
 
+def get_fingerprint(path, passphrase=None, content=None, backend='pyopenssl'):
+    """Generate the fingerprint of the public key. """
+
+    privatekey = load_privatekey(path, passphrase=passphrase, content=content, check_passphrase=False, backend=backend)
+
+    return get_fingerprint_of_privatekey(privatekey, backend=backend)
+
+
 def load_privatekey(path, passphrase=None, check_passphrase=True, content=None, backend='pyopenssl'):
     """Load the specified OpenSSL private key.
 
@@ -125,57 +131,57 @@ def load_privatekey(path, passphrase=None, check_passphrase=True, content=None,
                 priv_key_detail = b_priv_key_fh.read()
         else:
             priv_key_detail = content
-
-        if backend == 'pyopenssl':
-
-            # First try: try to load with real passphrase (resp. empty string)
-            # Will work if this is the correct passphrase, or the key is not
-            # password-protected.
-            try:
-                result = crypto.load_privatekey(crypto.FILETYPE_PEM,
-                                                priv_key_detail,
-                                                to_bytes(passphrase or ''))
-            except crypto.Error as e:
-                if len(e.args) > 0 and len(e.args[0]) > 0:
-                    if e.args[0][0][2] in ('bad decrypt', 'bad password read'):
-                        # This happens in case we have the wrong passphrase.
-                        if passphrase is not None:
-                            raise OpenSSLBadPassphraseError('Wrong passphrase provided for private key!')
-                        else:
-                            raise OpenSSLBadPassphraseError('No passphrase provided, but private key is password-protected!')
-                raise OpenSSLObjectError('Error while deserializing key: {0}'.format(e))
-            if check_passphrase:
-                # Next we want to make sure that the key is actually protected by
-                # a passphrase (in case we did try the empty string before, make
-                # sure that the key is not protected by the empty string)
-                try:
-                    crypto.load_privatekey(crypto.FILETYPE_PEM,
-                                           priv_key_detail,
-                                           to_bytes('y' if passphrase == 'x' else 'x'))
-                    if passphrase is not None:
-                        # Since we can load the key without an exception, the
-                        # key isn't password-protected
-                        raise OpenSSLBadPassphraseError('Passphrase provided, but private key is not password-protected!')
-                except crypto.Error as e:
-                    if passphrase is None and len(e.args) > 0 and len(e.args[0]) > 0:
-                        if e.args[0][0][2] in ('bad decrypt', 'bad password read'):
-                            # The key is obviously protected by the empty string.
-                            # Don't do this at home (if it's possible at all)...
-                            raise OpenSSLBadPassphraseError('No passphrase provided, but private key is password-protected!')
-        elif backend == 'cryptography':
-            try:
-                result = load_pem_private_key(priv_key_detail,
-                                              None if passphrase is None else to_bytes(passphrase),
-                                              cryptography_backend())
-            except TypeError:
-                raise OpenSSLBadPassphraseError('Wrong or empty passphrase provided for private key')
-            except ValueError:
-                raise OpenSSLBadPassphraseError('Wrong passphrase provided for private key')
-
-        return result
     except (IOError, OSError) as exc:
         raise OpenSSLObjectError(exc)
 
+    if backend == 'pyopenssl':
+
+        # First try: try to load with real passphrase (resp. empty string)
+        # Will work if this is the correct passphrase, or the key is not
+        # password-protected.
+        try:
+            result = crypto.load_privatekey(crypto.FILETYPE_PEM,
+                                            priv_key_detail,
+                                            to_bytes(passphrase or ''))
+        except crypto.Error as e:
+            if len(e.args) > 0 and len(e.args[0]) > 0:
+                if e.args[0][0][2] in ('bad decrypt', 'bad password read'):
+                    # This happens in case we have the wrong passphrase.
+                    if passphrase is not None:
+                        raise OpenSSLBadPassphraseError('Wrong passphrase provided for private key!')
+                    else:
+                        raise OpenSSLBadPassphraseError('No passphrase provided, but private key is password-protected!')
+            raise OpenSSLObjectError('Error while deserializing key: {0}'.format(e))
+        if check_passphrase:
+            # Next we want to make sure that the key is actually protected by
+            # a passphrase (in case we did try the empty string before, make
+            # sure that the key is not protected by the empty string)
+            try:
+                crypto.load_privatekey(crypto.FILETYPE_PEM,
+                                       priv_key_detail,
+                                       to_bytes('y' if passphrase == 'x' else 'x'))
+                if passphrase is not None:
+                    # Since we can load the key without an exception, the
+                    # key isn't password-protected
+                    raise OpenSSLBadPassphraseError('Passphrase provided, but private key is not password-protected!')
+            except crypto.Error as e:
+                if passphrase is None and len(e.args) > 0 and len(e.args[0]) > 0:
+                    if e.args[0][0][2] in ('bad decrypt', 'bad password read'):
+                        # The key is obviously protected by the empty string.
+                        # Don't do this at home (if it's possible at all)...
+                        raise OpenSSLBadPassphraseError('No passphrase provided, but private key is password-protected!')
+    elif backend == 'cryptography':
+        try:
+            result = load_pem_private_key(priv_key_detail,
+                                          None if passphrase is None else to_bytes(passphrase),
+                                          cryptography_backend())
+        except TypeError:
+            raise OpenSSLBadPassphraseError('Wrong or empty passphrase provided for private key')
+        except ValueError:
+            raise OpenSSLBadPassphraseError('Wrong passphrase provided for private key')
+
+    return result
+
 
 def load_certificate(path, content=None, backend='pyopenssl'):
     """Load the specified certificate."""
@@ -186,12 +192,15 @@ def load_certificate(path, content=None, backend='pyopenssl'):
                 cert_content = cert_fh.read()
         else:
             cert_content = content
-        if backend == 'pyopenssl':
-            return crypto.load_certificate(crypto.FILETYPE_PEM, cert_content)
-        elif backend == 'cryptography':
-            return x509.load_pem_x509_certificate(cert_content, cryptography_backend())
     except (IOError, OSError) as exc:
         raise OpenSSLObjectError(exc)
+    if backend == 'pyopenssl':
+        return crypto.load_certificate(crypto.FILETYPE_PEM, cert_content)
+    elif backend == 'cryptography':
+        try:
+            return x509.load_pem_x509_certificate(cert_content, cryptography_backend())
+        except ValueError as exc:
+            raise OpenSSLObjectError(exc)
 
 
 def load_certificate_request(path, content=None, backend='pyopenssl'):
@@ -207,7 +216,10 @@ def load_certificate_request(path, content=None, backend='pyopenssl'):
     if backend == 'pyopenssl':
         return crypto.load_certificate_request(crypto.FILETYPE_PEM, csr_content)
     elif backend == 'cryptography':
-        return x509.load_pem_x509_csr(csr_content, cryptography_backend())
+        try:
+            return x509.load_pem_x509_csr(csr_content, cryptography_backend())
+        except ValueError as exc:
+            raise OpenSSLObjectError(exc)
 
 
 def parse_name_field(input_dict):
@@ -343,6 +355,10 @@ class OpenSSLObject(object):
 
     def remove(self, module):
         """Remove the resource from the filesystem."""
+        if self.check_mode:
+            if os.path.exists(self.path):
+                self.changed = True
+            return
 
         try:
             os.remove(self.path)

plugins/modules/acme_account.py

@@ -31,6 +31,8 @@ seealso:
     description: Retrieves facts about an ACME account.
   - module: community.crypto.openssl_privatekey
     description: Can be used to create a private account key.
+  - module: community.crypto.openssl_privatekey_pipe
+    description: Can be used to create a private account key without writing it to disk.
   - module: community.crypto.acme_inspect
     description: Allows to debug problems.
 extends_documentation_fragment:
@@ -86,6 +88,12 @@ options:
       - "Mutually exclusive with C(new_account_key_src)."
       - "Required if C(new_account_key_src) is not used and state is C(changed_key)."
     type: str
+  new_account_key_passphrase:
+    description:
+      - Phassphrase to use to decode the new account key.
+      - "B(Note:) this is not supported by the C(openssl) backend, only by the C(cryptography) backend."
+    type: str
+    version_added: 1.6.0
   external_account_binding:
     description:
       - Allows to provide external account binding data during account creation.
@@ -156,11 +164,19 @@ import base64
 
 from ansible.module_utils.basic import AnsibleModule
 
-from ansible_collections.community.crypto.plugins.module_utils.acme import (
-    ModuleFailException,
-    ACMEAccount,
-    handle_standard_module_arguments,
+from ansible_collections.community.crypto.plugins.module_utils.acme.acme import (
+    create_backend,
     get_default_argspec,
+    ACMEClient,
+)
+
+from ansible_collections.community.crypto.plugins.module_utils.acme.account import (
+    ACMEAccount,
+)
+
+from ansible_collections.community.crypto.plugins.module_utils.acme.errors import (
+    ModuleFailException,
+    KeyParsingError,
 )
 
 
@@ -173,6 +189,7 @@ def main():
         contact=dict(type='list', elements='str', default=[]),
         new_account_key_src=dict(type='path'),
         new_account_key_content=dict(type='str', no_log=True),
+        new_account_key_passphrase=dict(type='str', no_log=True),
         external_account_binding=dict(type='dict', options=dict(
             kid=dict(type='str', required=True),
             alg=dict(type='str', required=True, choices=['HS256', 'HS384', 'HS512']),
@@ -195,7 +212,7 @@ def main():
         ),
         supports_check_mode=True,
     )
-    handle_standard_module_arguments(module, needs_acme_v2=True)
+    backend = create_backend(module, True)
 
     if module.params['external_account_binding']:
         # Make sure padding is there
@@ -210,7 +227,8 @@ def main():
         module.params['external_account_binding']['key'] = key
 
     try:
-        account = ACMEAccount(module)
+        client = ACMEClient(module, backend)
+        account = ACMEAccount(client)
         changed = False
         state = module.params.get('state')
         diff_before = {}
@@ -219,7 +237,7 @@ def main():
             created, account_data = account.setup_account(allow_creation=False)
             if account_data:
                 diff_before = dict(account_data)
-                diff_before['public_account_key'] = account.key_data['jwk']
+                diff_before['public_account_key'] = client.account_key_data['jwk']
             if created:
                 raise AssertionError('Unwanted account creation')
             if account_data is not None:
@@ -229,9 +247,8 @@ def main():
                     payload = {
                         'status': 'deactivated'
                     }
-                    result, info = account.send_signed_request(account.uri, payload)
-                    if info['status'] != 200:
-                        raise ModuleFailException('Error deactivating account: {0} {1}'.format(info['status'], result))
+                    result, info = client.send_signed_request(
+                        client.account_uri, payload, error_msg='Failed to deactivate account', expected_status_codes=[200])
                 changed = True
         elif state == 'present':
             allow_creation = module.params.get('allow_creation')
@@ -250,21 +267,23 @@ def main():
                 diff_before = {}
             else:
                 diff_before = dict(account_data)
-                diff_before['public_account_key'] = account.key_data['jwk']
+                diff_before['public_account_key'] = client.account_key_data['jwk']
             updated = False
             if not created:
                 updated, account_data = account.update_account(account_data, contact)
             changed = created or updated
             diff_after = dict(account_data)
-            diff_after['public_account_key'] = account.key_data['jwk']
+            diff_after['public_account_key'] = client.account_key_data['jwk']
         elif state == 'changed_key':
             # Parse new account key
-            error, new_key_data = account.parse_key(
-                module.params.get('new_account_key_src'),
-                module.params.get('new_account_key_content')
-            )
-            if error:
-                raise ModuleFailException("error while parsing account key: %s" % error)
+            try:
+                new_key_data = client.parse_key(
+                    module.params.get('new_account_key_src'),
+                    module.params.get('new_account_key_content'),
+                    passphrase=module.params.get('new_account_key_passphrase'),
+                )
+            except KeyParsingError as e:
+                raise ModuleFailException("Error while parsing new account key: {msg}".format(msg=e.msg))
             # Verify that the account exists and has not been deactivated
             created, account_data = account.setup_account(allow_creation=False)
             if created:
@@ -272,30 +291,29 @@ def main():
             if account_data is None:
                 raise ModuleFailException(msg='Account does not exist or is deactivated.')
             diff_before = dict(account_data)
-            diff_before['public_account_key'] = account.key_data['jwk']
+            diff_before['public_account_key'] = client.account_key_data['jwk']
             # Now we can start the account key rollover
             if not module.check_mode:
                 # Compose inner signed message
                 # https://tools.ietf.org/html/rfc8555#section-7.3.5
-                url = account.directory['keyChange']
+                url = client.directory['keyChange']
                 protected = {
                     "alg": new_key_data['alg'],
                     "jwk": new_key_data['jwk'],
                     "url": url,
                 }
                 payload = {
-                    "account": account.uri,
+                    "account": client.account_uri,
                     "newKey": new_key_data['jwk'],  # specified in draft 12 and older
-                    "oldKey": account.jwk,  # specified in draft 13 and newer
+                    "oldKey": client.account_jwk,  # specified in draft 13 and newer
                 }
-                data = account.sign_request(protected, payload, new_key_data)
+                data = client.sign_request(protected, payload, new_key_data)
                 # Send request and verify result
-                result, info = account.send_signed_request(url, data)
-                if info['status'] != 200:
-                    raise ModuleFailException('Error account key rollover: {0} {1}'.format(info['status'], result))
+                result, info = client.send_signed_request(
+                    url, data, error_msg='Failed to rollover account key', expected_status_codes=[200])
                 if module._diff:
-                    account.key_data = new_key_data
-                    account.jws_header['alg'] = new_key_data['alg']
+                    client.account_key_data = new_key_data
+                    client.account_jws_header['alg'] = new_key_data['alg']
                     diff_after = account.get_account_data()
             elif module._diff:
                 # Kind of fake diff_after
@@ -304,7 +322,7 @@ def main():
             changed = True
         result = {
             'changed': changed,
-            'account_uri': account.uri,
+            'account_uri': client.account_uri,
         }
         if module._diff:
             result['diff'] = {

plugins/modules/acme_account_info.py

@@ -23,12 +23,17 @@ notes:
       accounts."
    - "This module was called C(acme_account_facts) before Ansible 2.8. The usage
       did not change."
+   - Supports C(check_mode).
 options:
   retrieve_orders:
     description:
       - "Whether to retrieve the list of order URLs or order objects, if provided
          by the ACME server."
       - "A value of C(ignore) will not fetch the list of orders."
+      - "If the value is not C(ignore) and the ACME server supports orders, the C(order_uris)
+         return value is always populated. The C(orders) return value currently depends on
+         whether this option is set to C(url_list) or C(object_list). In community.crypto 2.0.0,
+         it will only be returned if this option is set to C(object_list)."
       - "Currently, Let's Encrypt does not return orders, so the C(orders) result
          will always be empty."
     type: str
@@ -55,9 +60,11 @@ EXAMPLES = '''
     that:
       - account_data.exists
 - name: Print account URI
-  debug: var=account_data.account_uri
+  ansible.builtin.debug:
+    var: account_data.account_uri
 - name: Print account contacts
-  debug: var=account_data.account.contact
+  ansible.builtin.debug:
+    var: account_data.account.contact
 
 - name: Check whether the account exists and is accessible with the given account key
   acme_account_info:
@@ -69,7 +76,8 @@ EXAMPLES = '''
     that:
       - account_data.exists
 - name: Print account contacts
-  debug: var=account_data.account.contact
+  ansible.builtin.debug:
+    var: account_data.account.contact
 '''
 
 RETURN = '''
@@ -117,7 +125,8 @@ account:
 orders:
   description:
     - "The list of orders."
-    - "If I(retrieve_orders) is C(url_list), this will be a list of URLs."
+    - "If I(retrieve_orders) is C(url_list), this will be a list of URLs. In community.crypto 2.0.0,
+       this return value will no longer be returned for C(url_list)."
     - "If I(retrieve_orders) is C(object_list), this will be a list of objects."
   type: list
   #elements: ... depends on retrieve_orders
@@ -190,27 +199,45 @@ orders:
         - The URL for retrieving the certificate.
       type: str
       returned: when certificate was issued
+
+order_uris:
+  description:
+    - "The list of orders."
+    - "If I(retrieve_orders) is C(url_list), this will be a list of URLs."
+    - "If I(retrieve_orders) is C(object_list), this will be a list of objects."
+  type: list
+  elements: str
+  returned: if account exists, I(retrieve_orders) is not C(ignore), and server supports order listing
+  version_added: 1.5.0
 '''
 
 from ansible.module_utils.basic import AnsibleModule
 
-from ansible_collections.community.crypto.plugins.module_utils.acme import (
-    ModuleFailException,
-    ACMEAccount,
-    handle_standard_module_arguments,
-    process_links,
+from ansible_collections.community.crypto.plugins.module_utils.acme.acme import (
+    create_backend,
     get_default_argspec,
+    ACMEClient,
+)
+
+from ansible_collections.community.crypto.plugins.module_utils.acme.account import (
+    ACMEAccount,
+)
+
+from ansible_collections.community.crypto.plugins.module_utils.acme.errors import ModuleFailException
+
+from ansible_collections.community.crypto.plugins.module_utils.acme.utils import (
+    process_links,
 )
 
 
-def get_orders_list(module, account, orders_url):
+def get_orders_list(module, client, orders_url):
     '''
     Retrieves orders list (handles pagination).
     '''
     orders = []
     while orders_url:
         # Get part of orders list
-        res, info = account.get_request(orders_url, parse_json_result=True, fail_on_error=True)
+        res, info = client.get_request(orders_url, parse_json_result=True, fail_on_error=True)
         if not res.get('orders'):
             if orders:
                 module.warn('When retrieving orders list part {0}, got empty result list'.format(orders_url))
@@ -233,11 +260,11 @@ def get_orders_list(module, account, orders_url):
     return orders
 
 
-def get_order(account, order_url):
+def get_order(client, order_url):
     '''
     Retrieve order data.
     '''
-    return account.get_request(order_url, parse_json_result=True, fail_on_error=True)[0]
+    return client.get_request(order_url, parse_json_result=True, fail_on_error=True)[0]
 
 
 def main():
@@ -258,10 +285,11 @@ def main():
     if module._name in ('acme_account_facts', 'community.crypto.acme_account_facts'):
         module.deprecate("The 'acme_account_facts' module has been renamed to 'acme_account_info'",
                          version='2.0.0', collection_name='community.crypto')
-    handle_standard_module_arguments(module, needs_acme_v2=True)
+    backend = create_backend(module, True)
 
     try:
-        account = ACMEAccount(module)
+        client = ACMEClient(module, backend)
+        account = ACMEAccount(client)
         # Check whether account exists
         created, account_data = account.setup_account(
             [],
@@ -272,22 +300,28 @@ def main():
             raise AssertionError('Unwanted account creation')
         result = {
             'changed': False,
-            'exists': account.uri is not None,
-            'account_uri': account.uri,
+            'exists': client.account_uri is not None,
+            'account_uri': client.account_uri,
         }
-        if account.uri is not None:
+        if client.account_uri is not None:
             # Make sure promised data is there
             if 'contact' not in account_data:
                 account_data['contact'] = []
-            account_data['public_account_key'] = account.key_data['jwk']
+            account_data['public_account_key'] = client.account_key_data['jwk']
             result['account'] = account_data
             # Retrieve orders list
             if account_data.get('orders') and module.params['retrieve_orders'] != 'ignore':
-                orders = get_orders_list(module, account, account_data['orders'])
+                orders = get_orders_list(module, client, account_data['orders'])
+                result['order_uris'] = orders
                 if module.params['retrieve_orders'] == 'url_list':
+                    module.deprecate(
+                        'retrieve_orders=url_list now returns the order URI list as `order_uris`.'
+                        ' Right now it also returns this list as `orders` for backwards compatibility,'
+                        ' but this will stop in community.crypto 2.0.0',
+                        version='2.0.0', collection_name='community.crypto')
                     result['orders'] = orders
-                else:
-                    result['orders'] = [get_order(account, order) for order in orders]
+                if module.params['retrieve_orders'] == 'object_list':
+                    result['orders'] = [get_order(client, order) for order in orders]
         module.exit_json(**result)
     except ModuleFailException as e:
         e.do_fail(module)

plugins/modules/acme_certificate.py

@@ -62,8 +62,12 @@ seealso:
     description: Helps preparing C(tls-alpn-01) challenges.
   - module: community.crypto.openssl_privatekey
     description: Can be used to create private keys (both for certificates and accounts).
+  - module: community.crypto.openssl_privatekey_pipe
+    description: Can be used to create private keys without writing it to disk (both for certificates and accounts).
   - module: community.crypto.openssl_csr
     description: Can be used to create a Certificate Signing Request (CSR).
+  - module: community.crypto.openssl_csr_pipe
+    description: Can be used to create a Certificate Signing Request (CSR) without writing it to disk.
   - module: community.crypto.certificate_complete_chain
     description: Allows to find the root certificate for the returned fullchain.
   - module: community.crypto.acme_certificate_revoke
@@ -117,7 +121,7 @@ options:
   csr:
     description:
       - "File containing the CSR for the new certificate."
-      - "Can be created with C(openssl req ...)."
+      - "Can be created with M(community.crypto.openssl_csr) or C(openssl req ...)."
       - "The CSR may contain multiple Subject Alternate Names, but each one
          will lead to an individual challenge that must be fulfilled for the
          CSR to be signed."
@@ -125,9 +129,23 @@ options:
          account key. This is a bad idea from a security point of view, and
          the CA should not accept the CSR. The ACME server should return an
          error in this case."
+      - Precisely one of I(csr) or I(csr_content) must be specified.
     type: path
-    required: true
     aliases: ['src']
+  csr_content:
+    description:
+      - "Content of the CSR for the new certificate."
+      - "Can be created with M(community.crypto.openssl_csr_pipe) or C(openssl req ...)."
+      - "The CSR may contain multiple Subject Alternate Names, but each one
+         will lead to an individual challenge that must be fulfilled for the
+         CSR to be signed."
+      - "I(Note): the private key used to create the CSR I(must not) be the
+         account key. This is a bad idea from a security point of view, and
+         the CA should not accept the CSR. The ACME server should return an
+         error in this case."
+      - Precisely one of I(csr) or I(csr_content) must be specified.
+    type: str
+    version_added: 1.2.0
   data:
     description:
       - "The data to validate ongoing challenges. This must be specified for
@@ -279,7 +297,7 @@ EXAMPLES = r'''
 - name: Create a challenge for sample.com using a account key file.
   community.crypto.acme_certificate:
     account_key_src: /etc/pki/cert/private/account.key
-    csr: /etc/pki/cert/csr/sample.com.csr
+    csr_content: "{{ lookup('file', '/etc/pki/cert/csr/sample.com.csr') }}"
     dest: /etc/httpd/ssl/sample.com.crt
     fullchain_dest: /etc/httpd/ssl/sample.com-fullchain.crt
   register: sample_com_challenge
@@ -297,7 +315,7 @@ EXAMPLES = r'''
 # - copy:
 #     dest: /var/www/{{ item.key }}/{{ item.value['http-01']['resource'] }}
 #     content: "{{ item.value['http-01']['resource_value'] }}"
-#   loop: "{{ sample_com_challenge.challenge_data | dictsort }}"
+#   loop: "{{ sample_com_challenge.challenge_data | dict2items }}"
 #   when: sample_com_challenge is changed
 
 - name: Let the challenge be validated and retrieve the cert and intermediate certificate
@@ -349,7 +367,7 @@ EXAMPLES = r'''
 #     # Note: item.value is a list of TXT entries, and route53
 #     # requires every entry to be enclosed in quotes
 #     value: "{{ item.value | map('regex_replace', '^(.*)$', '\"\\1\"' ) | list }}"
-#   loop: "{{ sample_com_challenge.challenge_data_dns | dictsort }}"
+#   loop: "{{ sample_com_challenge.challenge_data_dns | dict2items }}"
 #   when: sample_com_challenge is changed
 
 - name: Let the challenge be validated and retrieve the cert and intermediate certificate
@@ -490,102 +508,81 @@ all_chains:
       returned: always
 '''
 
-import base64
-import binascii
-import hashlib
 import os
-import re
-import textwrap
-import time
-import traceback
 
-from datetime import datetime
+from ansible.module_utils.basic import AnsibleModule
 
-from ansible.module_utils.basic import AnsibleModule, missing_required_lib
-from ansible.module_utils._text import to_bytes, to_native
-
-from ansible_collections.community.crypto.plugins.module_utils.crypto.support import (
-    parse_name_field,
-)
-
-from ansible_collections.community.crypto.plugins.module_utils.crypto.cryptography_support import (
-    cryptography_name_to_oid,
-)
-
-from ansible_collections.community.crypto.plugins.module_utils.acme import (
-    ModuleFailException,
-    write_file,
-    nopad_b64,
-    pem_to_der,
-    ACMEAccount,
-    HAS_CURRENT_CRYPTOGRAPHY,
-    cryptography_get_csr_identifiers,
-    openssl_get_csr_identifiers,
-    cryptography_get_cert_days,
-    handle_standard_module_arguments,
-    process_links,
+from ansible_collections.community.crypto.plugins.module_utils.acme.acme import (
+    create_backend,
     get_default_argspec,
+    ACMEClient,
 )
-from ansible_collections.community.crypto.plugins.module_utils.compat import ipaddress as compat_ipaddress
 
-try:
-    import cryptography
-    import cryptography.hazmat.backends
-    import cryptography.x509
-except ImportError:
-    CRYPTOGRAPHY_IMP_ERR = traceback.format_exc()
-    CRYPTOGRAPHY_FOUND = False
-else:
-    CRYPTOGRAPHY_FOUND = True
+from ansible_collections.community.crypto.plugins.module_utils.acme.account import (
+    ACMEAccount,
+)
+
+from ansible_collections.community.crypto.plugins.module_utils.acme.challenges import (
+    combine_identifier,
+    split_identifier,
+    Authorization,
+)
+
+from ansible_collections.community.crypto.plugins.module_utils.acme.certificates import (
+    retrieve_acme_v1_certificate,
+    CertificateChain,
+    Criterium,
+)
+
+from ansible_collections.community.crypto.plugins.module_utils.acme.errors import (
+    ModuleFailException,
+)
+
+from ansible_collections.community.crypto.plugins.module_utils.acme.io import (
+    write_file,
+)
+
+from ansible_collections.community.crypto.plugins.module_utils.acme.orders import (
+    Order,
+)
+
+from ansible_collections.community.crypto.plugins.module_utils.acme.utils import (
+    pem_to_der,
+)
 
 
-def get_cert_days(module, cert_file):
-    '''
-    Return the days the certificate in cert_file remains valid and -1
-    if the file was not found. If cert_file contains more than one
-    certificate, only the first one will be considered.
-    '''
-    if HAS_CURRENT_CRYPTOGRAPHY:
-        return cryptography_get_cert_days(module, cert_file)
-    if not os.path.exists(cert_file):
-        return -1
-
-    openssl_bin = module.get_bin_path('openssl', True)
-    openssl_cert_cmd = [openssl_bin, "x509", "-in", cert_file, "-noout", "-text"]
-    dummy, out, dummy = module.run_command(openssl_cert_cmd, check_rc=True, encoding=None)
-    try:
-        not_after_str = re.search(r"\s+Not After\s*:\s+(.*)", out.decode('utf8')).group(1)
-        not_after = datetime.fromtimestamp(time.mktime(time.strptime(not_after_str, '%b %d %H:%M:%S %Y %Z')))
-    except AttributeError:
-        raise ModuleFailException("No 'Not after' date found in {0}".format(cert_file))
-    except ValueError:
-        raise ModuleFailException("Failed to parse 'Not after' date of {0}".format(cert_file))
-    now = datetime.utcnow()
-    return (not_after - now).days
-
-
-class ACMEClient(object):
+class ACMECertificateClient(object):
     '''
     ACME client class. Uses an ACME account object and a CSR to
     start and validate ACME challenges and download the respective
     certificates.
     '''
 
-    def __init__(self, module):
+    def __init__(self, module, backend):
         self.module = module
         self.version = module.params['acme_version']
         self.challenge = module.params['challenge']
         self.csr = module.params['csr']
+        self.csr_content = module.params['csr_content']
         self.dest = module.params.get('dest')
         self.fullchain_dest = module.params.get('fullchain_dest')
         self.chain_dest = module.params.get('chain_dest')
-        self.account = ACMEAccount(module)
-        self.directory = self.account.directory
+        self.client = ACMEClient(module, backend)
+        self.account = ACMEAccount(self.client)
+        self.directory = self.client.directory
         self.data = module.params['data']
         self.authorizations = None
         self.cert_days = -1
+        self.order = None
         self.order_uri = self.data.get('order_uri') if self.data else None
-        self.finalize_uri = None
+        self.all_chains = None
+        self.select_chain_matcher = []
+
+        if self.module.params['select_chain']:
+            for criterium_idx, criterium in enumerate(self.module.params['select_chain']):
+                self.select_chain_matcher.append(
+                    self.client.backend.create_chain_matcher(
+                        Criterium(criterium, index=criterium_idx)))
 
         # Make sure account exists
         modify_account = module.params['modify_account']
@@ -613,290 +610,11 @@ class ACMEClient(object):
             # signed ACME request.
             pass
 
-        if not os.path.exists(self.csr):
+        if self.csr is not None and not os.path.exists(self.csr):
             raise ModuleFailException("CSR %s not found" % (self.csr))
 
-        self._openssl_bin = module.get_bin_path('openssl', True)
-
         # Extract list of identifiers from CSR
-        self.identifiers = self._get_csr_identifiers()
-
-    def _get_csr_identifiers(self):
-        '''
-        Parse the CSR and return the list of requested identifiers
-        '''
-        if HAS_CURRENT_CRYPTOGRAPHY:
-            return cryptography_get_csr_identifiers(self.module, self.csr)
-        else:
-            return openssl_get_csr_identifiers(self._openssl_bin, self.module, self.csr)
-
-    def _add_or_update_auth(self, identifier_type, identifier, auth):
-        '''
-        Add or update the given authorization in the global authorizations list.
-        Return True if the auth was updated/added and False if no change was
-        necessary.
-        '''
-        if self.authorizations.get(identifier_type + ':' + identifier) == auth:
-            return False
-        self.authorizations[identifier_type + ':' + identifier] = auth
-        return True
-
-    def _new_authz_v1(self, identifier_type, identifier):
-        '''
-        Create a new authorization for the given identifier.
-        Return the authorization object of the new authorization
-        https://tools.ietf.org/html/draft-ietf-acme-acme-02#section-6.4
-        '''
-        new_authz = {
-            "resource": "new-authz",
-            "identifier": {"type": identifier_type, "value": identifier},
-        }
-
-        result, info = self.account.send_signed_request(self.directory['new-authz'], new_authz)
-        if info['status'] not in [200, 201]:
-            raise ModuleFailException("Error requesting challenges: CODE: {0} RESULT: {1}".format(info['status'], result))
-        else:
-            result['uri'] = info['location']
-            return result
-
-    def _get_challenge_data(self, auth, identifier_type, identifier):
-        '''
-        Returns a dict with the data for all proposed (and supported) challenges
-        of the given authorization.
-        '''
-
-        data = {}
-        # no need to choose a specific challenge here as this module
-        # is not responsible for fulfilling the challenges. Calculate
-        # and return the required information for each challenge.
-        for challenge in auth['challenges']:
-            challenge_type = challenge['type']
-            token = re.sub(r"[^A-Za-z0-9_\-]", "_", challenge['token'])
-            keyauthorization = self.account.get_keyauthorization(token)
-
-            if challenge_type == 'http-01':
-                # https://tools.ietf.org/html/rfc8555#section-8.3
-                resource = '.well-known/acme-challenge/' + token
-                data[challenge_type] = {'resource': resource, 'resource_value': keyauthorization}
-            elif challenge_type == 'dns-01':
-                if identifier_type != 'dns':
-                    continue
-                # https://tools.ietf.org/html/rfc8555#section-8.4
-                resource = '_acme-challenge'
-                value = nopad_b64(hashlib.sha256(to_bytes(keyauthorization)).digest())
-                record = (resource + identifier[1:]) if identifier.startswith('*.') else (resource + '.' + identifier)
-                data[challenge_type] = {'resource': resource, 'resource_value': value, 'record': record}
-            elif challenge_type == 'tls-alpn-01':
-                # https://www.rfc-editor.org/rfc/rfc8737.html#section-3
-                if identifier_type == 'ip':
-                    # IPv4/IPv6 address: use reverse mapping (RFC1034, RFC3596)
-                    resource = compat_ipaddress.ip_address(identifier).reverse_pointer
-                    if not resource.endswith('.'):
-                        resource += '.'
-                else:
-                    resource = identifier
-                value = base64.b64encode(hashlib.sha256(to_bytes(keyauthorization)).digest())
-                data[challenge_type] = {'resource': resource, 'resource_original': identifier_type + ':' + identifier, 'resource_value': value}
-            else:
-                continue
-
-        return data
-
-    def _fail_challenge(self, identifier_type, identifier, auth, error):
-        '''
-        Aborts with a specific error for a challenge.
-        '''
-        error_details = ''
-        # multiple challenges could have failed at this point, gather error
-        # details for all of them before failing
-        for challenge in auth['challenges']:
-            if challenge['status'] == 'invalid':
-                error_details += ' CHALLENGE: {0}'.format(challenge['type'])
-                if 'error' in challenge:
-                    error_details += ' DETAILS: {0};'.format(challenge['error']['detail'])
-                else:
-                    error_details += ';'
-        raise ModuleFailException("{0}: {1}".format(error.format(identifier_type + ':' + identifier), error_details))
-
-    def _validate_challenges(self, identifier_type, identifier, auth):
-        '''
-        Validate the authorization provided in the auth dict. Returns True
-        when the validation was successful and False when it was not.
-        '''
-        for challenge in auth['challenges']:
-            if self.challenge != challenge['type']:
-                continue
-
-            uri = challenge['uri'] if self.version == 1 else challenge['url']
-
-            challenge_response = {}
-            if self.version == 1:
-                token = re.sub(r"[^A-Za-z0-9_\-]", "_", challenge['token'])
-                keyauthorization = self.account.get_keyauthorization(token)
-                challenge_response["resource"] = "challenge"
-                challenge_response["keyAuthorization"] = keyauthorization
-                challenge_response["type"] = self.challenge
-            result, info = self.account.send_signed_request(uri, challenge_response)
-            if info['status'] not in [200, 202]:
-                raise ModuleFailException("Error validating challenge: CODE: {0} RESULT: {1}".format(info['status'], result))
-
-        status = ''
-
-        while status not in ['valid', 'invalid', 'revoked']:
-            result, dummy = self.account.get_request(auth['uri'])
-            result['uri'] = auth['uri']
-            if self._add_or_update_auth(identifier_type, identifier, result):
-                self.changed = True
-            # https://tools.ietf.org/html/draft-ietf-acme-acme-02#section-6.1.2
-            # "status (required, string): ...
-            # If this field is missing, then the default value is "pending"."
-            if self.version == 1 and 'status' not in result:
-                status = 'pending'
-            else:
-                status = result['status']
-            time.sleep(2)
-
-        if status == 'invalid':
-            self._fail_challenge(identifier_type, identifier, result, 'Authorization for {0} returned invalid')
-
-        return status == 'valid'
-
-    def _finalize_cert(self):
-        '''
-        Create a new certificate based on the csr.
-        Return the certificate object as dict
-        https://tools.ietf.org/html/rfc8555#section-7.4
-        '''
-        csr = pem_to_der(self.csr)
-        new_cert = {
-            "csr": nopad_b64(csr),
-        }
-        result, info = self.account.send_signed_request(self.finalize_uri, new_cert)
-        if info['status'] not in [200]:
-            raise ModuleFailException("Error new cert: CODE: {0} RESULT: {1}".format(info['status'], result))
-
-        status = result['status']
-        while status not in ['valid', 'invalid']:
-            time.sleep(2)
-            result, dummy = self.account.get_request(self.order_uri)
-            status = result['status']
-
-        if status != 'valid':
-            raise ModuleFailException("Error new cert: CODE: {0} STATUS: {1} RESULT: {2}".format(info['status'], status, result))
-
-        return result['certificate']
-
-    def _der_to_pem(self, der_cert):
-        '''
-        Convert the DER format certificate in der_cert to a PEM format
-        certificate and return it.
-        '''
-        return """-----BEGIN CERTIFICATE-----\n{0}\n-----END CERTIFICATE-----\n""".format(
-            "\n".join(textwrap.wrap(base64.b64encode(der_cert).decode('utf8'), 64)))
-
-    def _download_cert(self, url):
-        '''
-        Download and parse the certificate chain.
-        https://tools.ietf.org/html/rfc8555#section-7.4.2
-        '''
-        content, info = self.account.get_request(url, parse_json_result=False, headers={'Accept': 'application/pem-certificate-chain'})
-
-        if not content or not info['content-type'].startswith('application/pem-certificate-chain'):
-            raise ModuleFailException("Cannot download certificate chain from {0}: {1} (headers: {2})".format(url, content, info))
-
-        cert = None
-        chain = []
-
-        # Parse data
-        lines = content.decode('utf-8').splitlines(True)
-        current = []
-        for line in lines:
-            if line.strip():
-                current.append(line)
-            if line.startswith('-----END CERTIFICATE-----'):
-                if cert is None:
-                    cert = ''.join(current)
-                else:
-                    chain.append(''.join(current))
-                current = []
-
-        alternates = []
-
-        def f(link, relation):
-            if relation == 'up':
-                # Process link-up headers if there was no chain in reply
-                if not chain:
-                    chain_result, chain_info = self.account.get_request(link, parse_json_result=False)
-                    if chain_info['status'] in [200, 201]:
-                        chain.append(self._der_to_pem(chain_result))
-            elif relation == 'alternate':
-                alternates.append(link)
-
-        process_links(info, f)
-
-        if cert is None or current:
-            raise ModuleFailException("Failed to parse certificate chain download from {0}: {1} (headers: {2})".format(url, content, info))
-        return {'cert': cert, 'chain': chain, 'alternates': alternates}
-
-    def _new_cert_v1(self):
-        '''
-        Create a new certificate based on the CSR (ACME v1 protocol).
-        Return the certificate object as dict
-        https://tools.ietf.org/html/draft-ietf-acme-acme-02#section-6.5
-        '''
-        csr = pem_to_der(self.csr)
-        new_cert = {
-            "resource": "new-cert",
-            "csr": nopad_b64(csr),
-        }
-        result, info = self.account.send_signed_request(self.directory['new-cert'], new_cert)
-
-        chain = []
-
-        def f(link, relation):
-            if relation == 'up':
-                chain_result, chain_info = self.account.get_request(link, parse_json_result=False)
-                if chain_info['status'] in [200, 201]:
-                    del chain[:]
-                    chain.append(self._der_to_pem(chain_result))
-
-        process_links(info, f)
-
-        if info['status'] not in [200, 201]:
-            raise ModuleFailException("Error new cert: CODE: {0} RESULT: {1}".format(info['status'], result))
-        else:
-            return {'cert': self._der_to_pem(result), 'uri': info['location'], 'chain': chain}
-
-    def _new_order_v2(self):
-        '''
-        Start a new certificate order (ACME v2 protocol).
-        https://tools.ietf.org/html/rfc8555#section-7.4
-        '''
-        identifiers = []
-        for identifier_type, identifier in self.identifiers:
-            identifiers.append({
-                'type': identifier_type,
-                'value': identifier,
-            })
-        new_order = {
-            "identifiers": identifiers
-        }
-        result, info = self.account.send_signed_request(self.directory['newOrder'], new_order)
-
-        if info['status'] not in [201]:
-            raise ModuleFailException("Error new order: CODE: {0} RESULT: {1}".format(info['status'], result))
-
-        for auth_uri in result['authorizations']:
-            auth_data, dummy = self.account.get_request(auth_uri)
-            auth_data['uri'] = auth_uri
-            identifier_type = auth_data['identifier']['type']
-            identifier = auth_data['identifier']['value']
-            if auth_data.get('wildcard', False):
-                identifier = '*.{0}'.format(identifier)
-            self.authorizations[identifier_type + ':' + identifier] = auth_data
-
-        self.order_uri = info['location']
-        self.finalize_uri = result['finalize']
+        self.identifiers = self.client.backend.get_csr_identifiers(csr_filename=self.csr, csr_content=self.csr_content)
 
     def is_first_step(self):
         '''
@@ -924,28 +642,33 @@ class ACMEClient(object):
                 if identifier_type != 'dns':
                     raise ModuleFailException('ACME v1 only supports DNS identifiers!')
             for identifier_type, identifier in self.identifiers:
-                new_auth = self._new_authz_v1(identifier_type, identifier)
-                self._add_or_update_auth(identifier_type, identifier, new_auth)
+                authz = Authorization.create(self.client, identifier_type, identifier)
+                self.authorizations[authz.combined_identifier] = authz
         else:
-            self._new_order_v2()
+            self.order = Order.create(self.client, self.identifiers)
+            self.order_uri = self.order.url
+            self.order.load_authorizations(self.client)
+            self.authorizations.update(self.order.authorizations)
         self.changed = True
 
-    def get_challenges_data(self):
+    def get_challenges_data(self, first_step):
         '''
         Get challenge details for the chosen challenge type.
         Return a tuple of generic challenge details, and specialized DNS challenge details.
         '''
         # Get general challenge data
         data = {}
-        for type_identifier, auth in self.authorizations.items():
-            identifier_type, identifier = type_identifier.split(':', 1)
-            auth = self.authorizations[type_identifier]
+        for type_identifier, authz in self.authorizations.items():
+            identifier_type, identifier = split_identifier(type_identifier)
             # Skip valid authentications: their challenges are already valid
             # and do not need to be returned
-            if auth['status'] == 'valid':
+            if authz.status == 'valid':
                 continue
             # We drop the type from the key to preserve backwards compatibility
-            data[identifier] = self._get_challenge_data(auth, identifier_type, identifier)
+            data[identifier] = authz.get_challenge_data(self.client)
+            if first_step and self.challenge not in data[identifier]:
+                raise ModuleFailException("Found no challenge of type '{0}' for identifier {1}!".format(
+                    self.challenge, type_identifier))
         # Get DNS challenge data
         data_dns = {}
         if self.challenge == 'dns-01':
@@ -969,91 +692,40 @@ class ACMEClient(object):
             # For ACME v1, we attempt to create new authzs. Existing ones
             # will be returned instead.
             for identifier_type, identifier in self.identifiers:
-                new_auth = self._new_authz_v1(identifier_type, identifier)
-                self._add_or_update_auth(identifier_type, identifier, new_auth)
+                authz = Authorization.create(self.client, identifier_type, identifier)
+                self.authorizations[combine_identifier(identifier_type, identifier)] = authz
         else:
             # For ACME v2, we obtain the order object by fetching the
             # order URI, and extract the information from there.
-            result, info = self.account.get_request(self.order_uri)
+            self.order = Order.from_url(self.client, self.order_uri)
+            self.order.load_authorizations(self.client)
+            self.authorizations.update(self.order.authorizations)
 
-            if not result:
-                raise ModuleFailException("Cannot download order from {0}: {1} (headers: {2})".format(self.order_uri, result, info))
+        # Step 2: validate pending challenges
+        for type_identifier, authz in self.authorizations.items():
+            if authz.status == 'pending':
+                identifier_type, identifier = split_identifier(type_identifier)
+                authz.call_validate(self.client, self.challenge)
+                self.changed = True
 
-            if info['status'] not in [200]:
-                raise ModuleFailException("Error on downloading order: CODE: {0} RESULT: {1}".format(info['status'], result))
-
-            for auth_uri in result['authorizations']:
-                auth_data, dummy = self.account.get_request(auth_uri)
-                auth_data['uri'] = auth_uri
-                identifier_type = auth_data['identifier']['type']
-                identifier = auth_data['identifier']['value']
-                if auth_data.get('wildcard', False):
-                    identifier = '*.{0}'.format(identifier)
-                self.authorizations[identifier_type + ':' + identifier] = auth_data
-
-            self.finalize_uri = result['finalize']
-
-        # Step 2: validate challenges
-        for type_identifier, auth in self.authorizations.items():
-            if auth['status'] == 'pending':
-                identifier_type, identifier = type_identifier.split(':', 1)
-                self._validate_challenges(identifier_type, identifier, auth)
-
-    def _chain_matches(self, chain, criterium):
-        '''
-        Check whether an alternate chain matches the specified criterium.
-        '''
-        if criterium['test_certificates'] == 'last':
-            chain = chain[-1:]
-        elif criterium['test_certificates'] == 'first':
-            chain = chain[:1]
-        for cert in chain:
+    def download_alternate_chains(self, cert):
+        alternate_chains = []
+        for alternate in cert.alternates:
             try:
-                x509 = cryptography.x509.load_pem_x509_certificate(to_bytes(cert), cryptography.hazmat.backends.default_backend())
-                matches = True
-                if criterium['subject']:
-                    for k, v in parse_name_field(criterium['subject']):
-                        oid = cryptography_name_to_oid(k)
-                        value = to_native(v)
-                        found = False
-                        for attribute in x509.subject:
-                            if attribute.oid == oid and value == to_native(attribute.value):
-                                found = True
-                                break
-                        if not found:
-                            matches = False
-                            break
-                if criterium['issuer']:
-                    for k, v in parse_name_field(criterium['issuer']):
-                        oid = cryptography_name_to_oid(k)
-                        value = to_native(v)
-                        found = False
-                        for attribute in x509.issuer:
-                            if attribute.oid == oid and value == to_native(attribute.value):
-                                found = True
-                                break
-                        if not found:
-                            matches = False
-                            break
-                if criterium['subject_key_identifier']:
-                    try:
-                        ext = x509.extensions.get_extension_for_class(cryptography.x509.SubjectKeyIdentifier)
-                        if criterium['subject_key_identifier'] != ext.value.digest:
-                            matches = False
-                    except cryptography.x509.ExtensionNotFound:
-                        matches = False
-                if criterium['authority_key_identifier']:
-                    try:
-                        ext = x509.extensions.get_extension_for_class(cryptography.x509.AuthorityKeyIdentifier)
-                        if criterium['authority_key_identifier'] != ext.value.key_identifier:
-                            matches = False
-                    except cryptography.x509.ExtensionNotFound:
-                        matches = False
-                if matches:
-                    return True
-            except Exception as e:
-                self.module.warn('Error while loading certificate {0}: {1}'.format(cert, e))
-        return False
+                alt_cert = CertificateChain.download(self.client, alternate)
+            except ModuleFailException as e:
+                self.module.warn('Error while downloading alternative certificate {0}: {1}'.format(alternate, e))
+                continue
+            alternate_chains.append(alt_cert)
+        return alternate_chains
+
+    def find_matching_chain(self, chains):
+        for criterium_idx, matcher in enumerate(self.select_chain_matcher):
+            for chain in chains:
+                if matcher.match(chain):
+                    self.module.debug('Found matching chain for criterium {0}'.format(criterium_idx))
+                    return chain
+        return None
 
     def get_certificate(self):
         '''
@@ -1062,81 +734,46 @@ class ACMEClient(object):
         with an error.
         '''
         for identifier_type, identifier in self.identifiers:
-            auth = self.authorizations.get(identifier_type + ':' + identifier)
-            if auth is None:
-                raise ModuleFailException('Found no authorization information for "{0}"!'.format(identifier_type + ':' + identifier))
-            if 'status' not in auth:
-                self._fail_challenge(identifier_type, identifier, auth, 'Authorization for {0} returned no status')
-            if auth['status'] != 'valid':
-                self._fail_challenge(identifier_type, identifier, auth, 'Authorization for {0} returned status ' + str(auth['status']))
+            authz = self.authorizations.get(combine_identifier(identifier_type, identifier))
+            if authz is None:
+                raise ModuleFailException('Found no authorization information for "{identifier}"!'.format(
+                    identifier=combine_identifier(identifier_type, identifier)))
+            if authz.status != 'valid':
+                authz.raise_error('Status is "{status}" and not "valid"'.format(status=authz.status), module=self.module)
 
         if self.version == 1:
-            cert = self._new_cert_v1()
+            cert = retrieve_acme_v1_certificate(self.client, pem_to_der(self.csr, self.csr_content))
         else:
-            cert_uri = self._finalize_cert()
-            cert = self._download_cert(cert_uri)
-            if self.module.params['retrieve_all_alternates'] or self.module.params['select_chain']:
+            self.order.finalize(self.client, pem_to_der(self.csr, self.csr_content))
+            cert = CertificateChain.download(self.client, self.order.certificate_uri)
+            if self.module.params['retrieve_all_alternates'] or self.select_chain_matcher:
                 # Retrieve alternate chains
-                alternate_chains = []
-                for alternate in cert['alternates']:
-                    try:
-                        alt_cert = self._download_cert(alternate)
-                    except ModuleFailException as e:
-                        self.module.warn('Error while downloading alternative certificate {0}: {1}'.format(alternate, e))
-                        continue
-                    alternate_chains.append(alt_cert)
+                alternate_chains = self.download_alternate_chains(cert)
 
                 # Prepare return value for all alternate chains
                 if self.module.params['retrieve_all_alternates']:
-                    self.all_chains = []
-
-                    def _append_all_chains(cert_data):
-                        self.all_chains.append(dict(
-                            cert=cert_data['cert'].encode('utf8'),
-                            chain=("\n".join(cert_data.get('chain', []))).encode('utf8'),
-                            full_chain=(cert_data['cert'] + "\n".join(cert_data.get('chain', []))).encode('utf8'),
-                        ))
-
-                    _append_all_chains(cert)
+                    self.all_chains = [cert.to_json()]
                     for alt_chain in alternate_chains:
-                        _append_all_chains(alt_chain)
+                        self.all_chains.append(alt_chain.to_json())
 
                 # Try to select alternate chain depending on criteria
-                if self.module.params['select_chain']:
-                    matching_chain = None
-                    all_chains = [cert] + alternate_chains
-                    for criterium_idx, criterium in enumerate(self.module.params['select_chain']):
-                        for v in ('subject_key_identifier', 'authority_key_identifier'):
-                            if criterium[v]:
-                                try:
-                                    criterium[v] = binascii.unhexlify(criterium[v].replace(':', ''))
-                                except Exception:
-                                    self.module.warn('Criterium {0} in select_chain has invalid {1} value. '
-                                                     'Ignoring criterium.'.format(criterium_idx, v))
-                                    continue
-                        for alt_chain in all_chains:
-                            if self._chain_matches(alt_chain.get('chain', []), criterium):
-                                self.module.debug('Found matching chain for criterium {0}'.format(criterium_idx))
-                                matching_chain = alt_chain
-                                break
-                        if matching_chain:
-                            break
+                if self.select_chain_matcher:
+                    matching_chain = self.find_matching_chain([cert] + alternate_chains)
                     if matching_chain:
-                        cert.update(matching_chain)
+                        cert = matching_chain
                     else:
                         self.module.debug('Found no matching alternative chain')
 
-        if cert['cert'] is not None:
-            pem_cert = cert['cert']
-
-            chain = [link for link in cert.get('chain', [])]
+        if cert.cert is not None:
+            pem_cert = cert.cert
+            chain = cert.chain
 
             if self.dest and write_file(self.module, self.dest, pem_cert.encode('utf8')):
-                self.cert_days = get_cert_days(self.module, self.dest)
+                self.cert_days = self.client.backend.get_cert_days(self.dest)
                 self.changed = True
 
             if self.fullchain_dest and write_file(self.module, self.fullchain_dest, (pem_cert + "\n".join(chain)).encode('utf8')):
-                self.cert_days = get_cert_days(self.module, self.fullchain_dest)
+                self.cert_days = self.client.backend.get_cert_days(self.fullchain_dest)
                 self.changed = True
 
             if self.chain_dest and write_file(self.module, self.chain_dest, ("\n".join(chain)).encode('utf8')):
@@ -1148,25 +785,14 @@ class ACMEClient(object):
         https://community.letsencrypt.org/t/authorization-deactivation/19860/2
         https://tools.ietf.org/html/rfc8555#section-7.5.2
         '''
-        authz_deactivate = {
-            'status': 'deactivated'
-        }
-        if self.version == 1:
-            authz_deactivate['resource'] = 'authz'
-        if self.authorizations:
-            for identifier_type, identifier in self.identifiers:
-                auth = self.authorizations.get(identifier_type + ':' + identifier)
-                if auth is None or auth.get('status') != 'valid':
-                    continue
-                try:
-                    result, info = self.account.send_signed_request(auth['uri'], authz_deactivate)
-                    if 200 <= info['status'] < 300 and result.get('status') == 'deactivated':
-                        auth['status'] = 'deactivated'
-                except Exception as dummy:
-                    # Ignore errors on deactivating authzs
-                    pass
-                if auth.get('status') != 'deactivated':
-                    self.module.warn(warning='Could not deactivate authz object {0}.'.format(auth['uri']))
+        for authz in self.authorizations.values():
+            try:
+                authz.deactivate(self.client)
+            except Exception:
+                # ignore errors
+                pass
+            if authz.status != 'deactivated':
+                self.module.warn(warning='Could not deactivate authz object {0}.'.format(authz.url))
 
 
 def main():
@@ -1177,7 +803,8 @@ def main():
         agreement=dict(type='str'),
         terms_agreed=dict(type='bool', default=False),
         challenge=dict(type='str', default='http-01', choices=['http-01', 'dns-01', 'tls-alpn-01']),
-        csr=dict(type='path', required=True, aliases=['src']),
+        csr=dict(type='path', aliases=['src']),
+        csr_content=dict(type='str'),
         data=dict(type='dict'),
         dest=dict(type='path', aliases=['cert']),
         fullchain_dest=dict(type='path', aliases=['fullchain']),
@@ -1199,24 +826,21 @@ def main():
         required_one_of=(
             ['account_key_src', 'account_key_content'],
             ['dest', 'fullchain_dest'],
+            ['csr', 'csr_content'],
         ),
         mutually_exclusive=(
             ['account_key_src', 'account_key_content'],
+            ['csr', 'csr_content'],
         ),
         supports_check_mode=True,
     )
-    backend = handle_standard_module_arguments(module)
-    if module.params['select_chain']:
-        if backend != 'cryptography':
-            module.fail_json(msg="The 'select_chain' can only be used with the 'cryptography' backend.")
-        elif not CRYPTOGRAPHY_FOUND:
-            module.fail_json(msg=missing_required_lib('cryptography'))
+    backend = create_backend(module, False)
 
     try:
         if module.params.get('dest'):
-            cert_days = get_cert_days(module, module.params['dest'])
+            cert_days = backend.get_cert_days(module.params['dest'])
         else:
-            cert_days = get_cert_days(module, module.params['fullchain_dest'])
+            cert_days = backend.get_cert_days(module.params['fullchain_dest'])
 
         if module.params['force'] or cert_days < module.params['remaining_days']:
             # If checkmode is active, base the changed state solely on the status
@@ -1226,10 +850,11 @@ def main():
             if module.check_mode:
                 module.exit_json(changed=True, authorizations={}, challenge_data={}, cert_days=cert_days)
             else:
-                client = ACMEClient(module)
+                client = ACMECertificateClient(module, backend)
                 client.cert_days = cert_days
                 other = dict()
-                if client.is_first_step():
+                is_first_step = client.is_first_step()
+                if is_first_step:
                     # First run: start challenges / start new order
                     client.start_challenges()
                 else:
@@ -1237,22 +862,22 @@ def main():
                     try:
                         client.finish_challenges()
                         client.get_certificate()
-                        if module.params['retrieve_all_alternates']:
+                        if client.all_chains is not None:
                             other['all_chains'] = client.all_chains
                     finally:
                         if module.params['deactivate_authzs']:
                             client.deactivate_authzs()
-                data, data_dns = client.get_challenges_data()
+                data, data_dns = client.get_challenges_data(first_step=is_first_step)
                 auths = dict()
                 for k, v in client.authorizations.items():
                     # Remove "type:" from key
-                    auths[k.split(':', 1)[1]] = v
+                    auths[split_identifier(k)[1]] = v.to_json()
                 module.exit_json(
                     changed=client.changed,
                     authorizations=auths,
-                    finalize_uri=client.finalize_uri,
+                    finalize_uri=client.order.finalize_uri if client.order else None,
                     order_uri=client.order_uri,
-                    account_uri=client.account.uri,
+                    account_uri=client.client.account_uri,
                     challenge_data=data,
                     challenge_data_dns=data_dns,
                     cert_days=client.cert_days,

plugins/modules/acme_certificate_revoke.py

@@ -25,6 +25,7 @@ notes:
       was different than the one specified here. Also, depending on the
       server, it can happen that some other error is returned if the
       certificate has already been revoked."
+   - Does not support C(check_mode).
 seealso:
   - name: The Let's Encrypt documentation
     description: Documentation for the Let's Encrypt Certification Authority.
@@ -53,7 +54,6 @@ options:
          private keys in PEM format can be used as well."
       - "Mutually exclusive with C(account_key_content)."
       - "Required if C(account_key_content) is not used."
-    type: path
   account_key_content:
     description:
       - "Content of the ACME account RSA or Elliptic Curve key."
@@ -68,7 +68,6 @@ options:
          temporary file. It can still happen that it is written to disk by
          Ansible in the process of moving the module with its argument to
          the node where it is executed."
-    type: str
   private_key_src:
     description:
       - "Path to the certificate's private key."
@@ -90,6 +89,12 @@ options:
          Ansible in the process of moving the module with its argument to
          the node where it is executed."
     type: str
+  private_key_passphrase:
+    description:
+      - Phassphrase to use to decode the certificate's private key.
+      - "B(Note:) this is not supported by the C(openssl) backend, only by the C(cryptography) backend."
+    type: str
+    version_added: 1.6.0
   revoke_reason:
     description:
       - "One of the revocation reasonCodes defined in
@@ -98,7 +103,7 @@ options:
          C(2) (cACompromise), C(3) (affiliationChanged), C(4) (superseded),
          C(5) (cessationOfOperation), C(6) (certificateHold),
          C(8) (removeFromCRL), C(9) (privilegeWithdrawn),
-         C(10) (aACompromise)"
+         C(10) (aACompromise)."
     type: int
 '''
 
@@ -114,18 +119,29 @@ EXAMPLES = '''
     certificate: /etc/httpd/ssl/sample.com.crt
 '''
 
-RETURN = '''
-'''
+RETURN = '''#'''
 
 from ansible.module_utils.basic import AnsibleModule
 
-from ansible_collections.community.crypto.plugins.module_utils.acme import (
-    ModuleFailException,
+from ansible_collections.community.crypto.plugins.module_utils.acme.acme import (
+    create_backend,
+    get_default_argspec,
+    ACMEClient,
+)
+
+from ansible_collections.community.crypto.plugins.module_utils.acme.account import (
     ACMEAccount,
+)
+
+from ansible_collections.community.crypto.plugins.module_utils.acme.errors import (
+    ACMEProtocolException,
+    ModuleFailException,
+    KeyParsingError,
+)
+
+from ansible_collections.community.crypto.plugins.module_utils.acme.utils import (
     nopad_b64,
     pem_to_der,
-    handle_standard_module_arguments,
-    get_default_argspec,
 )
 
 
@@ -134,6 +150,7 @@ def main():
     argument_spec.update(dict(
         private_key_src=dict(type='path'),
         private_key_content=dict(type='str', no_log=True),
+        private_key_passphrase=dict(type='str', no_log=True),
         certificate=dict(type='path', required=True),
         revoke_reason=dict(type='int'),
     ))
@@ -147,10 +164,11 @@ def main():
         ),
         supports_check_mode=False,
     )
-    handle_standard_module_arguments(module)
+    backend = create_backend(module, False)
 
     try:
-        account = ACMEAccount(module)
+        client = ACMEClient(module, backend)
+        account = ACMEAccount(client)
         # Load certificate
         certificate = pem_to_der(module.params.get('certificate'))
         certificate = nopad_b64(certificate)
@@ -162,25 +180,28 @@ def main():
             payload['reason'] = module.params.get('revoke_reason')
         # Determine endpoint
         if module.params.get('acme_version') == 1:
-            endpoint = account.directory['revoke-cert']
+            endpoint = client.directory['revoke-cert']
             payload['resource'] = 'revoke-cert'
         else:
-            endpoint = account.directory['revokeCert']
+            endpoint = client.directory['revokeCert']
         # Get hold of private key (if available) and make sure it comes from disk
         private_key = module.params.get('private_key_src')
         private_key_content = module.params.get('private_key_content')
         # Revoke certificate
         if private_key or private_key_content:
+            passphrase = module.params['private_key_passphrase']
             # Step 1: load and parse private key
-            error, private_key_data = account.parse_key(private_key, private_key_content)
-            if error:
-                raise ModuleFailException("error while parsing private key: %s" % error)
+            try:
+                private_key_data = client.parse_key(private_key, private_key_content, passphrase=passphrase)
+            except KeyParsingError as e:
+                raise ModuleFailException("Error while parsing private key: {msg}".format(msg=e.msg))
             # Step 2: sign revokation request with private key
             jws_header = {
                 "alg": private_key_data['alg'],
                 "jwk": private_key_data['jwk'],
             }
-            result, info = account.send_signed_request(endpoint, payload, key_data=private_key_data, jws_header=jws_header)
+            result, info = client.send_signed_request(
+                endpoint, payload, key_data=private_key_data, jws_header=jws_header, fail_on_error=False)
         else:
             # Step 1: get hold of account URI
             created, account_data = account.setup_account(allow_creation=False)
@@ -189,7 +210,7 @@ def main():
             if account_data is None:
                 raise ModuleFailException(msg='Account does not exist or is deactivated.')
             # Step 2: sign revokation request with account key
-            result, info = account.send_signed_request(endpoint, payload)
+            result, info = client.send_signed_request(endpoint, payload, fail_on_error=False)
         if info['status'] != 200:
             already_revoked = False
             # Standardized error from draft 14 on (https://tools.ietf.org/html/rfc8555#section-7.6)
@@ -208,7 +229,7 @@ def main():
             # but successfully terminate while indicating no change
             if already_revoked:
                 module.exit_json(changed=False)
-            raise ModuleFailException('Error revoking certificate: {0} {1}'.format(info['status'], result))
+            raise ACMEProtocolException(module, 'Failed to revoke certificate', info=info, content_json=result)
         module.exit_json(changed=True)
     except ModuleFailException as e:
         e.do_fail(module)

plugins/modules/acme_challenge_cert_helper.py

@@ -52,6 +52,13 @@ options:
       - "Content of the private key to use for this challenge certificate."
       - "Mutually exclusive with C(private_key_src)."
     type: str
+  private_key_passphrase:
+    description:
+      - Phassphrase to use to decode the private key.
+    type: str
+    version_added: 1.6.0
+notes:
+  - Does not support C(check_mode).
 '''
 
 EXAMPLES = '''
@@ -138,8 +145,9 @@ import traceback
 from ansible.module_utils.basic import AnsibleModule, missing_required_lib
 from ansible.module_utils._text import to_bytes, to_text
 
-from ansible_collections.community.crypto.plugins.module_utils.acme import (
-    ModuleFailException,
+from ansible_collections.community.crypto.plugins.module_utils.acme.errors import ModuleFailException
+
+from ansible_collections.community.crypto.plugins.module_utils.acme.io import (
     read_file,
 )
 
@@ -184,6 +192,7 @@ def main():
             challenge_data=dict(type='dict', required=True),
             private_key_src=dict(type='path'),
             private_key_content=dict(type='str', no_log=True),
+            private_key_passphrase=dict(type='str', no_log=True),
         ),
         required_one_of=(
             ['private_key_src', 'private_key_content'],
@@ -202,12 +211,16 @@ def main():
 
         # Get hold of private key
         private_key_content = module.params.get('private_key_content')
+        private_key_passphrase = module.params.get('private_key_passphrase')
         if private_key_content is None:
             private_key_content = read_file(module.params['private_key_src'])
         else:
             private_key_content = to_bytes(private_key_content)
         try:
-            private_key = cryptography.hazmat.primitives.serialization.load_pem_private_key(private_key_content, password=None, backend=_cryptography_backend)
+            private_key = cryptography.hazmat.primitives.serialization.load_pem_private_key(
+                private_key_content,
+                password=to_bytes(private_key_passphrase) if private_key_passphrase is not None else None,
+                backend=_cryptography_backend)
         except Exception as e:
             raise ModuleFailException('Error while loading private key: {0}'.format(e))
 

plugins/modules/acme_inspect.py

@@ -240,16 +240,18 @@ output_json:
       - ...
 '''
 
-import json
-
 from ansible.module_utils.basic import AnsibleModule
 from ansible.module_utils._text import to_native, to_bytes, to_text
 
-from ansible_collections.community.crypto.plugins.module_utils.acme import (
-    ModuleFailException,
-    ACMEAccount,
-    handle_standard_module_arguments,
+from ansible_collections.community.crypto.plugins.module_utils.acme.acme import (
+    create_backend,
     get_default_argspec,
+    ACMEClient,
+)
+
+from ansible_collections.community.crypto.plugins.module_utils.acme.errors import (
+    ACMEProtocolException,
+    ModuleFailException,
 )
 
 
@@ -273,25 +275,26 @@ def main():
             ['method', 'post', ['account_key_src', 'account_key_content'], True],
         ),
     )
-    handle_standard_module_arguments(module)
+    backend = create_backend(module, False)
 
     result = dict()
     changed = False
     try:
-        # Get hold of ACMEAccount object (includes directory)
-        account = ACMEAccount(module)
+        # Get hold of ACMEClient and ACMEAccount objects (includes directory)
+        client = ACMEClient(module, backend)
         method = module.params['method']
-        result['directory'] = account.directory.directory
+        result['directory'] = client.directory.directory
         # Do we have to do more requests?
         if method != 'directory-only':
             url = module.params['url']
             fail_on_acme_error = module.params['fail_on_acme_error']
             # Do request
             if method == 'get':
-                data, info = account.get_request(url, parse_json_result=False, fail_on_error=False)
+                data, info = client.get_request(url, parse_json_result=False, fail_on_error=False)
             elif method == 'post':
                 changed = True  # only POSTs can change
-                data, info = account.send_signed_request(url, to_bytes(module.params['content']), parse_json_result=False, encode_payload=False)
+                data, info = client.send_signed_request(
+                    url, to_bytes(module.params['content']), parse_json_result=False, encode_payload=False, fail_on_error=False)
             # Update results
             result.update(dict(
                 headers=info,
@@ -299,13 +302,12 @@ def main():
             ))
             # See if we can parse the result as JSON
             try:
-                # to_text() is needed only for Python 3.5 (and potentially 3.0 to 3.4 as well)
-                result['output_json'] = json.loads(to_text(data))
+                result['output_json'] = module.from_json(to_text(data))
             except Exception as dummy:
                 pass
             # Fail if error was returned
             if fail_on_acme_error and info['status'] >= 400:
-                raise ModuleFailException("ACME request failed: CODE: {0} RESULT: {1}".format(info['status'], data))
+                raise ACMEProtocolException(module, info=info, content=data)
         # Done!
         module.exit_json(changed=changed, **result)
     except ModuleFailException as e:

plugins/modules/certificate_complete_chain.py

@@ -124,6 +124,10 @@ import traceback
 from ansible.module_utils.basic import AnsibleModule, missing_required_lib
 from ansible.module_utils._text import to_bytes
 
+from ansible_collections.community.crypto.plugins.module_utils.crypto.pem import (
+    split_pem_list,
+)
+
 CRYPTOGRAPHY_IMP_ERR = None
 try:
     import cryptography
@@ -194,27 +198,17 @@ def parse_PEM_list(module, text, source, fail_on_error=True):
     Parse concatenated PEM certificates. Return list of ``Certificate`` objects.
     '''
     result = []
-    lines = text.splitlines(True)
-    current = None
-    for line in lines:
-        if line.strip():
-            if line.startswith('-----BEGIN '):
-                current = [line]
-            elif current is not None:
-                current.append(line)
-                if line.startswith('-----END '):
-                    cert_pem = ''.join(current)
-                    current = None
-                    # Try to load PEM certificate
-                    try:
-                        cert = cryptography.x509.load_pem_x509_certificate(to_bytes(cert_pem), _cryptography_backend)
-                        result.append(Certificate(cert_pem, cert))
-                    except Exception as e:
-                        msg = 'Cannot parse certificate #{0} from {1}: {2}'.format(len(result) + 1, source, e)
-                        if fail_on_error:
-                            module.fail_json(msg=msg)
-                        else:
-                            module.warn(msg)
+    for cert_pem in split_pem_list(text):
+        # Try to load PEM certificate
+        try:
+            cert = cryptography.x509.load_pem_x509_certificate(to_bytes(cert_pem), _cryptography_backend)
+            result.append(Certificate(cert_pem, cert))
+        except Exception as e:
+            msg = 'Cannot parse certificate #{0} from {1}: {2}'.format(len(result) + 1, source, e)
+            if fail_on_error:
+                module.fail_json(msg=msg)
+            else:
+                module.warn(msg)
     return result
 
 

plugins/modules/get_certificate.py

@@ -18,7 +18,7 @@ description:
       library. By default, it tries to detect which one is available. This can be
       overridden with the I(select_crypto_backend) option. Please note that the PyOpenSSL
       backend was deprecated in Ansible 2.9 and will be removed in community.crypto 2.0.0."
-    - Support SNI only with python >= 2.7
+    - Support SNI (L(Server Name Indication,https://en.wikipedia.org/wiki/Server_Name_Indication)) only with python >= 2.7.
 options:
     host:
       description:
@@ -35,6 +35,12 @@ options:
         - The port to connect to
       type: int
       required: true
+    server_name:
+      description:
+       - Server name used for SNI (L(Server Name Indication,https://en.wikipedia.org/wiki/Server_Name_Indication)) when hostname
+         is an IP or is different from server name.
+      type: str
+      version_added: 1.4.0
     proxy_host:
       description:
         - Proxy host used when get a certificate.
@@ -211,6 +217,7 @@ def main():
             port=dict(type='int', required=True),
             proxy_host=dict(type='str'),
             proxy_port=dict(type='int', default=8080),
+            server_name=dict(type='str'),
             timeout=dict(type='int', default=10),
             select_crypto_backend=dict(type='str', choices=['auto', 'pyopenssl', 'cryptography'], default='auto'),
         ),
@@ -222,6 +229,7 @@ def main():
     proxy_host = module.params.get('proxy_host')
     proxy_port = module.params.get('proxy_port')
     timeout = module.params.get('timeout')
+    server_name = module.params.get('server_name')
 
     backend = module.params.get('select_crypto_backend')
     if backend == 'auto':
@@ -297,7 +305,7 @@ def main():
                 ctx.check_hostname = False
                 ctx.verify_mode = CERT_NONE
 
-            cert = ctx.wrap_socket(sock, server_hostname=host).getpeercert(True)
+            cert = ctx.wrap_socket(sock, server_hostname=server_name or host).getpeercert(True)
             cert = DER_cert_to_PEM_cert(cert)
         except Exception as e:
             if proxy_host:

plugins/modules/luks_device.py

@@ -81,9 +81,10 @@ options:
               Needs I(keyfile) or I(passphrase) option for authorization.
               LUKS container supports up to 8 keyslots. Parameter value
               is the path to the keyfile with the passphrase."
-            - "NOTE that adding additional keys is *not idempotent*.
-              A new keyslot will be used even if another keyslot already
-              exists for this keyfile."
+            - "NOTE that adding additional keys is idempotent only since
+              community.crypto 1.4.0. For older versions, a new keyslot
+              will be used even if another keyslot already exists for this
+              keyfile."
             - "BEWARE that working with keyfiles in plaintext is dangerous.
               Make sure that they are protected."
         type: path
@@ -93,9 +94,9 @@ options:
               Needs I(keyfile) or I(passphrase) option for authorization. LUKS
               container supports up to 8 keyslots. Parameter value is a string
               with the new passphrase."
-            - "NOTE that adding additional passphrase is *not idempotent*.  A
-              new keyslot will be used even if another keyslot already exists
-              for this passphrase."
+            - "NOTE that adding additional passphrase is idempotent only since
+              community.crypto 1.4.0. For older versions, a new keyslot will
+              be used even if another keyslot already exists for this passphrase."
         type: str
         version_added: '1.0.0'
     remove_keyfile:
@@ -103,7 +104,8 @@ options:
             - "Removes given key from the container on I(device). Does not
               remove the keyfile from filesystem.
               Parameter value is the path to the keyfile with the passphrase."
-            - "NOTE that removing keys is *not idempotent*. Trying to remove
+            - "NOTE that removing keys is idempotent only since
+              community.crypto 1.4.0. For older versions, trying to remove
               a key which no longer exists results in an error."
             - "NOTE that to remove the last key from a LUKS container, the
               I(force_remove_last_key) option must be set to C(yes)."
@@ -114,9 +116,9 @@ options:
         description:
             - "Removes given passphrase from the container on I(device).
               Parameter value is a string with the passphrase to remove."
-            - "NOTE that removing passphrases is I(not
-              idempotent). Trying to remove a passphrase which no longer
-              exists results in an error."
+            - "NOTE that removing passphrases is idempotent only since
+              community.crypto 1.4.0. For older versions, trying to remove
+              a passphrase which no longer exists results in an error."
             - "NOTE that to remove the last keyslot from a LUKS
               container, the I(force_remove_last_key) option must be set
               to C(yes)."
@@ -168,6 +170,53 @@ options:
             - "Will only be used on container creation."
         type: str
         version_added: '1.1.0'
+    pbkdf:
+        description:
+            - This option allows the user to configure the Password-Based Key Derivation
+              Function (PBKDF) used.
+            - Will only be used on container creation, and when adding keys to an existing
+              container.
+        type: dict
+        version_added: '1.4.0'
+        suboptions:
+            iteration_time:
+                description:
+                    - Specify the iteration time used for the PBKDF.
+                    - Note that this is in B(seconds), not in milliseconds as on the
+                      command line.
+                    - Mutually exclusive with I(iteration_count).
+                type: float
+            iteration_count:
+                description:
+                    - Specify the iteration count used for the PBKDF.
+                    - Mutually exclusive with I(iteration_time).
+                type: int
+            algorithm:
+                description:
+                    - The algorithm to use.
+                    - Only available for the LUKS 2 format.
+                choices:
+                    - argon2i
+                    - argon2id
+                    - pbkdf2
+                type: str
+            memory:
+                description:
+                    - The memory cost limit in kilobytes for the PBKDF.
+                    - This is not used for PBKDF2, but only for the Argon PBKDFs.
+                type: int
+            parallel:
+                description:
+                    - The parallel cost for the PBKDF. This is the number of threads that
+                      run in parallel.
+                    - This is not used for PBKDF2, but only for the Argon PBKDFs.
+                type: int
+    sector_size:
+        description:
+            - "This option allows the user to specify the sector size (in bytes) used for LUKS2 containers."
+            - "Will only be used on container creation."
+        type: int
+        version_added: '1.5.0'
 
 requirements:
     - "cryptsetup"
@@ -397,7 +446,19 @@ class CryptHandler(Handler):
         result = self._run_command([self._cryptsetup_bin, 'isLuks', device])
         return result[RETURN_CODE] == 0
 
-    def run_luks_create(self, device, keyfile, passphrase, keysize, cipher, hash_):
+    def _add_pbkdf_options(self, options, pbkdf):
+        if pbkdf['iteration_time'] is not None:
+            options.extend(['--iter-time', str(int(pbkdf['iteration_time'] * 1000))])
+        if pbkdf['iteration_count'] is not None:
+            options.extend(['--pbkdf-force-iterations', str(pbkdf['iteration_count'])])
+        if pbkdf['algorithm'] is not None:
+            options.extend(['--pbkdf', pbkdf['algorithm']])
+        if pbkdf['memory'] is not None:
+            options.extend(['--pbkdf-memory', str(pbkdf['memory'])])
+        if pbkdf['parallel'] is not None:
+            options.extend(['--pbkdf-parallel', str(pbkdf['parallel'])])
+
+    def run_luks_create(self, device, keyfile, passphrase, keysize, cipher, hash_, sector_size, pbkdf):
         # create a new luks container; use batch mode to auto confirm
         luks_type = self._module.params['type']
         label = self._module.params['label']
@@ -414,6 +475,10 @@ class CryptHandler(Handler):
             options.extend(['--cipher', cipher])
         if hash_ is not None:
             options.extend(['--hash', hash_])
+        if pbkdf is not None:
+            self._add_pbkdf_options(options, pbkdf)
+        if sector_size is not None:
+            options.extend(['--sector-size', str(sector_size)])
 
         args = [self._cryptsetup_bin, 'luksFormat']
         args.extend(options)
@@ -454,13 +519,15 @@ class CryptHandler(Handler):
                              % (device, result[STDERR]))
 
     def run_luks_add_key(self, device, keyfile, passphrase, new_keyfile,
-                         new_passphrase):
+                         new_passphrase, pbkdf):
         ''' Add new key from a keyfile or passphrase to given 'device';
             authentication done using 'keyfile' or 'passphrase'.
             Raises ValueError when command fails.
         '''
         data = []
         args = [self._cryptsetup_bin, 'luksAddKey', device]
+        if pbkdf is not None:
+            self._add_pbkdf_options(args, pbkdf)
 
         if keyfile:
             args.extend(['--key-file', keyfile])
@@ -520,6 +587,28 @@ class CryptHandler(Handler):
             raise ValueError('Error while removing LUKS key from %s: %s'
                              % (device, result[STDERR]))
 
+    def luks_test_key(self, device, keyfile, passphrase):
+        ''' Check whether the keyfile or passphrase works.
+            Raises ValueError when command fails.
+        '''
+        data = None
+        args = [self._cryptsetup_bin, 'luksOpen', '--test-passphrase', device]
+
+        if keyfile:
+            args.extend(['--key-file', keyfile])
+        else:
+            data = passphrase
+
+        result = self._run_command(args, data=data)
+        if result[RETURN_CODE] == 0:
+            return True
+        for output in (STDOUT, STDERR):
+            if 'No key available with this passphrase' in result[output]:
+                return False
+
+        raise ValueError('Error while testing whether keyslot exists on %s: %s'
+                         % (device, result[STDERR]))
+
 
 class ConditionsHandler(Handler):
 
@@ -627,7 +716,7 @@ class ConditionsHandler(Handler):
             self._module.fail_json(msg="Contradiction in setup: Asking to "
                                    "add a key to absent LUKS.")
 
-        return True
+        return not self._crypthandler.luks_test_key(self.device, self._module.params['new_keyfile'], self._module.params['new_passphrase'])
 
     def luks_remove_key(self):
         if (self.device is None or
@@ -640,7 +729,7 @@ class ConditionsHandler(Handler):
             self._module.fail_json(msg="Contradiction in setup: Asking to "
                                    "remove a key from absent LUKS.")
 
-        return True
+        return self._crypthandler.luks_test_key(self.device, self._module.params['remove_keyfile'], self._module.params['remove_passphrase'])
 
     def luks_remove(self):
         return (self.device is not None and
@@ -667,6 +756,18 @@ def run_module():
         type=dict(type='str', choices=['luks1', 'luks2']),
         cipher=dict(type='str'),
         hash=dict(type='str'),
+        pbkdf=dict(
+            type='dict',
+            options=dict(
+                iteration_time=dict(type='float'),
+                iteration_count=dict(type='int'),
+                algorithm=dict(type='str', choices=['argon2i', 'argon2id', 'pbkdf2']),
+                memory=dict(type='int'),
+                parallel=dict(type='int'),
+            ),
+            mutually_exclusive=[('iteration_time', 'iteration_count')],
+        ),
+        sector_size=dict(type='int'),
     )
 
     mutually_exclusive = [
@@ -714,6 +815,8 @@ def run_module():
                                       module.params['keysize'],
                                       module.params['cipher'],
                                       module.params['hash'],
+                                      module.params['sector_size'],
+                                      module.params['pbkdf'],
                                       )
             except ValueError as e:
                 module.fail_json(msg="luks_device error: %s" % e)
@@ -775,7 +878,8 @@ def run_module():
                                        module.params['keyfile'],
                                        module.params['passphrase'],
                                        module.params['new_keyfile'],
-                                       module.params['new_passphrase'])
+                                       module.params['new_passphrase'],
+                                       module.params['pbkdf'])
             except ValueError as e:
                 module.fail_json(msg="luks_device error: %s" % e)
         result['changed'] = True

plugins/modules/openssh_cert.py

@@ -53,6 +53,12 @@ options:
             - If this is set, I(signing_key) needs to point to a file containing the public key of the CA.
         type: str
         version_added: 1.1.0
+    use_agent:
+        description:
+            - Should the ssh-keygen use a CA key residing in a ssh-agent.
+        type: bool
+        default: false
+        version_added: 1.3.0
     public_key:
         description:
             - The path to the public key that will be signed with the signing key in order to generate the certificate.
@@ -94,7 +100,7 @@ options:
                command specified by the user when the certificate is used for authentication."
             - "C(no-agent-forwarding): Disable ssh-agent forwarding (permitted by default)."
             - "C(no-port-forwarding): Disable port forwarding (permitted by default)."
-            - "C(no-pty Disable): PTY allocation (permitted by default)."
+            - "C(no-pty): Disable PTY allocation (permitted by default)."
             - "C(no-user-rc): Disable execution of C(~/.ssh/rc) by sshd (permitted by default)."
             - "C(no-x11-forwarding): Disable X11 forwarding (permitted by default)"
             - "C(permit-agent-forwarding): Allows ssh-agent forwarding."
@@ -216,12 +222,14 @@ import tempfile
 
 from datetime import datetime
 from datetime import MINYEAR, MAXYEAR
+from distutils.version import LooseVersion
 from shutil import copy2, rmtree
 
 from ansible.module_utils.basic import AnsibleModule
 from ansible.module_utils._text import to_native
 
 from ansible_collections.community.crypto.plugins.module_utils.crypto.support import convert_relative_to_datetime
+from ansible_collections.community.crypto.plugins.module_utils.crypto.openssh import parse_openssh_version
 
 
 class CertificateError(Exception):
@@ -235,6 +243,7 @@ class Certificate(object):
         self.force = module.params['force']
         self.type = module.params['type']
         self.signing_key = module.params['signing_key']
+        self.use_agent = module.params['use_agent']
         self.pkcs11_provider = module.params['pkcs11_provider']
         self.public_key = module.params['public_key']
         self.path = module.params['path']
@@ -273,6 +282,9 @@ class Certificate(object):
             if self.pkcs11_provider:
                 args.extend(['-D', self.pkcs11_provider])
 
+            if self.use_agent:
+                args.extend(['-U'])
+
             validity = ""
 
             if not (self.valid_from == "always" and self.valid_to == "forever"):
@@ -547,6 +559,7 @@ def main():
             force=dict(type='bool', default=False),
             type=dict(type='str', choices=['host', 'user']),
             signing_key=dict(type='path'),
+            use_agent=dict(type='bool', default=False),
             pkcs11_provider=dict(type='str'),
             public_key=dict(type='path'),
             path=dict(type='path', required=True),
@@ -563,6 +576,21 @@ def main():
         required_if=[('state', 'present', ['type', 'signing_key', 'public_key', 'valid_from', 'valid_to'])],
     )
 
+    if module.params['use_agent']:
+        ssh = module.get_bin_path('ssh', True)
+        proc = module.run_command([ssh, '-Vq'])
+        ssh_version_string = proc[2].strip()
+        ssh_version = parse_openssh_version(ssh_version_string)
+        if ssh_version is None:
+            module.fail_json(msg="Failed to parse ssh version")
+        elif LooseVersion(ssh_version) < LooseVersion("7.6"):
+            module.fail_json(
+                msg=(
+                    "Signing with CA key in ssh agent requires ssh 7.6 or newer."
+                    " Your version is: %s"
+                ) % ssh_version_string
+            )
+
     def isBaseDir(path):
         base_dir = os.path.dirname(path) or '.'
         if not os.path.isdir(base_dir):

plugins/modules/openssh_keypair.py

@@ -12,7 +12,7 @@ DOCUMENTATION = '''
 ---
 module: openssh_keypair
 author: "David Kainz (@lolcube)"
-short_description: Generate OpenSSH private and public keys.
+short_description: Generate OpenSSH private and public keys
 description:
     - "This module allows one to (re)generate OpenSSH private and public keys. It uses
       ssh-keygen to generate keys. One can generate C(rsa), C(dsa), C(rsa1), C(ed25519)
@@ -59,7 +59,7 @@ options:
         description:
             - Allows to configure in which situations the module is allowed to regenerate private keys.
               The module will always generate a new key if the destination file does not exist.
-            - By default, the key will be regenerated when it doesn't match the module's options,
+            - By default, the key will be regenerated when it does not match the module's options,
               except when the key cannot be read or the passphrase does not match. Please note that
               this B(changed) for Ansible 2.10. For Ansible 2.9, the behavior was as if C(full_idempotence)
               is specified.
@@ -91,6 +91,7 @@ options:
 notes:
     - In case the ssh key is broken or password protected, the module will fail.
       Set the I(force) option to C(yes) if you want to regenerate the keypair.
+    - Supports C(check_mode).
 
 extends_documentation_fragment: files
 '''
@@ -118,17 +119,17 @@ EXAMPLES = '''
 
 RETURN = '''
 size:
-    description: Size (in bits) of the SSH private key
+    description: Size (in bits) of the SSH private key.
     returned: changed or success
     type: int
     sample: 4096
 type:
-    description: Algorithm used to generate the SSH private key
+    description: Algorithm used to generate the SSH private key.
     returned: changed or success
     type: str
     sample: rsa
 filename:
-    description: Path to the generated SSH private key file
+    description: Path to the generated SSH private key file.
     returned: changed or success
     type: str
     sample: /tmp/id_ssh_rsa
@@ -138,12 +139,12 @@ fingerprint:
     type: str
     sample: SHA256:r4YCZxihVjedH2OlfjVGI6Y5xAYtdCwk8VxKyzVyYfM
 public_key:
-    description: The public key of the generated SSH private key
+    description: The public key of the generated SSH private key.
     returned: changed or success
     type: str
     sample: ssh-rsa AAAAB3Nza(...omitted...)veL4E3Xcw== test_key
 comment:
-    description: The comment of the generated key
+    description: The comment of the generated key.
     returned: changed or success
     type: str
     sample: test@comment

plugins/modules/openssl_csr_info.py

@@ -53,6 +53,7 @@ options:
 
 seealso:
 - module: community.crypto.openssl_csr
+- module: community.crypto.openssl_csr_pipe
 '''
 
 EXAMPLES = r'''

plugins/modules/openssl_csr_pipe.py

@@ -0,0 +1,175 @@
+#!/usr/bin/python
+# -*- coding: utf-8 -*-
+
+# Copyright: (c) 2017, Yanis Guenane <yanis+ansible@guenane.org>
+# Copyright: (c) 2020, Felix Fontein <felix@fontein.de>
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+
+from __future__ import absolute_import, division, print_function
+__metaclass__ = type
+
+
+DOCUMENTATION = r'''
+---
+module: openssl_csr_pipe
+short_description: Generate OpenSSL Certificate Signing Request (CSR)
+version_added: 1.3.0
+description:
+    - "Please note that the module regenerates an existing CSR if it doesn't match the module's
+      options, or if it seems to be corrupt."
+author:
+- Yanis Guenane (@Spredzy)
+- Felix Fontein (@felixfontein)
+options:
+    content:
+        description:
+            - The existing CSR.
+        type: str
+extends_documentation_fragment:
+- community.crypto.module_csr
+seealso:
+- module: community.crypto.openssl_csr
+'''
+
+EXAMPLES = r'''
+- name: Generate an OpenSSL Certificate Signing Request
+  community.crypto.openssl_csr_pipe:
+    privatekey_path: /etc/ssl/private/ansible.com.pem
+    common_name: www.ansible.com
+  register: result
+- debug:
+    var: result.csr
+
+- name: Generate an OpenSSL Certificate Signing Request with an inline CSR
+  community.crypto.openssl_csr:
+    content: "{{ lookup('file', '/etc/ssl/csr/www.ansible.com.csr') }}"
+    privatekey_content: "{{ private_key_content }}"
+    common_name: www.ansible.com
+  register: result
+- name: Store CSR
+  ansible.builtin.copy:
+    dest: /etc/ssl/csr/www.ansible.com.csr
+    content: "{{ result.csr }}"
+  when: result is changed
+'''
+
+RETURN = r'''
+privatekey:
+    description:
+    - Path to the TLS/SSL private key the CSR was generated for
+    - Will be C(none) if the private key has been provided in I(privatekey_content).
+    returned: changed or success
+    type: str
+    sample: /etc/ssl/private/ansible.com.pem
+subject:
+    description: A list of the subject tuples attached to the CSR
+    returned: changed or success
+    type: list
+    elements: list
+    sample: "[('CN', 'www.ansible.com'), ('O', 'Ansible')]"
+subjectAltName:
+    description: The alternative names this CSR is valid for
+    returned: changed or success
+    type: list
+    elements: str
+    sample: [ 'DNS:www.ansible.com', 'DNS:m.ansible.com' ]
+keyUsage:
+    description: Purpose for which the public key may be used
+    returned: changed or success
+    type: list
+    elements: str
+    sample: [ 'digitalSignature', 'keyAgreement' ]
+extendedKeyUsage:
+    description: Additional restriction on the public key purposes
+    returned: changed or success
+    type: list
+    elements: str
+    sample: [ 'clientAuth' ]
+basicConstraints:
+    description: Indicates if the certificate belongs to a CA
+    returned: changed or success
+    type: list
+    elements: str
+    sample: ['CA:TRUE', 'pathLenConstraint:0']
+ocsp_must_staple:
+    description: Indicates whether the certificate has the OCSP
+                 Must Staple feature enabled
+    returned: changed or success
+    type: bool
+    sample: false
+name_constraints_permitted:
+    description: List of permitted subtrees to sign certificates for.
+    returned: changed or success
+    type: list
+    elements: str
+    sample: ['email:.somedomain.com']
+name_constraints_excluded:
+    description: List of excluded subtrees the CA cannot sign certificates for.
+    returned: changed or success
+    type: list
+    elements: str
+    sample: ['email:.com']
+csr:
+    description: The (current or generated) CSR's content.
+    returned: changed or success
+    type: str
+'''
+
+from ansible.module_utils._text import to_native
+
+from ansible_collections.community.crypto.plugins.module_utils.crypto.module_backends.csr import (
+    select_backend,
+    get_csr_argument_spec,
+)
+
+from ansible_collections.community.crypto.plugins.module_utils.crypto.basic import (
+    OpenSSLObjectError,
+)
+
+
+class CertificateSigningRequestModule(object):
+    def __init__(self, module, module_backend):
+        self.check_mode = module.check_mode
+        self.module_backend = module_backend
+        self.changed = False
+        if module.params['content'] is not None:
+            self.module_backend.set_existing(module.params['content'].encode('utf-8'))
+
+    def generate(self, module):
+        '''Generate the certificate signing request.'''
+        if self.module_backend.needs_regeneration():
+            if not self.check_mode:
+                self.module_backend.generate_csr()
+            self.changed = True
+
+    def dump(self):
+        '''Serialize the object into a dictionary.'''
+        result = self.module_backend.dump(include_csr=True)
+        result.update({
+            'changed': self.changed,
+        })
+        return result
+
+
+def main():
+    argument_spec = get_csr_argument_spec()
+    argument_spec.argument_spec.update(dict(
+        content=dict(type='str'),
+    ))
+    module = argument_spec.create_ansible_module(
+        supports_check_mode=True,
+    )
+
+    backend = module.params['select_crypto_backend']
+    backend, module_backend = select_backend(module, backend)
+    try:
+        csr = CertificateSigningRequestModule(module, module_backend)
+        csr.generate(module)
+        result = csr.dump()
+        module.exit_json(**result)
+    except OpenSSLObjectError as exc:
+        module.fail_json(msg=to_native(exc))
+
+
+if __name__ == "__main__":
+    main()

plugins/modules/openssl_dhparam.py

@@ -15,7 +15,7 @@ short_description: Generate OpenSSL Diffie-Hellman Parameters
 description:
     - This module allows one to (re)generate OpenSSL DH-params.
     - This module uses file common arguments to specify generated file permissions.
-    - "Please note that the module regenerates existing DH params if they don't
+    - "Please note that the module regenerates existing DH params if they do not
       match the module's options. If you are concerned that this could overwrite
       your existing DH params, consider using the I(backup) option."
     - The module can use the cryptography Python library, or the C(openssl) executable.
@@ -71,6 +71,8 @@ options:
         type: bool
         default: no
         version_added: "1.0.0"
+notes:
+- Supports C(check_mode).
 extends_documentation_fragment:
 - files
 seealso:

plugins/modules/openssl_pkcs12.py

@@ -27,10 +27,19 @@ options:
         choices: [ export, parse ]
     other_certificates:
         description:
-            - List of other certificates to include. Pre 2.8 this parameter was called C(ca_certificates)
+            - List of other certificates to include. Pre Ansible 2.8 this parameter was called I(ca_certificates).
+            - Assumes there is one PEM-encoded certificate per file. If a file contains multiple PEM certificates,
+              set I(other_certificates_parse_all) to C(true).
         type: list
         elements: path
         aliases: [ ca_certificates ]
+    other_certificates_parse_all:
+        description:
+            - If set to C(true), assumes that the files mentioned in I(other_certificates) can contain more than one
+              certificate per file (or even none per file).
+        type: bool
+        default: false
+        version_added: 1.4.0
     certificate_path:
         description:
             - The path to read certificates and private keys from.
@@ -115,6 +124,27 @@ EXAMPLES = r'''
     privatekey_path: /opt/certs/keys/key.pem
     certificate_path: /opt/certs/cert.pem
     other_certificates: /opt/certs/ca.pem
+    # Note that if /opt/certs/ca.pem contains multiple certificates,
+    # only the first one will be used. See the other_certificates_parse_all
+    # option for changing this behavior.
+    state: present
+
+- name: Generate PKCS#12 file
+  community.crypto.openssl_pkcs12:
+    action: export
+    path: /opt/certs/ansible.p12
+    friendly_name: raclette
+    privatekey_path: /opt/certs/keys/key.pem
+    certificate_path: /opt/certs/cert.pem
+    other_certificates_parse_all: true
+    other_certificates:
+      - /opt/certs/ca_bundle.pem
+        # Since we set other_certificates_parse_all to true, all
+        # certificates in the CA bundle are included and not just
+        # the first one.
+      - /opt/certs/intermediate.pem
+        # In case this file has multiple certificates in it,
+        # all will be included as well.
     state: present
 
 - name: Change PKCS#12 file permission
@@ -201,6 +231,10 @@ from ansible_collections.community.crypto.plugins.module_utils.crypto.support im
     load_certificate,
 )
 
+from ansible_collections.community.crypto.plugins.module_utils.crypto.pem import (
+    split_pem_list,
+)
+
 PYOPENSSL_IMP_ERR = None
 try:
     from OpenSSL import crypto
@@ -211,6 +245,15 @@ else:
     pyopenssl_found = True
 
 
+def load_certificate_set(filename):
+    '''
+    Load list of concatenated PEM files, and return a list of parsed certificates.
+    '''
+    with open(filename, 'rb') as f:
+        data = f.read().decode('utf-8')
+    return [load_certificate(None, content=cert) for cert in split_pem_list(data)]
+
+
 class PkcsError(OpenSSLObjectError):
     pass
 
@@ -226,6 +269,7 @@ class Pkcs(OpenSSLObject):
         )
         self.action = module.params['action']
         self.other_certificates = module.params['other_certificates']
+        self.other_certificates_parse_all = module.params['other_certificates_parse_all']
         self.certificate_path = module.params['certificate_path']
         self.friendly_name = module.params['friendly_name']
         self.iter_size = module.params['iter_size']
@@ -244,6 +288,17 @@ class Pkcs(OpenSSLObject):
         self.backup = module.params['backup']
         self.backup_file = None
 
+        if self.other_certificates:
+            if self.other_certificates_parse_all:
+                filenames = list(self.other_certificates)
+                self.other_certificates = []
+                for other_cert_bundle in filenames:
+                    self.other_certificates.extend(load_certificate_set(other_cert_bundle))
+            else:
+                self.other_certificates = [
+                    load_certificate(other_cert) for other_cert in self.other_certificates
+                ]
+
     def check(self, module, perms_required=True):
         """Ensure the resource is in its desired state."""
 
@@ -302,6 +357,17 @@ class Pkcs(OpenSSLObject):
                         return False
                 elif bool(self.pkcs12.get_friendlyname()) != bool(pkcs12_friendly_name):
                     return False
+        elif module.params['action'] == 'parse' and os.path.exists(self.src) and os.path.exists(self.path):
+            try:
+                pkey, cert, other_certs, friendly_name = self.parse()
+            except crypto.Error:
+                return False
+            expected_content = to_bytes(
+                ''.join([to_native(pem) for pem in [pkey, cert] + other_certs if pem is not None])
+            )
+            dumped_content = load_file_if_exists(self.path, ignore_errors=True)
+            if expected_content != dumped_content:
+                return False
         else:
             return False
 
@@ -329,9 +395,7 @@ class Pkcs(OpenSSLObject):
         self.pkcs12 = crypto.PKCS12()
 
         if self.other_certificates:
-            other_certs = [load_certificate(other_cert) for other_cert
-                           in self.other_certificates]
-            self.pkcs12.set_ca_certificates(other_certs)
+            self.pkcs12.set_ca_certificates(self.other_certificates)
 
         if self.certificate_path:
             self.pkcs12.set_certificate(load_certificate(self.certificate_path))
@@ -360,10 +424,12 @@ class Pkcs(OpenSSLObject):
                 pkcs12_content = pkcs12_fh.read()
             p12 = crypto.load_pkcs12(pkcs12_content,
                                      self.passphrase)
-            pkey = crypto.dump_privatekey(crypto.FILETYPE_PEM,
-                                          p12.get_privatekey())
-            crt = crypto.dump_certificate(crypto.FILETYPE_PEM,
-                                          p12.get_certificate())
+            pkey = p12.get_privatekey()
+            if pkey is not None:
+                pkey = crypto.dump_privatekey(crypto.FILETYPE_PEM, pkey)
+            crt = p12.get_certificate()
+            if crt is not None:
+                crt = crypto.dump_certificate(crypto.FILETYPE_PEM, crt)
             other_certs = []
             if p12.get_ca_certificates() is not None:
                 other_certs = [crypto.dump_certificate(crypto.FILETYPE_PEM,
@@ -389,6 +455,7 @@ def main():
     argument_spec = dict(
         action=dict(type='str', default='export', choices=['export', 'parse']),
         other_certificates=dict(type='list', elements='path', aliases=['ca_certificates']),
+        other_certificates_parse_all=dict(type='bool', default=False),
         certificate_path=dict(type='path'),
         force=dict(type='bool', default=False),
         friendly_name=dict(type='str', aliases=['name']),
@@ -444,8 +511,9 @@ def main():
                     changed = True
                 else:
                     pkey, cert, other_certs, friendly_name = pkcs12.parse()
-                    dump_content = '%s%s%s' % (to_native(pkey), to_native(cert), to_native(b''.join(other_certs)))
+                    dump_content = ''.join([to_native(pem) for pem in [pkey, cert] + other_certs if pem is not None])
                     pkcs12.write(module, to_bytes(dump_content))
+                    changed = True
 
             file_args = module.load_file_common_arguments(module.params)
             if module.set_fs_attributes_if_different(file_args, changed):

plugins/modules/openssl_privatekey.py

@@ -14,23 +14,7 @@ module: openssl_privatekey
 short_description: Generate OpenSSL private keys
 description:
     - This module allows one to (re)generate OpenSSL private keys.
-    - One can generate L(RSA,https://en.wikipedia.org/wiki/RSA_%28cryptosystem%29),
-      L(DSA,https://en.wikipedia.org/wiki/Digital_Signature_Algorithm),
-      L(ECC,https://en.wikipedia.org/wiki/Elliptic-curve_cryptography) or
-      L(EdDSA,https://en.wikipedia.org/wiki/EdDSA) private keys.
-    - Keys are generated in PEM format.
-    - "Please note that the module regenerates private keys if they don't match
-      the module's options. In particular, if you provide another passphrase
-      (or specify none), change the keysize, etc., the private key will be
-      regenerated. If you are concerned that this could **overwrite your private key**,
-      consider using the I(backup) option."
-    - "The module can use the cryptography Python library, or the pyOpenSSL Python
-      library. By default, it tries to detect which one is available. This can be
-      overridden with the I(select_crypto_backend) option. Please note that the
-      PyOpenSSL backend was deprecated in Ansible 2.9 and will be removed in Ansible 2.13."
-requirements:
-    - Either cryptography >= 1.2.3 (older versions might work as well)
-    - Or pyOpenSSL
+    - The default mode for the private key file will be C(0600) if I(mode) is not explicitly set.
 author:
     - Yanis Guenane (@Spredzy)
     - Felix Fontein (@felixfontein)
@@ -41,48 +25,6 @@ options:
         type: str
         default: present
         choices: [ absent, present ]
-    size:
-        description:
-            - Size (in bits) of the TLS/SSL key to generate.
-        type: int
-        default: 4096
-    type:
-        description:
-            - The algorithm used to generate the TLS/SSL private key.
-            - Note that C(ECC), C(X25519), C(X448), C(Ed25519) and C(Ed448) require the C(cryptography) backend.
-              C(X25519) needs cryptography 2.5 or newer, while C(X448), C(Ed25519) and C(Ed448) require
-              cryptography 2.6 or newer. For C(ECC), the minimal cryptography version required depends on the
-              I(curve) option.
-        type: str
-        default: RSA
-        choices: [ DSA, ECC, Ed25519, Ed448, RSA, X25519, X448 ]
-    curve:
-        description:
-            - Note that not all curves are supported by all versions of C(cryptography).
-            - For maximal interoperability, C(secp384r1) or C(secp256r1) should be used.
-            - We use the curve names as defined in the
-              L(IANA registry for TLS,https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8).
-        type: str
-        choices:
-            - secp384r1
-            - secp521r1
-            - secp224r1
-            - secp192r1
-            - secp256r1
-            - secp256k1
-            - brainpoolP256r1
-            - brainpoolP384r1
-            - brainpoolP512r1
-            - sect571k1
-            - sect409k1
-            - sect283k1
-            - sect233k1
-            - sect163k1
-            - sect571r1
-            - sect409r1
-            - sect283r1
-            - sect233r1
-            - sect163r2
     force:
         description:
             - Should the key be regenerated even if it already exists.
@@ -90,56 +32,13 @@ options:
         default: no
     path:
         description:
-            - Name of the file in which the generated TLS/SSL private key will be written. It will have 0600 mode.
+            - Name of the file in which the generated TLS/SSL private key will be written. It will have C(0600) mode
+              if I(mode) is not explicitly set.
         type: path
         required: true
-    passphrase:
-        description:
-            - The passphrase for the private key.
-        type: str
-    cipher:
-        description:
-            - The cipher to encrypt the private key. (Valid values can be found by
-              running `openssl list -cipher-algorithms` or `openssl list-cipher-algorithms`,
-              depending on your OpenSSL version.)
-            - When using the C(cryptography) backend, use C(auto).
-        type: str
-    select_crypto_backend:
-        description:
-            - Determines which crypto backend to use.
-            - The default choice is C(auto), which tries to use C(cryptography) if available, and falls back to C(pyopenssl).
-            - If set to C(pyopenssl), will try to use the L(pyOpenSSL,https://pypi.org/project/pyOpenSSL/) library.
-            - If set to C(cryptography), will try to use the L(cryptography,https://cryptography.io/) library.
-            - Please note that the C(pyopenssl) backend has been deprecated in Ansible 2.9, and will be removed in community.crypto 2.0.0.
-              From that point on, only the C(cryptography) backend will be available.
-        type: str
-        default: auto
-        choices: [ auto, cryptography, pyopenssl ]
     format:
-        description:
-            - Determines which format the private key is written in. By default, PKCS1 (traditional OpenSSL format)
-              is used for all keys which support it. Please note that not every key can be exported in any format.
-            - The value C(auto) selects a fromat based on the key format. The value C(auto_ignore) does the same,
-              but for existing private key files, it will not force a regenerate when its format is not the automatically
-              selected one for generation.
-            - Note that if the format for an existing private key mismatches, the key is *regenerated* by default.
-              To change this behavior, use the I(format_mismatch) option.
-            - The I(format) option is only supported by the C(cryptography) backend. The C(pyopenssl) backend will
-              fail if a value different from C(auto_ignore) is used.
-        type: str
-        default: auto_ignore
-        choices: [ pkcs1, pkcs8, raw, auto, auto_ignore ]
         version_added: '1.0.0'
     format_mismatch:
-        description:
-            - Determines behavior of the module if the format of a private key does not match the expected format, but all
-              other parameters are as expected.
-            - If set to C(regenerate) (default), generates a new private key.
-            - If set to C(convert), the key will be converted to the new format instead.
-            - Only supported by the C(cryptography) backend.
-        type: str
-        default: regenerate
-        choices: [ regenerate, convert ]
         version_added: '1.0.0'
     backup:
         description:
@@ -152,50 +51,19 @@ options:
             - If set to C(yes), will return the (current or generated) private key's content as I(privatekey).
             - Note that especially if the private key is not encrypted, you have to make sure that the returned
               value is treated appropriately and not accidentally written to logs etc.! Use with care!
+            - Use Ansible's I(no_log) task option to avoid the output being shown. See also
+              U(https://docs.ansible.com/ansible/latest/reference_appendices/faq.html#how-do-i-keep-secret-data-in-my-playbook).
         type: bool
         default: no
         version_added: '1.0.0'
     regenerate:
-        description:
-            - Allows to configure in which situations the module is allowed to regenerate private keys.
-              The module will always generate a new key if the destination file does not exist.
-            - By default, the key will be regenerated when it doesn't match the module's options,
-              except when the key cannot be read or the passphrase does not match. Please note that
-              this B(changed) for Ansible 2.10. For Ansible 2.9, the behavior was as if C(full_idempotence)
-              is specified.
-            - If set to C(never), the module will fail if the key cannot be read or the passphrase
-              isn't matching, and will never regenerate an existing key.
-            - If set to C(fail), the module will fail if the key does not correspond to the module's
-              options.
-            - If set to C(partial_idempotence), the key will be regenerated if it does not conform to
-              the module's options. The key is B(not) regenerated if it cannot be read (broken file),
-              the key is protected by an unknown passphrase, or when they key is not protected by a
-              passphrase, but a passphrase is specified.
-            - If set to C(full_idempotence), the key will be regenerated if it does not conform to the
-              module's options. This is also the case if the key cannot be read (broken file), the key
-              is protected by an unknown passphrase, or when they key is not protected by a passphrase,
-              but a passphrase is specified. Make sure you have a B(backup) when using this option!
-            - If set to C(always), the module will always regenerate the key. This is equivalent to
-              setting I(force) to C(yes).
-            - Note that if I(format_mismatch) is set to C(convert) and everything matches except the
-              format, the key will always be converted, except if I(regenerate) is set to C(always).
-        type: str
-        choices:
-            - never
-            - fail
-            - partial_idempotence
-            - full_idempotence
-            - always
-        default: full_idempotence
         version_added: '1.0.0'
 extends_documentation_fragment:
-- files
+- ansible.builtin.files
+- community.crypto.module_privatekey
 seealso:
-- module: community.crypto.x509_certificate
-- module: community.crypto.openssl_csr
-- module: community.crypto.openssl_dhparam
-- module: community.crypto.openssl_pkcs12
-- module: community.crypto.openssl_publickey
+- module: community.crypto.openssl_privatekey_pipe
+- module: community.crypto.openssl_privatekey_info
 '''
 
 EXAMPLES = r'''
@@ -273,15 +141,10 @@ privatekey:
     version_added: '1.0.0'
 '''
 
-import abc
-import base64
 import os
-import traceback
 
-from distutils.version import LooseVersion
-
-from ansible.module_utils.basic import AnsibleModule, missing_required_lib
-from ansible.module_utils._text import to_native, to_bytes
+from ansible.module_utils.basic import AnsibleModule
+from ansible.module_utils._text import to_native
 
 from ansible_collections.community.crypto.plugins.module_utils.io import (
     load_file_if_exists,
@@ -289,83 +152,32 @@ from ansible_collections.community.crypto.plugins.module_utils.io import (
 )
 
 from ansible_collections.community.crypto.plugins.module_utils.crypto.basic import (
-    CRYPTOGRAPHY_HAS_X25519,
-    CRYPTOGRAPHY_HAS_X25519_FULL,
-    CRYPTOGRAPHY_HAS_X448,
-    CRYPTOGRAPHY_HAS_ED25519,
-    CRYPTOGRAPHY_HAS_ED448,
     OpenSSLObjectError,
-    OpenSSLBadPassphraseError,
 )
 
 from ansible_collections.community.crypto.plugins.module_utils.crypto.support import (
     OpenSSLObject,
-    load_privatekey,
-    get_fingerprint,
-    get_fingerprint_of_bytes,
 )
 
-from ansible_collections.community.crypto.plugins.module_utils.crypto.identify import (
-    identify_private_key_format,
+from ansible_collections.community.crypto.plugins.module_utils.crypto.module_backends.privatekey import (
+    select_backend,
+    get_privatekey_argument_spec,
 )
 
-MINIMAL_PYOPENSSL_VERSION = '0.6'
-MINIMAL_CRYPTOGRAPHY_VERSION = '1.2.3'
 
-PYOPENSSL_IMP_ERR = None
-try:
-    import OpenSSL
-    from OpenSSL import crypto
-    PYOPENSSL_VERSION = LooseVersion(OpenSSL.__version__)
-except ImportError:
-    PYOPENSSL_IMP_ERR = traceback.format_exc()
-    PYOPENSSL_FOUND = False
-else:
-    PYOPENSSL_FOUND = True
+class PrivateKeyModule(OpenSSLObject):
 
-CRYPTOGRAPHY_IMP_ERR = None
-try:
-    import cryptography
-    import cryptography.exceptions
-    import cryptography.hazmat.backends
-    import cryptography.hazmat.primitives.serialization
-    import cryptography.hazmat.primitives.asymmetric.rsa
-    import cryptography.hazmat.primitives.asymmetric.dsa
-    import cryptography.hazmat.primitives.asymmetric.ec
-    import cryptography.hazmat.primitives.asymmetric.utils
-    CRYPTOGRAPHY_VERSION = LooseVersion(cryptography.__version__)
-except ImportError:
-    CRYPTOGRAPHY_IMP_ERR = traceback.format_exc()
-    CRYPTOGRAPHY_FOUND = False
-else:
-    CRYPTOGRAPHY_FOUND = True
-
-
-class PrivateKeyError(OpenSSLObjectError):
-    pass
-
-
-class PrivateKeyBase(OpenSSLObject):
-
-    def __init__(self, module):
-        super(PrivateKeyBase, self).__init__(
+    def __init__(self, module, module_backend):
+        super(PrivateKeyModule, self).__init__(
             module.params['path'],
             module.params['state'],
             module.params['force'],
-            module.check_mode
+            module.check_mode,
         )
-        self.size = module.params['size']
-        self.passphrase = module.params['passphrase']
-        self.cipher = module.params['cipher']
-        self.privatekey = None
-        self.fingerprint = {}
-        self.format = module.params['format']
-        self.format_mismatch = module.params['format_mismatch']
-        self.privatekey_bytes = None
+        self.module_backend = module_backend
         self.return_content = module.params['return_content']
-        self.regenerate = module.params['regenerate']
-        if self.regenerate == 'always':
-            self.force = True
+        if self.force:
+            module_backend.regenerate = 'always'
 
         self.backup = module.params['backup']
         self.backup_file = None
@@ -373,510 +185,68 @@ class PrivateKeyBase(OpenSSLObject):
         if module.params['mode'] is None:
             module.params['mode'] = '0600'
 
-    @abc.abstractmethod
-    def _generate_private_key(self):
-        """(Re-)Generate private key."""
-        pass
-
-    @abc.abstractmethod
-    def _ensure_private_key_loaded(self):
-        """Make sure that the private key has been loaded."""
-        pass
-
-    @abc.abstractmethod
-    def _get_private_key_data(self):
-        """Return bytes for self.privatekey"""
-        pass
-
-    @abc.abstractmethod
-    def _get_fingerprint(self):
-        pass
+        module_backend.set_existing(load_file_if_exists(self.path, module))
 
     def generate(self, module):
         """Generate a keypair."""
 
-        if not self.check(module, perms_required=False, ignore_conversion=True) or self.force:
+        if self.module_backend.needs_regeneration():
             # Regenerate
-            if self.backup:
-                self.backup_file = module.backup_local(self.path)
-            self._generate_private_key()
-            privatekey_data = self._get_private_key_data()
-            if self.return_content:
-                self.privatekey_bytes = privatekey_data
-            write_file(module, privatekey_data, 0o600)
+            if not self.check_mode:
+                if self.backup:
+                    self.backup_file = module.backup_local(self.path)
+                self.module_backend.generate_private_key()
+                privatekey_data = self.module_backend.get_private_key_data()
+                if self.return_content:
+                    self.privatekey_bytes = privatekey_data
+                write_file(module, privatekey_data, 0o600)
             self.changed = True
-        elif not self.check(module, perms_required=False, ignore_conversion=False):
+        elif self.module_backend.needs_conversion():
             # Convert
-            if self.backup:
-                self.backup_file = module.backup_local(self.path)
-            self._ensure_private_key_loaded()
-            privatekey_data = self._get_private_key_data()
-            if self.return_content:
-                self.privatekey_bytes = privatekey_data
-            write_file(module, privatekey_data, 0o600)
+            if not self.check_mode:
+                if self.backup:
+                    self.backup_file = module.backup_local(self.path)
+                self.module_backend.convert_private_key()
+                privatekey_data = self.module_backend.get_private_key_data()
+                if self.return_content:
+                    self.privatekey_bytes = privatekey_data
+                write_file(module, privatekey_data, 0o600)
             self.changed = True
 
-        self.fingerprint = self._get_fingerprint()
         file_args = module.load_file_common_arguments(module.params)
-        if module.set_fs_attributes_if_different(file_args, False):
-            self.changed = True
+        self.changed = module.set_fs_attributes_if_different(file_args, self.changed)
 
     def remove(self, module):
-        if self.backup:
+        self.module_backend.set_existing(None)
+        if self.backup and not self.check_mode:
             self.backup_file = module.backup_local(self.path)
-        super(PrivateKeyBase, self).remove(module)
-
-    @abc.abstractmethod
-    def _check_passphrase(self):
-        pass
-
-    @abc.abstractmethod
-    def _check_size_and_type(self):
-        pass
-
-    @abc.abstractmethod
-    def _check_format(self):
-        pass
-
-    def check(self, module, perms_required=True, ignore_conversion=True):
-        """Ensure the resource is in its desired state."""
-
-        state_and_perms = super(PrivateKeyBase, self).check(module, perms_required=False)
-
-        if not state_and_perms:
-            # key does not exist
-            return False
-
-        if not self._check_passphrase():
-            if self.regenerate in ('full_idempotence', 'always'):
-                return False
-            module.fail_json(msg='Unable to read the key. The key is protected with a another passphrase / no passphrase or broken.'
-                                 ' Will not proceed. To force regeneration, call the module with `generate`'
-                                 ' set to `full_idempotence` or `always`, or with `force=yes`.')
-
-        if self.regenerate != 'never':
-            if not self._check_size_and_type():
-                if self.regenerate in ('partial_idempotence', 'full_idempotence', 'always'):
-                    return False
-                module.fail_json(msg='Key has wrong type and/or size.'
-                                     ' Will not proceed. To force regeneration, call the module with `generate`'
-                                     ' set to `partial_idempotence`, `full_idempotence` or `always`, or with `force=yes`.')
-
-        if not self._check_format():
-            # During conversion step, convert if format does not match and format_mismatch == 'convert'
-            if not ignore_conversion and self.format_mismatch == 'convert':
-                return False
-            # During generation step, regenerate if format does not match and format_mismatch == 'regenerate'
-            if ignore_conversion and self.format_mismatch == 'regenerate' and self.regenerate != 'never':
-                if not ignore_conversion or self.regenerate in ('partial_idempotence', 'full_idempotence', 'always'):
-                    return False
-                module.fail_json(msg='Key has wrong format.'
-                                     ' Will not proceed. To force regeneration, call the module with `generate`'
-                                     ' set to `partial_idempotence`, `full_idempotence` or `always`, or with `force=yes`.'
-                                     ' To convert the key, set `format_mismatch` to `convert`.')
-
-        # check whether permissions are correct (in case that needs to be checked)
-        return not perms_required or super(PrivateKeyBase, self).check(module, perms_required=perms_required)
+        super(PrivateKeyModule, self).remove(module)
 
     def dump(self):
         """Serialize the object into a dictionary."""
 
-        result = {
-            'size': self.size,
-            'filename': self.path,
-            'changed': self.changed,
-            'fingerprint': self.fingerprint,
-        }
+        result = self.module_backend.dump(include_key=self.return_content)
+        result['filename'] = self.path
+        result['changed'] = self.changed
         if self.backup_file:
             result['backup_file'] = self.backup_file
-        if self.return_content:
-            if self.privatekey_bytes is None:
-                self.privatekey_bytes = load_file_if_exists(self.path, ignore_errors=True)
-            if self.privatekey_bytes:
-                if identify_private_key_format(self.privatekey_bytes) == 'raw':
-                    result['privatekey'] = base64.b64encode(self.privatekey_bytes)
-                else:
-                    result['privatekey'] = self.privatekey_bytes.decode('utf-8')
-            else:
-                result['privatekey'] = None
 
         return result
 
 
-# Implementation with using pyOpenSSL
-class PrivateKeyPyOpenSSL(PrivateKeyBase):
-
-    def __init__(self, module):
-        super(PrivateKeyPyOpenSSL, self).__init__(module)
-
-        if module.params['type'] == 'RSA':
-            self.type = crypto.TYPE_RSA
-        elif module.params['type'] == 'DSA':
-            self.type = crypto.TYPE_DSA
-        else:
-            module.fail_json(msg="PyOpenSSL backend only supports RSA and DSA keys.")
-
-        if self.format != 'auto_ignore':
-            module.fail_json(msg="PyOpenSSL backend only supports auto_ignore format.")
-
-    def _generate_private_key(self):
-        """(Re-)Generate private key."""
-        self.privatekey = crypto.PKey()
-        try:
-            self.privatekey.generate_key(self.type, self.size)
-        except (TypeError, ValueError) as exc:
-            raise PrivateKeyError(exc)
-
-    def _ensure_private_key_loaded(self):
-        """Make sure that the private key has been loaded."""
-        if self.privatekey is None:
-            try:
-                self.privatekey = privatekey = load_privatekey(self.path, self.passphrase)
-            except OpenSSLBadPassphraseError as exc:
-                raise PrivateKeyError(exc)
-
-    def _get_private_key_data(self):
-        """Return bytes for self.privatekey"""
-        if self.cipher and self.passphrase:
-            return crypto.dump_privatekey(crypto.FILETYPE_PEM, self.privatekey,
-                                          self.cipher, to_bytes(self.passphrase))
-        else:
-            return crypto.dump_privatekey(crypto.FILETYPE_PEM, self.privatekey)
-
-    def _get_fingerprint(self):
-        return get_fingerprint(self.path, self.passphrase)
-
-    def _check_passphrase(self):
-        try:
-            load_privatekey(self.path, self.passphrase)
-            return True
-        except Exception as dummy:
-            return False
-
-    def _check_size_and_type(self):
-        def _check_size(privatekey):
-            return self.size == privatekey.bits()
-
-        def _check_type(privatekey):
-            return self.type == privatekey.type()
-
-        self._ensure_private_key_loaded()
-        return _check_size(self.privatekey) and _check_type(self.privatekey)
-
-    def _check_format(self):
-        # Not supported by this backend
-        return True
-
-    def dump(self):
-        """Serialize the object into a dictionary."""
-
-        result = super(PrivateKeyPyOpenSSL, self).dump()
-
-        if self.type == crypto.TYPE_RSA:
-            result['type'] = 'RSA'
-        else:
-            result['type'] = 'DSA'
-
-        return result
-
-
-# Implementation with using cryptography
-class PrivateKeyCryptography(PrivateKeyBase):
-
-    def _get_ec_class(self, ectype):
-        ecclass = cryptography.hazmat.primitives.asymmetric.ec.__dict__.get(ectype)
-        if ecclass is None:
-            self.module.fail_json(msg='Your cryptography version does not support {0}'.format(ectype))
-        return ecclass
-
-    def _add_curve(self, name, ectype, deprecated=False):
-        def create(size):
-            ecclass = self._get_ec_class(ectype)
-            return ecclass()
-
-        def verify(privatekey):
-            ecclass = self._get_ec_class(ectype)
-            return isinstance(privatekey.private_numbers().public_numbers.curve, ecclass)
-
-        self.curves[name] = {
-            'create': create,
-            'verify': verify,
-            'deprecated': deprecated,
-        }
-
-    def __init__(self, module):
-        super(PrivateKeyCryptography, self).__init__(module)
-
-        self.curves = dict()
-        self._add_curve('secp384r1', 'SECP384R1')
-        self._add_curve('secp521r1', 'SECP521R1')
-        self._add_curve('secp224r1', 'SECP224R1')
-        self._add_curve('secp192r1', 'SECP192R1')
-        self._add_curve('secp256r1', 'SECP256R1')
-        self._add_curve('secp256k1', 'SECP256K1')
-        self._add_curve('brainpoolP256r1', 'BrainpoolP256R1', deprecated=True)
-        self._add_curve('brainpoolP384r1', 'BrainpoolP384R1', deprecated=True)
-        self._add_curve('brainpoolP512r1', 'BrainpoolP512R1', deprecated=True)
-        self._add_curve('sect571k1', 'SECT571K1', deprecated=True)
-        self._add_curve('sect409k1', 'SECT409K1', deprecated=True)
-        self._add_curve('sect283k1', 'SECT283K1', deprecated=True)
-        self._add_curve('sect233k1', 'SECT233K1', deprecated=True)
-        self._add_curve('sect163k1', 'SECT163K1', deprecated=True)
-        self._add_curve('sect571r1', 'SECT571R1', deprecated=True)
-        self._add_curve('sect409r1', 'SECT409R1', deprecated=True)
-        self._add_curve('sect283r1', 'SECT283R1', deprecated=True)
-        self._add_curve('sect233r1', 'SECT233R1', deprecated=True)
-        self._add_curve('sect163r2', 'SECT163R2', deprecated=True)
-
-        self.module = module
-        self.cryptography_backend = cryptography.hazmat.backends.default_backend()
-
-        self.type = module.params['type']
-        self.curve = module.params['curve']
-        if not CRYPTOGRAPHY_HAS_X25519 and self.type == 'X25519':
-            self.module.fail_json(msg='Your cryptography version does not support X25519')
-        if not CRYPTOGRAPHY_HAS_X25519_FULL and self.type == 'X25519':
-            self.module.fail_json(msg='Your cryptography version does not support X25519 serialization')
-        if not CRYPTOGRAPHY_HAS_X448 and self.type == 'X448':
-            self.module.fail_json(msg='Your cryptography version does not support X448')
-        if not CRYPTOGRAPHY_HAS_ED25519 and self.type == 'Ed25519':
-            self.module.fail_json(msg='Your cryptography version does not support Ed25519')
-        if not CRYPTOGRAPHY_HAS_ED448 and self.type == 'Ed448':
-            self.module.fail_json(msg='Your cryptography version does not support Ed448')
-
-    def _get_wanted_format(self):
-        if self.format not in ('auto', 'auto_ignore'):
-            return self.format
-        if self.type in ('X25519', 'X448', 'Ed25519', 'Ed448'):
-            return 'pkcs8'
-        else:
-            return 'pkcs1'
-
-    def _generate_private_key(self):
-        """(Re-)Generate private key."""
-        try:
-            if self.type == 'RSA':
-                self.privatekey = cryptography.hazmat.primitives.asymmetric.rsa.generate_private_key(
-                    public_exponent=65537,  # OpenSSL always uses this
-                    key_size=self.size,
-                    backend=self.cryptography_backend
-                )
-            if self.type == 'DSA':
-                self.privatekey = cryptography.hazmat.primitives.asymmetric.dsa.generate_private_key(
-                    key_size=self.size,
-                    backend=self.cryptography_backend
-                )
-            if CRYPTOGRAPHY_HAS_X25519_FULL and self.type == 'X25519':
-                self.privatekey = cryptography.hazmat.primitives.asymmetric.x25519.X25519PrivateKey.generate()
-            if CRYPTOGRAPHY_HAS_X448 and self.type == 'X448':
-                self.privatekey = cryptography.hazmat.primitives.asymmetric.x448.X448PrivateKey.generate()
-            if CRYPTOGRAPHY_HAS_ED25519 and self.type == 'Ed25519':
-                self.privatekey = cryptography.hazmat.primitives.asymmetric.ed25519.Ed25519PrivateKey.generate()
-            if CRYPTOGRAPHY_HAS_ED448 and self.type == 'Ed448':
-                self.privatekey = cryptography.hazmat.primitives.asymmetric.ed448.Ed448PrivateKey.generate()
-            if self.type == 'ECC' and self.curve in self.curves:
-                if self.curves[self.curve]['deprecated']:
-                    self.module.warn('Elliptic curves of type {0} should not be used for new keys!'.format(self.curve))
-                self.privatekey = cryptography.hazmat.primitives.asymmetric.ec.generate_private_key(
-                    curve=self.curves[self.curve]['create'](self.size),
-                    backend=self.cryptography_backend
-                )
-        except cryptography.exceptions.UnsupportedAlgorithm as dummy:
-            self.module.fail_json(msg='Cryptography backend does not support the algorithm required for {0}'.format(self.type))
-
-    def _ensure_private_key_loaded(self):
-        """Make sure that the private key has been loaded."""
-        if self.privatekey is None:
-            self.privatekey = self._load_privatekey()
-
-    def _get_private_key_data(self):
-        """Return bytes for self.privatekey"""
-        # Select export format and encoding
-        try:
-            export_format = self._get_wanted_format()
-            export_encoding = cryptography.hazmat.primitives.serialization.Encoding.PEM
-            if export_format == 'pkcs1':
-                # "TraditionalOpenSSL" format is PKCS1
-                export_format = cryptography.hazmat.primitives.serialization.PrivateFormat.TraditionalOpenSSL
-            elif export_format == 'pkcs8':
-                export_format = cryptography.hazmat.primitives.serialization.PrivateFormat.PKCS8
-            elif export_format == 'raw':
-                export_format = cryptography.hazmat.primitives.serialization.PrivateFormat.Raw
-                export_encoding = cryptography.hazmat.primitives.serialization.Encoding.Raw
-        except AttributeError:
-            self.module.fail_json(msg='Cryptography backend does not support the selected output format "{0}"'.format(self.format))
-
-        # Select key encryption
-        encryption_algorithm = cryptography.hazmat.primitives.serialization.NoEncryption()
-        if self.cipher and self.passphrase:
-            if self.cipher == 'auto':
-                encryption_algorithm = cryptography.hazmat.primitives.serialization.BestAvailableEncryption(to_bytes(self.passphrase))
-            else:
-                self.module.fail_json(msg='Cryptography backend can only use "auto" for cipher option.')
-
-        # Serialize key
-        try:
-            return self.privatekey.private_bytes(
-                encoding=export_encoding,
-                format=export_format,
-                encryption_algorithm=encryption_algorithm
-            )
-        except ValueError as dummy:
-            self.module.fail_json(
-                msg='Cryptography backend cannot serialize the private key in the required format "{0}"'.format(self.format)
-            )
-        except Exception as dummy:
-            self.module.fail_json(
-                msg='Error while serializing the private key in the required format "{0}"'.format(self.format),
-                exception=traceback.format_exc()
-            )
-
-    def _load_privatekey(self):
-        try:
-            # Read bytes
-            with open(self.path, 'rb') as f:
-                data = f.read()
-            # Interpret bytes depending on format.
-            format = identify_private_key_format(data)
-            if format == 'raw':
-                if len(data) == 56 and CRYPTOGRAPHY_HAS_X448:
-                    return cryptography.hazmat.primitives.asymmetric.x448.X448PrivateKey.from_private_bytes(data)
-                if len(data) == 57 and CRYPTOGRAPHY_HAS_ED448:
-                    return cryptography.hazmat.primitives.asymmetric.ed448.Ed448PrivateKey.from_private_bytes(data)
-                if len(data) == 32:
-                    if CRYPTOGRAPHY_HAS_X25519 and (self.type == 'X25519' or not CRYPTOGRAPHY_HAS_ED25519):
-                        return cryptography.hazmat.primitives.asymmetric.x25519.X25519PrivateKey.from_private_bytes(data)
-                    if CRYPTOGRAPHY_HAS_ED25519 and (self.type == 'Ed25519' or not CRYPTOGRAPHY_HAS_X25519):
-                        return cryptography.hazmat.primitives.asymmetric.ed25519.Ed25519PrivateKey.from_private_bytes(data)
-                    if CRYPTOGRAPHY_HAS_X25519 and CRYPTOGRAPHY_HAS_ED25519:
-                        try:
-                            return cryptography.hazmat.primitives.asymmetric.x25519.X25519PrivateKey.from_private_bytes(data)
-                        except Exception:
-                            return cryptography.hazmat.primitives.asymmetric.ed25519.Ed25519PrivateKey.from_private_bytes(data)
-                raise PrivateKeyError('Cannot load raw key')
-            else:
-                return cryptography.hazmat.primitives.serialization.load_pem_private_key(
-                    data,
-                    None if self.passphrase is None else to_bytes(self.passphrase),
-                    backend=self.cryptography_backend
-                )
-        except Exception as e:
-            raise PrivateKeyError(e)
-
-    def _get_fingerprint(self):
-        # Get bytes of public key
-        private_key = self._load_privatekey()
-        public_key = private_key.public_key()
-        public_key_bytes = public_key.public_bytes(
-            cryptography.hazmat.primitives.serialization.Encoding.DER,
-            cryptography.hazmat.primitives.serialization.PublicFormat.SubjectPublicKeyInfo
-        )
-        # Get fingerprints of public_key_bytes
-        return get_fingerprint_of_bytes(public_key_bytes)
-
-    def _check_passphrase(self):
-        try:
-            with open(self.path, 'rb') as f:
-                data = f.read()
-            format = identify_private_key_format(data)
-            if format == 'raw':
-                # Raw keys cannot be encrypted. To avoid incompatibilities, we try to
-                # actually load the key (and return False when this fails).
-                self._load_privatekey()
-                # Loading the key succeeded. Only return True when no passphrase was
-                # provided.
-                return self.passphrase is None
-            else:
-                return cryptography.hazmat.primitives.serialization.load_pem_private_key(
-                    data,
-                    None if self.passphrase is None else to_bytes(self.passphrase),
-                    backend=self.cryptography_backend
-                )
-        except Exception as dummy:
-            return False
-
-    def _check_size_and_type(self):
-        self._ensure_private_key_loaded()
-
-        if isinstance(self.privatekey, cryptography.hazmat.primitives.asymmetric.rsa.RSAPrivateKey):
-            return self.type == 'RSA' and self.size == self.privatekey.key_size
-        if isinstance(self.privatekey, cryptography.hazmat.primitives.asymmetric.dsa.DSAPrivateKey):
-            return self.type == 'DSA' and self.size == self.privatekey.key_size
-        if CRYPTOGRAPHY_HAS_X25519 and isinstance(self.privatekey, cryptography.hazmat.primitives.asymmetric.x25519.X25519PrivateKey):
-            return self.type == 'X25519'
-        if CRYPTOGRAPHY_HAS_X448 and isinstance(self.privatekey, cryptography.hazmat.primitives.asymmetric.x448.X448PrivateKey):
-            return self.type == 'X448'
-        if CRYPTOGRAPHY_HAS_ED25519 and isinstance(self.privatekey, cryptography.hazmat.primitives.asymmetric.ed25519.Ed25519PrivateKey):
-            return self.type == 'Ed25519'
-        if CRYPTOGRAPHY_HAS_ED448 and isinstance(self.privatekey, cryptography.hazmat.primitives.asymmetric.ed448.Ed448PrivateKey):
-            return self.type == 'Ed448'
-        if isinstance(self.privatekey, cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePrivateKey):
-            if self.type != 'ECC':
-                return False
-            if self.curve not in self.curves:
-                return False
-            return self.curves[self.curve]['verify'](self.privatekey)
-
-        return False
-
-    def _check_format(self):
-        if self.format == 'auto_ignore':
-            return True
-        try:
-            with open(self.path, 'rb') as f:
-                content = f.read()
-            format = identify_private_key_format(content)
-            return format == self._get_wanted_format()
-        except Exception as dummy:
-            return False
-
-    def dump(self):
-        """Serialize the object into a dictionary."""
-        result = super(PrivateKeyCryptography, self).dump()
-        result['type'] = self.type
-        if self.type == 'ECC':
-            result['curve'] = self.curve
-        return result
-
-
 def main():
 
-    module = AnsibleModule(
-        argument_spec=dict(
-            state=dict(type='str', default='present', choices=['present', 'absent']),
-            size=dict(type='int', default=4096),
-            type=dict(type='str', default='RSA', choices=[
-                'DSA', 'ECC', 'Ed25519', 'Ed448', 'RSA', 'X25519', 'X448'
-            ]),
-            curve=dict(type='str', choices=[
-                'secp384r1', 'secp521r1', 'secp224r1', 'secp192r1', 'secp256r1',
-                'secp256k1', 'brainpoolP256r1', 'brainpoolP384r1', 'brainpoolP512r1',
-                'sect571k1', 'sect409k1', 'sect283k1', 'sect233k1', 'sect163k1',
-                'sect571r1', 'sect409r1', 'sect283r1', 'sect233r1', 'sect163r2',
-            ]),
-            force=dict(type='bool', default=False),
-            path=dict(type='path', required=True),
-            passphrase=dict(type='str', no_log=True),
-            cipher=dict(type='str'),
-            backup=dict(type='bool', default=False),
-            format=dict(type='str', default='auto_ignore', choices=['pkcs1', 'pkcs8', 'raw', 'auto', 'auto_ignore']),
-            format_mismatch=dict(type='str', default='regenerate', choices=['regenerate', 'convert']),
-            select_crypto_backend=dict(type='str', choices=['auto', 'pyopenssl', 'cryptography'], default='auto'),
-            return_content=dict(type='bool', default=False),
-            regenerate=dict(
-                type='str',
-                default='full_idempotence',
-                choices=['never', 'fail', 'partial_idempotence', 'full_idempotence', 'always']
-            ),
-        ),
+    argument_spec = get_privatekey_argument_spec()
+    argument_spec.argument_spec.update(dict(
+        state=dict(type='str', default='present', choices=['present', 'absent']),
+        force=dict(type='bool', default=False),
+        path=dict(type='path', required=True),
+        backup=dict(type='bool', default=False),
+        return_content=dict(type='bool', default=False),
+    ))
+    module = argument_spec.create_ansible_module(
         supports_check_mode=True,
         add_file_common_args=True,
-        required_together=[
-            ['cipher', 'passphrase']
-        ],
-        required_if=[
-            ['type', 'ECC', ['curve']],
-        ],
     )
 
     base_dir = os.path.dirname(module.params['path']) or '.'
@@ -886,61 +256,17 @@ def main():
             msg='The directory %s does not exist or the file is not a directory' % base_dir
         )
 
-    backend = module.params['select_crypto_backend']
-    if backend == 'auto':
-        # Detection what is possible
-        can_use_cryptography = CRYPTOGRAPHY_FOUND and CRYPTOGRAPHY_VERSION >= LooseVersion(MINIMAL_CRYPTOGRAPHY_VERSION)
-        can_use_pyopenssl = PYOPENSSL_FOUND and PYOPENSSL_VERSION >= LooseVersion(MINIMAL_PYOPENSSL_VERSION)
+    backend, module_backend = select_backend(
+        module=module,
+        backend=module.params['select_crypto_backend'],
+    )
 
-        # Decision
-        if module.params['cipher'] and module.params['passphrase'] and module.params['cipher'] != 'auto':
-            # First try pyOpenSSL, then cryptography
-            if can_use_pyopenssl:
-                backend = 'pyopenssl'
-            elif can_use_cryptography:
-                backend = 'cryptography'
-        else:
-            # First try cryptography, then pyOpenSSL
-            if can_use_cryptography:
-                backend = 'cryptography'
-            elif can_use_pyopenssl:
-                backend = 'pyopenssl'
-
-        # Success?
-        if backend == 'auto':
-            module.fail_json(msg=("Can't detect any of the required Python libraries "
-                                  "cryptography (>= {0}) or PyOpenSSL (>= {1})").format(
-                                      MINIMAL_CRYPTOGRAPHY_VERSION,
-                                      MINIMAL_PYOPENSSL_VERSION))
     try:
-        if backend == 'pyopenssl':
-            if not PYOPENSSL_FOUND:
-                module.fail_json(msg=missing_required_lib('pyOpenSSL >= {0}'.format(MINIMAL_PYOPENSSL_VERSION)),
-                                 exception=PYOPENSSL_IMP_ERR)
-            module.deprecate('The module is using the PyOpenSSL backend. This backend has been deprecated',
-                             version='2.0.0', collection_name='community.crypto')
-            private_key = PrivateKeyPyOpenSSL(module)
-        elif backend == 'cryptography':
-            if not CRYPTOGRAPHY_FOUND:
-                module.fail_json(msg=missing_required_lib('cryptography >= {0}'.format(MINIMAL_CRYPTOGRAPHY_VERSION)),
-                                 exception=CRYPTOGRAPHY_IMP_ERR)
-            private_key = PrivateKeyCryptography(module)
+        private_key = PrivateKeyModule(module, module_backend)
 
         if private_key.state == 'present':
-            if module.check_mode:
-                result = private_key.dump()
-                result['changed'] = private_key.force \
-                    or not private_key.check(module, ignore_conversion=True) \
-                    or not private_key.check(module, ignore_conversion=False)
-                module.exit_json(**result)
-
             private_key.generate(module)
         else:
-            if module.check_mode:
-                result = private_key.dump()
-                result['changed'] = os.path.exists(module.params['path'])
-                module.exit_json(**result)
-
             private_key.remove(module)
 
         result = private_key.dump()

plugins/modules/openssl_privatekey_info.py

@@ -65,8 +65,12 @@ options:
         default: auto
         choices: [ auto, cryptography, pyopenssl ]
 
+notes:
+- Supports C(check_mode).
+
 seealso:
 - module: community.crypto.openssl_privatekey
+- module: community.crypto.openssl_privatekey_pipe
 '''
 
 EXAMPLES = r'''
@@ -80,28 +84,28 @@ EXAMPLES = r'''
   register: result
 
 - name: Dump information
-  debug:
+  ansible.builtin.debug:
     var: result
 '''
 
 RETURN = r'''
 can_load_key:
-    description: Whether the module was able to load the private key from disk
+    description: Whether the module was able to load the private key from disk.
     returned: always
     type: bool
 can_parse_key:
-    description: Whether the module was able to parse the private key
+    description: Whether the module was able to parse the private key.
     returned: always
     type: bool
 key_is_consistent:
     description:
         - Whether the key is consistent. Can also return C(none) next to C(yes) and
-          C(no), to indicate that consistency couldn't be checked.
+          C(no), to indicate that consistency could not be checked.
         - In case the check returns C(no), the module will fail.
     returned: always
     type: bool
 public_key:
-    description: Private key's public key in PEM format
+    description: Private key's public key in PEM format.
     returned: success
     type: str
     sample: "-----BEGIN PUBLIC KEY-----\nMIICIjANBgkqhkiG9w0BAQEFAAOCAg8A..."
@@ -583,7 +587,7 @@ def main():
     module = AnsibleModule(
         argument_spec=dict(
             path=dict(type='path'),
-            content=dict(type='str'),
+            content=dict(type='str', no_log=True),
             passphrase=dict(type='str', no_log=True),
             return_private_key_data=dict(type='bool', default=False),
             select_crypto_backend=dict(type='str', default='auto', choices=['auto', 'cryptography', 'pyopenssl']),

plugins/modules/openssl_privatekey_pipe.py

@@ -0,0 +1,118 @@
+#!/usr/bin/python
+# -*- coding: utf-8 -*-
+
+# Copyright: (c) 2020, Felix Fontein <felix@fontein.de>
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+
+from __future__ import absolute_import, division, print_function
+__metaclass__ = type
+
+
+DOCUMENTATION = r'''
+---
+module: openssl_privatekey_pipe
+short_description: Generate OpenSSL private keys without disk access
+version_added: 1.3.0
+description:
+    - This module allows one to (re)generate OpenSSL private keys without disk access.
+    - This allows to read and write keys to vaults without having to write intermediate versions to disk.
+    - Make sure to not write the result of this module into logs or to the console, as it contains private key data! Use the I(no_log) task option to be sure.
+    - Note that this module is implemented as an L(action plugin,https://docs.ansible.com/ansible/latest/plugins/action.html)
+      and will always be executed on the controller.
+author:
+    - Yanis Guenane (@Spredzy)
+    - Felix Fontein (@felixfontein)
+options:
+    content:
+        description:
+            - The current private key data.
+            - Needed for idempotency. If not provided, the module will always return a change, and all idempotence-related
+              options are ignored.
+        type: str
+    content_base64:
+        description:
+            - Set to C(true) if the content is base64 encoded.
+        type: bool
+        default: false
+    return_current_key:
+        description:
+            - Set to C(true) to return the current private key when the module did not generate a new one.
+            - Note that in case of check mode, when this option is not set to C(true), the module always returns the
+              current key (if it was provided) and Ansible will replace it by C(VALUE_SPECIFIED_IN_NO_LOG_PARAMETER).
+        type: bool
+        default: false
+extends_documentation_fragment:
+- community.crypto.module_privatekey
+seealso:
+- module: community.crypto.openssl_privatekey
+- module: community.crypto.openssl_privatekey_info
+'''
+
+EXAMPLES = r'''
+- name: Generate an OpenSSL private key with the default values (4096 bits, RSA)
+  community.crypto.openssl_privatekey_pipe:
+    path: /etc/ssl/private/ansible.com.pem
+  register: output
+  no_log: true  # make sure that private key data is not accidentally revealed in logs!
+- name: Show generated key
+  debug:
+    msg: "{{ output.privatekey }}"
+  # DO NOT OUTPUT KEY MATERIAL TO CONSOLE OR LOGS IN PRODUCTION!
+
+- block:
+    - name: Update sops-encrypted key with the community.sops collection
+      community.crypto.openssl_privatekey_pipe:
+        content: "{{ lookup('community.sops.sops', 'private_key.pem.sops') }}"
+        size: 2048
+      register: output
+      no_log: true  # make sure that private key data is not accidentally revealed in logs!
+
+    - name: Update encrypted key when openssl_privatekey_pipe reported a change
+      community.sops.encrypt_sops:
+        path: private_key.pem.sops
+        content_text: "{{ output.privatekey }}"
+      when: output is changed
+  always:
+    - name: Make sure that output (which contains the private key) is overwritten
+      set_fact:
+        output: ''
+'''
+
+RETURN = r'''
+size:
+    description: Size (in bits) of the TLS/SSL private key.
+    returned: changed or success
+    type: int
+    sample: 4096
+type:
+    description: Algorithm used to generate the TLS/SSL private key.
+    returned: changed or success
+    type: str
+    sample: RSA
+curve:
+    description: Elliptic curve used to generate the TLS/SSL private key.
+    returned: changed or success, and I(type) is C(ECC)
+    type: str
+    sample: secp256r1
+fingerprint:
+    description:
+    - The fingerprint of the public key. Fingerprint will be generated for each C(hashlib.algorithms) available.
+    - The PyOpenSSL backend requires PyOpenSSL >= 16.0 for meaningful output.
+    returned: changed or success
+    type: dict
+    sample:
+      md5: "84:75:71:72:8d:04:b5:6c:4d:37:6d:66:83:f5:4c:29"
+      sha1: "51:cc:7c:68:5d:eb:41:43:88:7e:1a:ae:c7:f8:24:72:ee:71:f6:10"
+      sha224: "b1:19:a6:6c:14:ac:33:1d:ed:18:50:d3:06:5c:b2:32:91:f1:f1:52:8c:cb:d5:75:e9:f5:9b:46"
+      sha256: "41:ab:c7:cb:d5:5f:30:60:46:99:ac:d4:00:70:cf:a1:76:4f:24:5d:10:24:57:5d:51:6e:09:97:df:2f:de:c7"
+      sha384: "85:39:50:4e:de:d9:19:33:40:70:ae:10:ab:59:24:19:51:c3:a2:e4:0b:1c:b1:6e:dd:b3:0c:d9:9e:6a:46:af:da:18:f8:ef:ae:2e:c0:9a:75:2c:9b:b3:0f:3a:5f:3d"
+      sha512: "fd:ed:5e:39:48:5f:9f:fe:7f:25:06:3f:79:08:cd:ee:a5:e7:b3:3d:13:82:87:1f:84:e1:f5:c7:28:77:53:94:86:56:38:69:f0:d9:35:22:01:1e:a6:60:...:0f:9b"
+privatekey:
+    description:
+        - The generated private key's content.
+        - Please note that if the result is not changed, the current private key will only be returned
+          if the I(return_current_key) option is set to C(true).
+        - Will be Base64-encoded if the key is in raw format.
+    returned: changed, or I(return_current_key) is C(true)
+    type: str
+'''

plugins/modules/openssl_publickey.py

@@ -92,10 +92,13 @@ extends_documentation_fragment:
 - files
 seealso:
 - module: community.crypto.x509_certificate
+- module: community.crypto.x509_certificate_pipe
 - module: community.crypto.openssl_csr
+- module: community.crypto.openssl_csr_pipe
 - module: community.crypto.openssl_dhparam
 - module: community.crypto.openssl_pkcs12
 - module: community.crypto.openssl_privatekey
+- module: community.crypto.openssl_privatekey_pipe
 '''
 
 EXAMPLES = r'''
@@ -395,7 +398,7 @@ def main():
             force=dict(type='bool', default=False),
             path=dict(type='path', required=True),
             privatekey_path=dict(type='path'),
-            privatekey_content=dict(type='str'),
+            privatekey_content=dict(type='str', no_log=True),
             format=dict(type='str', default='PEM', choices=['OpenSSH', 'PEM']),
             privatekey_passphrase=dict(type='str', no_log=True),
             backup=dict(type='bool', default=False),

plugins/modules/openssl_signature.py

@@ -259,7 +259,7 @@ def main():
     module = AnsibleModule(
         argument_spec=dict(
             privatekey_path=dict(type='path'),
-            privatekey_content=dict(type='str'),
+            privatekey_content=dict(type='str', no_log=True),
             privatekey_passphrase=dict(type='str', no_log=True),
             path=dict(type='path', required=True),
             select_crypto_backend=dict(type='str', choices=['auto', 'pyopenssl', 'cryptography'], default='auto'),

plugins/modules/openssl_signature_info.py

@@ -14,7 +14,7 @@ module: openssl_signature_info
 version_added: 1.1.0
 short_description: Verify signatures with openssl
 description:
-    - This module allows one to verify a signature for a file via a certificate.
+    - This module allows one to verify a signature for a file by a certificate.
     - The module can use the cryptography Python library, or the pyOpenSSL Python
       library. By default, it tries to detect which one is available. This can be
       overridden with the I(select_crypto_backend) option. Please note that the PyOpenSSL backend
@@ -61,6 +61,7 @@ notes:
       RSA keys: C(cryptography) >= 1.4
       DSA and ECDSA keys: C(cryptography) >= 1.5
       ed448 and ed25519 keys: C(cryptography) >= 2.6
+    - Supports C(check_mode).
 seealso:
     - module: community.crypto.openssl_signature
     - module: community.crypto.x509_certificate
@@ -88,7 +89,7 @@ EXAMPLES = r'''
 
 RETURN = r'''
 valid:
-    description: C(true) means the signature was valid for the given file, C(false) means it wasn't.
+    description: C(true) means the signature was valid for the given file, C(false) means it was not.
     returned: success
     type: bool
 '''

plugins/modules/x509_certificate_info.py

@@ -54,7 +54,7 @@ options:
             - Time can be specified either as relative time or as absolute timestamp.
             - Time will always be interpreted as UTC.
             - Valid format is C([+-]timespec | ASN.1 TIME) where timespec can be an integer
-              + C([w | d | h | m | s]) (e.g. C(+32w1d2h), and ASN.1 TIME (i.e. pattern C(YYYYMMDDHHMMSSZ)).
+              + C([w | d | h | m | s]) (e.g. C(+32w1d2h), and ASN.1 TIME (in other words, pattern C(YYYYMMDDHHMMSSZ)).
               Note that all timestamps will be treated as being in UTC.
         type: dict
     select_crypto_backend:
@@ -70,10 +70,12 @@ options:
         choices: [ auto, cryptography, pyopenssl ]
 
 notes:
-    - All timestamp values are provided in ASN.1 TIME format, i.e. following the C(YYYYMMDDHHMMSSZ) pattern.
+    - All timestamp values are provided in ASN.1 TIME format, in other words, following the C(YYYYMMDDHHMMSSZ) pattern.
       They are all in UTC.
+    - Supports C(check_mode).
 seealso:
 - module: community.crypto.x509_certificate
+- module: community.crypto.x509_certificate_pipe
 '''
 
 EXAMPLES = r'''
@@ -93,7 +95,7 @@ EXAMPLES = r'''
   register: result
 
 - name: Dump information
-  debug:
+  ansible.builtin.debug:
     var: result
 
 
@@ -119,7 +121,7 @@ EXAMPLES = r'''
 
 RETURN = r'''
 expired:
-    description: Whether the certificate is expired (i.e. C(notAfter) is in the past)
+    description: Whether the certificate is expired (in other words, C(notAfter) is in the past).
     returned: success
     type: bool
 basic_constraints:
@@ -143,7 +145,7 @@ extended_key_usage_critical:
     returned: success
     type: bool
 extensions_by_oid:
-    description: Returns a dictionary for every extension OID
+    description: Returns a dictionary for every extension OID.
     returned: success
     type: dict
     contains:
@@ -152,7 +154,7 @@ extensions_by_oid:
             returned: success
             type: bool
         value:
-            description: The Base64 encoded value (in DER format) of the extension
+            description: The Base64 encoded value (in DER format) of the extension.
             returned: success
             type: str
             sample: "MAMCAQU="
@@ -211,17 +213,17 @@ subject_ordered:
     elements: list
     sample: '[["commonName", "www.example.com"], ["emailAddress": "test@example.com"]]'
 not_after:
-    description: C(notAfter) date as ASN.1 TIME
+    description: C(notAfter) date as ASN.1 TIME.
     returned: success
     type: str
     sample: 20190413202428Z
 not_before:
-    description: C(notBefore) date as ASN.1 TIME
+    description: C(notBefore) date as ASN.1 TIME.
     returned: success
     type: str
     sample: 20190331202428Z
 public_key:
-    description: Certificate's public key in PEM format
+    description: Certificate's public key in PEM format.
     returned: success
     type: str
     sample: "-----BEGIN PUBLIC KEY-----\nMIICIjANBgkqhkiG9w0BAQEFAAOCAg8A..."
@@ -233,6 +235,15 @@ public_key_fingerprints:
     type: dict
     sample: "{'sha256': 'd4:b3:aa:6d:c8:04:ce:4e:ba:f6:29:4d:92:a3:94:b0:c2:ff:bd:bf:33:63:11:43:34:0f:51:b0:95:09:2f:63',
               'sha512': 'f7:07:4a:f0:b0:f0:e6:8b:95:5f:f9:e6:61:0a:32:68:f1..."
+fingerprints:
+    description:
+        - Fingerprints of the DER-encoded form of the whole certificate.
+        - For every hash algorithm available, the fingerprint is computed.
+    returned: success
+    type: dict
+    sample: "{'sha256': 'd4:b3:aa:6d:c8:04:ce:4e:ba:f6:29:4d:92:a3:94:b0:c2:ff:bd:bf:33:63:11:43:34:0f:51:b0:95:09:2f:63',
+              'sha512': 'f7:07:4a:f0:b0:f0:e6:8b:95:5f:f9:e6:61:0a:32:68:f1..."
+    version_added: 1.2.0
 signature_algorithm:
     description: The signature algorithm used to sign the certificate.
     returned: success
@@ -401,6 +412,10 @@ class CertificateInfo(OpenSSLObject):
         # Empty method because OpenSSLObject wants this
         pass
 
+    @abc.abstractmethod
+    def _get_der_bytes(self):
+        pass
+
     @abc.abstractmethod
     def _get_signature_algorithm(self):
         pass
@@ -506,6 +521,8 @@ class CertificateInfo(OpenSSLObject):
         pk = self._get_public_key(binary=True)
         result['public_key_fingerprints'] = get_fingerprint_of_bytes(pk) if pk is not None else dict()
 
+        result['fingerprints'] = get_fingerprint_of_bytes(self._get_der_bytes())
+
         if self.backend != 'pyopenssl':
             ski = self._get_subject_key_identifier()
             if ski is not None:
@@ -533,6 +550,9 @@ class CertificateInfoCryptography(CertificateInfo):
     def __init__(self, module):
         super(CertificateInfoCryptography, self).__init__(module, 'cryptography')
 
+    def _get_der_bytes(self):
+        return self.cert.public_bytes(serialization.Encoding.DER)
+
     def _get_signature_algorithm(self):
         return cryptography_oid_to_name(self.cert.signature_algorithm_oid)
 
@@ -689,6 +709,9 @@ class CertificateInfoPyOpenSSL(CertificateInfo):
     def __init__(self, module):
         super(CertificateInfoPyOpenSSL, self).__init__(module, 'pyopenssl')
 
+    def _get_der_bytes(self):
+        return crypto.dump_certificate(crypto.FILETYPE_ASN1, self.cert)
+
     def _get_signature_algorithm(self):
         return to_text(self.cert.get_signature_algorithm())
 

plugins/modules/x509_certificate_pipe.py

@@ -0,0 +1,210 @@
+#!/usr/bin/python
+# -*- coding: utf-8 -*-
+
+# Copyright: (c) 2016-2017, Yanis Guenane <yanis+ansible@guenane.org>
+# Copyright: (c) 2017, Markus Teufelberger <mteufelberger+ansible@mgit.at>
+# Copyright: (2) 2020, Felix Fontein <felix@fontein.de>
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+
+from __future__ import absolute_import, division, print_function
+__metaclass__ = type
+
+
+DOCUMENTATION = r'''
+---
+module: x509_certificate_pipe
+short_description: Generate and/or check OpenSSL certificates
+version_added: 1.3.0
+description:
+    - It implements a notion of provider (ie. C(selfsigned), C(ownca), C(entrust))
+      for your certificate.
+    - "Please note that the module regenerates an existing certificate if it does not match the module's
+      options, or if it seems to be corrupt. If you are concerned that this could overwrite
+      your existing certificate, consider using the I(backup) option."
+author:
+  - Yanis Guenane (@Spredzy)
+  - Markus Teufelberger (@MarkusTeufelberger)
+  - Felix Fontein (@felixfontein)
+options:
+    provider:
+        description:
+            - Name of the provider to use to generate/retrieve the OpenSSL certificate.
+            - "The C(entrust) provider requires credentials for the
+               L(Entrust Certificate Services,https://www.entrustdatacard.com/products/categories/ssl-certificates) (ECS) API."
+        type: str
+        choices: [ entrust, ownca, selfsigned ]
+        required: true
+
+    content:
+        description:
+            - The existing certificate.
+        type: str
+
+seealso:
+- module: community.crypto.x509_certificate
+
+notes:
+- Supports C(check_mode).
+
+extends_documentation_fragment:
+    - community.crypto.module_certificate
+    - community.crypto.module_certificate.backend_entrust_documentation
+    - community.crypto.module_certificate.backend_ownca_documentation
+    - community.crypto.module_certificate.backend_selfsigned_documentation
+'''
+
+EXAMPLES = r'''
+- name: Generate a Self Signed OpenSSL certificate
+  community.crypto.x509_certificate_pipe:
+    provider: selfsigned
+    privatekey_path: /etc/ssl/private/ansible.com.pem
+    csr_path: /etc/ssl/csr/ansible.com.csr
+  register: result
+- name: Print the certificate
+  ansible.builtin.debug:
+    var: result.certificate
+
+# In the following example, both CSR and certificate file are stored on the
+# machine where ansible-playbook is executed, while the OwnCA data (certificate,
+# private key) are stored on the remote machine.
+
+- name: (1/2) Generate an OpenSSL Certificate with the CSR provided inline
+  community.crypto.x509_certificate_pipe:
+    provider: ownca
+    content: "{{ lookup('file', '/etc/ssl/csr/www.ansible.com.crt') }}"
+    csr_content: "{{ lookup('file', '/etc/ssl/csr/www.ansible.com.csr') }}"
+    ownca_cert: /path/to/ca_cert.crt
+    ownca_privatekey: /path/to/ca_cert.key
+    ownca_privatekey_passphrase: hunter2
+  register: result
+
+- name: (2/2) Store certificate
+  ansible.builtin.copy:
+    dest: /etc/ssl/csr/www.ansible.com.crt
+    content: "{{ result.certificate }}"
+  delegate_to: localhost
+  when: result is changed
+
+# In the following example, the certificate from another machine is signed by
+# our OwnCA whose private key and certificate are only available on this
+# machine (where ansible-playbook is executed), without having to write
+# the certificate file to disk on localhost. The CSR could have been
+# provided by community.crypto.openssl_csr_pipe earlier, or also have been
+# read from the remote machine.
+
+- name: (1/3) Read certificate's contents from remote machine
+  ansible.builtin.slurp:
+    src: /etc/ssl/csr/www.ansible.com.crt
+  register: certificate_content
+
+- name: (2/3) Generate an OpenSSL Certificate with the CSR provided inline
+  community.crypto.x509_certificate_pipe:
+    provider: ownca
+    content: "{{ certificate_content.content | b64decode }}"
+    csr_content: "{{ the_csr }}"
+    ownca_cert: /path/to/ca_cert.crt
+    ownca_privatekey: /path/to/ca_cert.key
+    ownca_privatekey_passphrase: hunter2
+  delegate_to: localhost
+  register: result
+
+- name: (3/3) Store certificate
+  ansible.builtin.copy:
+    dest: /etc/ssl/csr/www.ansible.com.crt
+    content: "{{ result.certificate }}"
+  when: result is changed
+'''
+
+RETURN = r'''
+certificate:
+    description: The (current or generated) certificate's content.
+    returned: changed or success
+    type: str
+'''
+
+
+import os
+
+from ansible.module_utils._text import to_native
+
+from ansible_collections.community.crypto.plugins.module_utils.crypto.module_backends.certificate import (
+    select_backend,
+    get_certificate_argument_spec,
+)
+
+from ansible_collections.community.crypto.plugins.module_utils.crypto.module_backends.certificate_entrust import (
+    EntrustCertificateProvider,
+    add_entrust_provider_to_argument_spec,
+)
+
+from ansible_collections.community.crypto.plugins.module_utils.crypto.module_backends.certificate_ownca import (
+    OwnCACertificateProvider,
+    add_ownca_provider_to_argument_spec,
+)
+
+from ansible_collections.community.crypto.plugins.module_utils.crypto.module_backends.certificate_selfsigned import (
+    SelfSignedCertificateProvider,
+    add_selfsigned_provider_to_argument_spec,
+)
+
+from ansible_collections.community.crypto.plugins.module_utils.crypto.basic import (
+    OpenSSLObjectError,
+)
+
+
+class GenericCertificate(object):
+    """Retrieve a certificate using the given module backend."""
+    def __init__(self, module, module_backend):
+        self.check_mode = module.check_mode
+        self.module_backend = module_backend
+        self.changed = False
+        if module.params['content'] is not None:
+            self.module_backend.set_existing(module.params['content'].encode('utf-8'))
+
+    def generate(self, module):
+        if self.module_backend.needs_regeneration():
+            if not self.check_mode:
+                self.module_backend.generate_certificate()
+            self.changed = True
+
+    def dump(self, check_mode=False):
+        result = self.module_backend.dump(include_certificate=True)
+        result.update({
+            'changed': self.changed,
+        })
+        return result
+
+
+def main():
+    argument_spec = get_certificate_argument_spec()
+    argument_spec.argument_spec['provider']['required'] = True
+    add_entrust_provider_to_argument_spec(argument_spec)
+    add_ownca_provider_to_argument_spec(argument_spec)
+    add_selfsigned_provider_to_argument_spec(argument_spec)
+    argument_spec.argument_spec.update(dict(
+        content=dict(type='str'),
+    ))
+    module = argument_spec.create_ansible_module(
+        supports_check_mode=True,
+    )
+
+    try:
+        provider = module.params['provider']
+        provider_map = {
+            'entrust': EntrustCertificateProvider,
+            'ownca': OwnCACertificateProvider,
+            'selfsigned': SelfSignedCertificateProvider,
+        }
+
+        backend = module.params['select_crypto_backend']
+        module_backend = select_backend(module, backend, provider_map[provider]())
+        certificate = GenericCertificate(module, module_backend)
+        certificate.generate(module)
+        result = certificate.dump()
+        module.exit_json(**result)
+    except OpenSSLObjectError as exc:
+        module.fail_json(msg=to_native(exc))
+
+
+if __name__ == "__main__":
+    main()

plugins/modules/x509_crl.py

@@ -15,7 +15,7 @@ version_added: '1.0.0'
 short_description: Generate Certificate Revocation Lists (CRLs)
 description:
     - This module allows one to (re)generate or update Certificate Revocation Lists (CRLs).
-    - Certificates on the revocation list can be either specified via serial number and (optionally) their issuer,
+    - Certificates on the revocation list can be either specified by serial number and (optionally) their issuer,
       or as a path to a certificate file in PEM format.
 requirements:
     - cryptography >= 1.2
@@ -233,6 +233,7 @@ extends_documentation_fragment:
 notes:
     - All ASN.1 TIME values should be specified following the YYYYMMDDHHMMSSZ pattern.
     - Date specified should be UTC. Minutes and seconds are mandatory.
+    - Supports C(check_mode).
 '''
 
 EXAMPLES = r'''
@@ -259,7 +260,7 @@ EXAMPLES = r'''
 
 RETURN = r'''
 filename:
-    description: Path to the generated CRL
+    description: Path to the generated CRL.
     returned: changed or success
     type: str
     sample: /path/to/my-ca.crl
@@ -269,7 +270,7 @@ backup_file:
     type: str
     sample: /path/to/my-ca.crl.2019-03-09@11:22~
 privatekey:
-    description: Path to the private CA key
+    description: Path to the private CA key.
     returned: changed or success
     type: str
     sample: /path/to/my-ca.pem
@@ -404,7 +405,7 @@ from ansible_collections.community.crypto.plugins.module_utils.crypto.cryptograp
     cryptography_get_signature_algorithm_oid_from_crl,
 )
 
-from ansible_collections.community.crypto.plugins.module_utils.crypto.identify import (
+from ansible_collections.community.crypto.plugins.module_utils.crypto.pem import (
     identify_pem_format,
 )
 
@@ -501,7 +502,7 @@ class CRL(OpenSSLObject):
                 result['serial_number'] = rc['serial_number']
             # All other options
             if rc['issuer']:
-                result['issuer'] = [cryptography_get_name(issuer) for issuer in rc['issuer']]
+                result['issuer'] = [cryptography_get_name(issuer, 'issuer') for issuer in rc['issuer']]
                 result['issuer_critical'] = rc['issuer_critical']
             result['revocation_date'] = get_relative_time_option(
                 rc['revocation_date'],
@@ -647,7 +648,7 @@ class CRL(OpenSSLObject):
             if entry['issuer'] is not None:
                 revoked_cert = revoked_cert.add_extension(
                     x509.CertificateIssuer([
-                        cryptography_get_name(name) for name in entry['issuer']
+                        cryptography_get_name(name, 'issuer') for name in entry['issuer']
                     ]),
                     entry['issuer_critical']
                 )
@@ -754,7 +755,7 @@ def main():
             path=dict(type='path', required=True),
             format=dict(type='str', default='pem', choices=['pem', 'der']),
             privatekey_path=dict(type='path'),
-            privatekey_content=dict(type='str'),
+            privatekey_content=dict(type='str', no_log=True),
             privatekey_passphrase=dict(type='str', no_log=True),
             issuer=dict(type='dict'),
             last_update=dict(type='str', default='+0s'),

plugins/modules/x509_crl_info.py

@@ -32,8 +32,9 @@ options:
         type: str
 
 notes:
-    - All timestamp values are provided in ASN.1 TIME format, i.e. following the C(YYYYMMDDHHMMSSZ) pattern.
+    - All timestamp values are provided in ASN.1 TIME format, in other words, following the C(YYYYMMDDHHMMSSZ) pattern.
       They are all in UTC.
+    - Supports C(check_mode).
 seealso:
     - module: community.crypto.x509_crl
 '''
@@ -44,7 +45,8 @@ EXAMPLES = r'''
     path: /etc/ssl/my-ca.crl
   register: result
 
-- debug:
+- name: Print the information
+  ansible.builtin.debug:
     msg: "{{ result }}"
 '''
 
@@ -158,7 +160,7 @@ from ansible_collections.community.crypto.plugins.module_utils.crypto.cryptograp
     cryptography_get_signature_algorithm_oid_from_crl,
 )
 
-from ansible_collections.community.crypto.plugins.module_utils.crypto.identify import (
+from ansible_collections.community.crypto.plugins.module_utils.crypto.pem import (
     identify_pem_format,
 )
 

plugins/plugin_utils/action_module.py

@@ -0,0 +1,760 @@
+# -*- coding: utf-8 -*-
+#
+# Copyright (c) 2012-2013 Michael DeHaan <michael.dehaan@gmail.com>
+# Copyright (c) 2016 Toshio Kuratomi <tkuratomi@ansible.com>
+# Copyright (c) 2019 Ansible Project
+# Copyright (c) 2020 Felix Fontein <felix@fontein.de>
+# Copyright (c) 2021 Ansible Project
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+
+# Parts taken from ansible.module_utils.basic and ansible.module_utils.common.warnings.
+
+# NOTE: THIS IS ONLY FOR ACTION PLUGINS!
+
+from __future__ import absolute_import, division, print_function
+__metaclass__ = type
+
+
+import abc
+import copy
+import traceback
+
+from ansible import constants as C
+from ansible.errors import AnsibleError
+from ansible.module_utils import six
+from ansible.module_utils.basic import AnsibleFallbackNotFound, SEQUENCETYPE, remove_values
+from ansible.module_utils.common._collections_compat import (
+    Mapping
+)
+from ansible.module_utils.common.parameters import (
+    PASS_VARS,
+    PASS_BOOLS,
+)
+from ansible.module_utils.common.validation import (
+    check_mutually_exclusive,
+    check_required_arguments,
+    check_required_by,
+    check_required_if,
+    check_required_one_of,
+    check_required_together,
+    count_terms,
+    check_type_bool,
+    check_type_bits,
+    check_type_bytes,
+    check_type_float,
+    check_type_int,
+    check_type_jsonarg,
+    check_type_list,
+    check_type_dict,
+    check_type_path,
+    check_type_raw,
+    check_type_str,
+    safe_eval,
+)
+from ansible.module_utils.common.text.formatters import (
+    lenient_lowercase,
+)
+from ansible.module_utils.parsing.convert_bool import BOOLEANS_FALSE, BOOLEANS_TRUE
+from ansible.module_utils.six import (
+    binary_type,
+    string_types,
+    text_type,
+)
+from ansible.module_utils._text import to_native, to_text
+from ansible.plugins.action import ActionBase
+
+
+try:
+    # For ansible-core 2.11, we can use the ArgumentSpecValidator. We also import
+    # ModuleArgumentSpecValidator since that indicates that the 'classical' approach
+    # will no longer work.
+    from ansible.module_utils.common.arg_spec import (
+        ArgumentSpecValidator,
+        ModuleArgumentSpecValidator,  # noqa
+    )
+    from ansible.module_utils.errors import UnsupportedError
+    HAS_ARGSPEC_VALIDATOR = True
+except ImportError:
+    # For ansible-base 2.10 and Ansible 2.9, we need to use the 'classical' approach
+    from ansible.module_utils.common.parameters import (
+        handle_aliases,
+        list_deprecations,
+        list_no_log_values,
+    )
+    HAS_ARGSPEC_VALIDATOR = False
+
+
+class _ModuleExitException(Exception):
+    def __init__(self, result):
+        super(_ModuleExitException, self).__init__()
+        self.result = result
+
+
+class AnsibleActionModule(object):
+    def __init__(self, action_plugin, argument_spec, bypass_checks=False,
+                 mutually_exclusive=None, required_together=None,
+                 required_one_of=None, supports_check_mode=False,
+                 required_if=None, required_by=None):
+        # Internal data
+        self.__action_plugin = action_plugin
+        self.__warnings = []
+        self.__deprecations = []
+
+        # AnsibleModule data
+        self._name = self.__action_plugin._task.action
+        self.argument_spec = argument_spec
+        self.supports_check_mode = supports_check_mode
+        self.check_mode = self.__action_plugin._play_context.check_mode
+        self.bypass_checks = bypass_checks
+        self.no_log = self.__action_plugin._play_context.no_log
+
+        self.mutually_exclusive = mutually_exclusive
+        self.required_together = required_together
+        self.required_one_of = required_one_of
+        self.required_if = required_if
+        self.required_by = required_by
+        self._diff = self.__action_plugin._play_context.diff
+        self._verbosity = self.__action_plugin._display.verbosity
+        self._string_conversion_action = C.STRING_CONVERSION_ACTION
+
+        self.aliases = {}
+        self._legal_inputs = []
+        self._options_context = list()
+
+        self.params = copy.deepcopy(action_plugin._task.args)
+        self.no_log_values = set()
+        if HAS_ARGSPEC_VALIDATOR:
+            self._validator = ArgumentSpecValidator(
+                self.argument_spec,
+                self.mutually_exclusive,
+                self.required_together,
+                self.required_one_of,
+                self.required_if,
+                self.required_by,
+            )
+            self._validation_result = self._validator.validate(self.params)
+            self.params.update(self._validation_result.validated_parameters)
+            self.no_log_values.update(self._validation_result._no_log_values)
+
+            try:
+                error = self._validation_result.errors[0]
+            except IndexError:
+                error = None
+
+            # We cannot use ModuleArgumentSpecValidator directly since it uses mechanisms for reporting
+            # warnings and deprecations that do not work in plugins. This is a copy of that code adjusted
+            # for our use-case:
+            for d in self._validation_result._deprecations:
+                self.deprecate(
+                    "Alias '{name}' is deprecated. See the module docs for more information".format(name=d['name']),
+                    version=d.get('version'), date=d.get('date'), collection_name=d.get('collection_name'))
+
+            for w in self._validation_result._warnings:
+                self.warn('Both option {option} and its alias {alias} are set.'.format(option=w['option'], alias=w['alias']))
+
+            # Fail for validation errors, even in check mode
+            if error:
+                msg = self._validation_result.errors.msg
+                if isinstance(error, UnsupportedError):
+                    msg = "Unsupported parameters for ({name}) {kind}: {msg}".format(name=self._name, kind='module', msg=msg)
+
+                self.fail_json(msg=msg)
+        else:
+            self._set_fallbacks()
+
+            # append to legal_inputs and then possibly check against them
+            try:
+                self.aliases = self._handle_aliases()
+            except (ValueError, TypeError) as e:
+                # Use exceptions here because it isn't safe to call fail_json until no_log is processed
+                raise _ModuleExitException(dict(failed=True, msg="Module alias error: %s" % to_native(e)))
+
+            # Save parameter values that should never be logged
+            self._handle_no_log_values()
+
+            self._check_arguments()
+
+            # check exclusive early
+            if not bypass_checks:
+                self._check_mutually_exclusive(mutually_exclusive)
+
+            self._set_defaults(pre=True)
+
+            self._CHECK_ARGUMENT_TYPES_DISPATCHER = {
+                'str': self._check_type_str,
+                'list': check_type_list,
+                'dict': check_type_dict,
+                'bool': check_type_bool,
+                'int': check_type_int,
+                'float': check_type_float,
+                'path': check_type_path,
+                'raw': check_type_raw,
+                'jsonarg': check_type_jsonarg,
+                'json': check_type_jsonarg,
+                'bytes': check_type_bytes,
+                'bits': check_type_bits,
+            }
+            if not bypass_checks:
+                self._check_required_arguments()
+                self._check_argument_types()
+                self._check_argument_values()
+                self._check_required_together(required_together)
+                self._check_required_one_of(required_one_of)
+                self._check_required_if(required_if)
+                self._check_required_by(required_by)
+
+            self._set_defaults(pre=False)
+
+            # deal with options sub-spec
+            self._handle_options()
+
+    def _handle_aliases(self, spec=None, param=None, option_prefix=''):
+        if spec is None:
+            spec = self.argument_spec
+        if param is None:
+            param = self.params
+
+        # this uses exceptions as it happens before we can safely call fail_json
+        alias_warnings = []
+        alias_results, self._legal_inputs = handle_aliases(spec, param, alias_warnings=alias_warnings)
+        for option, alias in alias_warnings:
+            self.warn('Both option %s and its alias %s are set.' % (option_prefix + option, option_prefix + alias))
+
+        deprecated_aliases = []
+        for i in spec.keys():
+            if 'deprecated_aliases' in spec[i].keys():
+                for alias in spec[i]['deprecated_aliases']:
+                    deprecated_aliases.append(alias)
+
+        for deprecation in deprecated_aliases:
+            if deprecation['name'] in param.keys():
+                self.deprecate("Alias '%s' is deprecated. See the module docs for more information" % deprecation['name'],
+                               version=deprecation.get('version'), date=deprecation.get('date'),
+                               collection_name=deprecation.get('collection_name'))
+        return alias_results
+
+    def _handle_no_log_values(self, spec=None, param=None):
+        if spec is None:
+            spec = self.argument_spec
+        if param is None:
+            param = self.params
+
+        try:
+            self.no_log_values.update(list_no_log_values(spec, param))
+        except TypeError as te:
+            self.fail_json(msg="Failure when processing no_log parameters. Module invocation will be hidden. "
+                               "%s" % to_native(te), invocation={'module_args': 'HIDDEN DUE TO FAILURE'})
+
+        for message in list_deprecations(spec, param):
+            self.deprecate(message['msg'], version=message.get('version'), date=message.get('date'),
+                           collection_name=message.get('collection_name'))
+
+    def _check_arguments(self, spec=None, param=None, legal_inputs=None):
+        self._syslog_facility = 'LOG_USER'
+        unsupported_parameters = set()
+        if spec is None:
+            spec = self.argument_spec
+        if param is None:
+            param = self.params
+        if legal_inputs is None:
+            legal_inputs = self._legal_inputs
+
+        for k in list(param.keys()):
+
+            if k not in legal_inputs:
+                unsupported_parameters.add(k)
+
+        for k in PASS_VARS:
+            # handle setting internal properties from internal ansible vars
+            param_key = '_ansible_%s' % k
+            if param_key in param:
+                if k in PASS_BOOLS:
+                    setattr(self, PASS_VARS[k][0], self.boolean(param[param_key]))
+                else:
+                    setattr(self, PASS_VARS[k][0], param[param_key])
+
+                # clean up internal top level params:
+                if param_key in self.params:
+                    del self.params[param_key]
+            else:
+                # use defaults if not already set
+                if not hasattr(self, PASS_VARS[k][0]):
+                    setattr(self, PASS_VARS[k][0], PASS_VARS[k][1])
+
+        if unsupported_parameters:
+            msg = "Unsupported parameters for (%s) module: %s" % (self._name, ', '.join(sorted(list(unsupported_parameters))))
+            if self._options_context:
+                msg += " found in %s." % " -> ".join(self._options_context)
+            supported_parameters = list()
+            for key in sorted(spec.keys()):
+                if 'aliases' in spec[key] and spec[key]['aliases']:
+                    supported_parameters.append("%s (%s)" % (key, ', '.join(sorted(spec[key]['aliases']))))
+                else:
+                    supported_parameters.append(key)
+            msg += " Supported parameters include: %s" % (', '.join(supported_parameters))
+            self.fail_json(msg=msg)
+        if self.check_mode and not self.supports_check_mode:
+            self.exit_json(skipped=True, msg="action module (%s) does not support check mode" % self._name)
+
+    def _count_terms(self, check, param=None):
+        if param is None:
+            param = self.params
+        return count_terms(check, param)
+
+    def _check_mutually_exclusive(self, spec, param=None):
+        if param is None:
+            param = self.params
+
+        try:
+            check_mutually_exclusive(spec, param)
+        except TypeError as e:
+            msg = to_native(e)
+            if self._options_context:
+                msg += " found in %s" % " -> ".join(self._options_context)
+            self.fail_json(msg=msg)
+
+    def _check_required_one_of(self, spec, param=None):
+        if spec is None:
+            return
+
+        if param is None:
+            param = self.params
+
+        try:
+            check_required_one_of(spec, param)
+        except TypeError as e:
+            msg = to_native(e)
+            if self._options_context:
+                msg += " found in %s" % " -> ".join(self._options_context)
+            self.fail_json(msg=msg)
+
+    def _check_required_together(self, spec, param=None):
+        if spec is None:
+            return
+        if param is None:
+            param = self.params
+
+        try:
+            check_required_together(spec, param)
+        except TypeError as e:
+            msg = to_native(e)
+            if self._options_context:
+                msg += " found in %s" % " -> ".join(self._options_context)
+            self.fail_json(msg=msg)
+
+    def _check_required_by(self, spec, param=None):
+        if spec is None:
+            return
+        if param is None:
+            param = self.params
+
+        try:
+            check_required_by(spec, param)
+        except TypeError as e:
+            self.fail_json(msg=to_native(e))
+
+    def _check_required_arguments(self, spec=None, param=None):
+        if spec is None:
+            spec = self.argument_spec
+        if param is None:
+            param = self.params
+
+        try:
+            check_required_arguments(spec, param)
+        except TypeError as e:
+            msg = to_native(e)
+            if self._options_context:
+                msg += " found in %s" % " -> ".join(self._options_context)
+            self.fail_json(msg=msg)
+
+    def _check_required_if(self, spec, param=None):
+        ''' ensure that parameters which conditionally required are present '''
+        if spec is None:
+            return
+        if param is None:
+            param = self.params
+
+        try:
+            check_required_if(spec, param)
+        except TypeError as e:
+            msg = to_native(e)
+            if self._options_context:
+                msg += " found in %s" % " -> ".join(self._options_context)
+            self.fail_json(msg=msg)
+
+    def _check_argument_values(self, spec=None, param=None):
+        ''' ensure all arguments have the requested values, and there are no stray arguments '''
+        if spec is None:
+            spec = self.argument_spec
+        if param is None:
+            param = self.params
+        for (k, v) in spec.items():
+            choices = v.get('choices', None)
+            if choices is None:
+                continue
+            if isinstance(choices, SEQUENCETYPE) and not isinstance(choices, (binary_type, text_type)):
+                if k in param:
+                    # Allow one or more when type='list' param with choices
+                    if isinstance(param[k], list):
+                        diff_list = ", ".join([item for item in param[k] if item not in choices])
+                        if diff_list:
+                            choices_str = ", ".join([to_native(c) for c in choices])
+                            msg = "value of %s must be one or more of: %s. Got no match for: %s" % (k, choices_str, diff_list)
+                            if self._options_context:
+                                msg += " found in %s" % " -> ".join(self._options_context)
+                            self.fail_json(msg=msg)
+                    elif param[k] not in choices:
+                        # PyYaml converts certain strings to bools.  If we can unambiguously convert back, do so before checking
+                        # the value.  If we can't figure this out, module author is responsible.
+                        lowered_choices = None
+                        if param[k] == 'False':
+                            lowered_choices = lenient_lowercase(choices)
+                            overlap = BOOLEANS_FALSE.intersection(choices)
+                            if len(overlap) == 1:
+                                # Extract from a set
+                                (param[k],) = overlap
+
+                        if param[k] == 'True':
+                            if lowered_choices is None:
+                                lowered_choices = lenient_lowercase(choices)
+                            overlap = BOOLEANS_TRUE.intersection(choices)
+                            if len(overlap) == 1:
+                                (param[k],) = overlap
+
+                        if param[k] not in choices:
+                            choices_str = ", ".join([to_native(c) for c in choices])
+                            msg = "value of %s must be one of: %s, got: %s" % (k, choices_str, param[k])
+                            if self._options_context:
+                                msg += " found in %s" % " -> ".join(self._options_context)
+                            self.fail_json(msg=msg)
+            else:
+                msg = "internal error: choices for argument %s are not iterable: %s" % (k, choices)
+                if self._options_context:
+                    msg += " found in %s" % " -> ".join(self._options_context)
+                self.fail_json(msg=msg)
+
+    def safe_eval(self, value, locals=None, include_exceptions=False):
+        return safe_eval(value, locals, include_exceptions)
+
+    def _check_type_str(self, value, param=None, prefix=''):
+        opts = {
+            'error': False,
+            'warn': False,
+            'ignore': True
+        }
+
+        # Ignore, warn, or error when converting to a string.
+        allow_conversion = opts.get(self._string_conversion_action, True)
+        try:
+            return check_type_str(value, allow_conversion)
+        except TypeError:
+            common_msg = 'quote the entire value to ensure it does not change.'
+            from_msg = '{0!r}'.format(value)
+            to_msg = '{0!r}'.format(to_text(value))
+
+            if param is not None:
+                if prefix:
+                    param = '{0}{1}'.format(prefix, param)
+
+                from_msg = '{0}: {1!r}'.format(param, value)
+                to_msg = '{0}: {1!r}'.format(param, to_text(value))
+
+            if self._string_conversion_action == 'error':
+                msg = common_msg.capitalize()
+                raise TypeError(to_native(msg))
+            elif self._string_conversion_action == 'warn':
+                msg = ('The value "{0}" (type {1.__class__.__name__}) was converted to "{2}" (type string). '
+                       'If this does not look like what you expect, {3}').format(from_msg, value, to_msg, common_msg)
+                self.warn(to_native(msg))
+                return to_native(value, errors='surrogate_or_strict')
+
+    def _handle_options(self, argument_spec=None, params=None, prefix=''):
+        ''' deal with options to create sub spec '''
+        if argument_spec is None:
+            argument_spec = self.argument_spec
+        if params is None:
+            params = self.params
+
+        for (k, v) in argument_spec.items():
+            wanted = v.get('type', None)
+            if wanted == 'dict' or (wanted == 'list' and v.get('elements', '') == 'dict'):
+                spec = v.get('options', None)
+                if v.get('apply_defaults', False):
+                    if spec is not None:
+                        if params.get(k) is None:
+                            params[k] = {}
+                    else:
+                        continue
+                elif spec is None or k not in params or params[k] is None:
+                    continue
+
+                self._options_context.append(k)
+
+                if isinstance(params[k], dict):
+                    elements = [params[k]]
+                else:
+                    elements = params[k]
+
+                for idx, param in enumerate(elements):
+                    if not isinstance(param, dict):
+                        self.fail_json(msg="value of %s must be of type dict or list of dict" % k)
+
+                    new_prefix = prefix + k
+                    if wanted == 'list':
+                        new_prefix += '[%d]' % idx
+                    new_prefix += '.'
+
+                    self._set_fallbacks(spec, param)
+                    options_aliases = self._handle_aliases(spec, param, option_prefix=new_prefix)
+
+                    options_legal_inputs = list(spec.keys()) + list(options_aliases.keys())
+
+                    self._check_arguments(spec, param, options_legal_inputs)
+
+                    # check exclusive early
+                    if not self.bypass_checks:
+                        self._check_mutually_exclusive(v.get('mutually_exclusive', None), param)
+
+                    self._set_defaults(pre=True, spec=spec, param=param)
+
+                    if not self.bypass_checks:
+                        self._check_required_arguments(spec, param)
+                        self._check_argument_types(spec, param, new_prefix)
+                        self._check_argument_values(spec, param)
+
+                        self._check_required_together(v.get('required_together', None), param)
+                        self._check_required_one_of(v.get('required_one_of', None), param)
+                        self._check_required_if(v.get('required_if', None), param)
+                        self._check_required_by(v.get('required_by', None), param)
+
+                    self._set_defaults(pre=False, spec=spec, param=param)
+
+                    # handle multi level options (sub argspec)
+                    self._handle_options(spec, param, new_prefix)
+                self._options_context.pop()
+
+    def _get_wanted_type(self, wanted, k):
+        if not callable(wanted):
+            if wanted is None:
+                # Mostly we want to default to str.
+                # For values set to None explicitly, return None instead as
+                # that allows a user to unset a parameter
+                wanted = 'str'
+            try:
+                type_checker = self._CHECK_ARGUMENT_TYPES_DISPATCHER[wanted]
+            except KeyError:
+                self.fail_json(msg="implementation error: unknown type %s requested for %s" % (wanted, k))
+        else:
+            # set the type_checker to the callable, and reset wanted to the callable's name (or type if it doesn't have one, ala MagicMock)
+            type_checker = wanted
+            wanted = getattr(wanted, '__name__', to_native(type(wanted)))
+
+        return type_checker, wanted
+
+    def _handle_elements(self, wanted, param, values):
+        type_checker, wanted_name = self._get_wanted_type(wanted, param)
+        validated_params = []
+        # Get param name for strings so we can later display this value in a useful error message if needed
+        # Only pass 'kwargs' to our checkers and ignore custom callable checkers
+        kwargs = {}
+        if wanted_name == 'str' and isinstance(wanted, string_types):
+            if isinstance(param, string_types):
+                kwargs['param'] = param
+            elif isinstance(param, dict):
+                kwargs['param'] = list(param.keys())[0]
+        for value in values:
+            try:
+                validated_params.append(type_checker(value, **kwargs))
+            except (TypeError, ValueError) as e:
+                msg = "Elements value for option %s" % param
+                if self._options_context:
+                    msg += " found in '%s'" % " -> ".join(self._options_context)
+                msg += " is of type %s and we were unable to convert to %s: %s" % (type(value), wanted_name, to_native(e))
+                self.fail_json(msg=msg)
+        return validated_params
+
+    def _check_argument_types(self, spec=None, param=None, prefix=''):
+        ''' ensure all arguments have the requested type '''
+
+        if spec is None:
+            spec = self.argument_spec
+        if param is None:
+            param = self.params
+
+        for (k, v) in spec.items():
+            wanted = v.get('type', None)
+            if k not in param:
+                continue
+
+            value = param[k]
+            if value is None:
+                continue
+
+            type_checker, wanted_name = self._get_wanted_type(wanted, k)
+            # Get param name for strings so we can later display this value in a useful error message if needed
+            # Only pass 'kwargs' to our checkers and ignore custom callable checkers
+            kwargs = {}
+            if wanted_name == 'str' and isinstance(type_checker, string_types):
+                kwargs['param'] = list(param.keys())[0]
+
+                # Get the name of the parent key if this is a nested option
+                if prefix:
+                    kwargs['prefix'] = prefix
+
+            try:
+                param[k] = type_checker(value, **kwargs)
+                wanted_elements = v.get('elements', None)
+                if wanted_elements:
+                    if wanted != 'list' or not isinstance(param[k], list):
+                        msg = "Invalid type %s for option '%s'" % (wanted_name, param)
+                        if self._options_context:
+                            msg += " found in '%s'." % " -> ".join(self._options_context)
+                        msg += ", elements value check is supported only with 'list' type"
+                        self.fail_json(msg=msg)
+                    param[k] = self._handle_elements(wanted_elements, k, param[k])
+
+            except (TypeError, ValueError) as e:
+                msg = "argument %s is of type %s" % (k, type(value))
+                if self._options_context:
+                    msg += " found in '%s'." % " -> ".join(self._options_context)
+                msg += " and we were unable to convert to %s: %s" % (wanted_name, to_native(e))
+                self.fail_json(msg=msg)
+
+    def _set_defaults(self, pre=True, spec=None, param=None):
+        if spec is None:
+            spec = self.argument_spec
+        if param is None:
+            param = self.params
+        for (k, v) in spec.items():
+            default = v.get('default', None)
+            if pre is True:
+                # this prevents setting defaults on required items
+                if default is not None and k not in param:
+                    param[k] = default
+            else:
+                # make sure things without a default still get set None
+                if k not in param:
+                    param[k] = default
+
+    def _set_fallbacks(self, spec=None, param=None):
+        if spec is None:
+            spec = self.argument_spec
+        if param is None:
+            param = self.params
+
+        for (k, v) in spec.items():
+            fallback = v.get('fallback', (None,))
+            fallback_strategy = fallback[0]
+            fallback_args = []
+            fallback_kwargs = {}
+            if k not in param and fallback_strategy is not None:
+                for item in fallback[1:]:
+                    if isinstance(item, dict):
+                        fallback_kwargs = item
+                    else:
+                        fallback_args = item
+                try:
+                    param[k] = fallback_strategy(*fallback_args, **fallback_kwargs)
+                except AnsibleFallbackNotFound:
+                    continue
+
+    def warn(self, warning):
+        # Copied from ansible.module_utils.common.warnings:
+        if isinstance(warning, string_types):
+            self.__warnings.append(warning)
+        else:
+            raise TypeError("warn requires a string not a %s" % type(warning))
+
+    def deprecate(self, msg, version=None, date=None, collection_name=None):
+        if version is not None and date is not None:
+            raise AssertionError("implementation error -- version and date must not both be set")
+
+        # Copied from ansible.module_utils.common.warnings:
+        if isinstance(msg, string_types):
+            # For compatibility, we accept that neither version nor date is set,
+            # and treat that the same as if version would haven been set
+            if date is not None:
+                self.__deprecations.append({'msg': msg, 'date': date, 'collection_name': collection_name})
+            else:
+                self.__deprecations.append({'msg': msg, 'version': version, 'collection_name': collection_name})
+        else:
+            raise TypeError("deprecate requires a string not a %s" % type(msg))
+
+    def _return_formatted(self, kwargs):
+        if 'invocation' not in kwargs:
+            kwargs['invocation'] = {'module_args': self.params}
+
+        if 'warnings' in kwargs:
+            if isinstance(kwargs['warnings'], list):
+                for w in kwargs['warnings']:
+                    self.warn(w)
+            else:
+                self.warn(kwargs['warnings'])
+
+        if self.__warnings:
+            kwargs['warnings'] = self.__warnings
+
+        if 'deprecations' in kwargs:
+            if isinstance(kwargs['deprecations'], list):
+                for d in kwargs['deprecations']:
+                    if isinstance(d, SEQUENCETYPE) and len(d) == 2:
+                        self.deprecate(d[0], version=d[1])
+                    elif isinstance(d, Mapping):
+                        self.deprecate(d['msg'], version=d.get('version'), date=d.get('date'),
+                                       collection_name=d.get('collection_name'))
+                    else:
+                        self.deprecate(d)  # pylint: disable=ansible-deprecated-no-version
+            else:
+                self.deprecate(kwargs['deprecations'])  # pylint: disable=ansible-deprecated-no-version
+
+        if self.__deprecations:
+            kwargs['deprecations'] = self.__deprecations
+
+        kwargs = remove_values(kwargs, self.no_log_values)
+        raise _ModuleExitException(kwargs)
+
+    def exit_json(self, **kwargs):
+        result = dict(kwargs)
+        if 'failed' not in result:
+            result['failed'] = False
+        self._return_formatted(result)
+
+    def fail_json(self, msg, **kwargs):
+        result = dict(kwargs)
+        result['failed'] = True
+        result['msg'] = msg
+        self._return_formatted(result)
+
+
+@six.add_metaclass(abc.ABCMeta)
+class ActionModuleBase(ActionBase):
+    @abc.abstractmethod
+    def setup_module(self):
+        """Return pair (ArgumentSpec, kwargs)."""
+        pass
+
+    @abc.abstractmethod
+    def run_module(self, module):
+        """Run module code"""
+        module.fail_json(msg='Not implemented.')
+
+    def run(self, tmp=None, task_vars=None):
+        if task_vars is None:
+            task_vars = dict()
+
+        result = super(ActionModuleBase, self).run(tmp, task_vars)
+        del tmp  # tmp no longer has any effect
+
+        try:
+            argument_spec, kwargs = self.setup_module()
+            module = argument_spec.create_ansible_module_helper(AnsibleActionModule, (self, ), **kwargs)
+            self.run_module(module)
+            raise AnsibleError('Internal error: action module did not call module.exit_json()')
+        except _ModuleExitException as mee:
+            result.update(mee.result)
+            return result
+        except Exception as dummy:
+            result['failed'] = True
+            result['msg'] = 'MODULE FAILURE'
+            result['exception'] = traceback.format_exc()
+            return result

shippable.yml

@@ -1,78 +0,0 @@
-language: python
-
-env:
-  matrix:
-    - T=none
-
-matrix:
-  exclude:
-    - env: T=none
-  include:
-    - env: T=devel/sanity/1
-    - env: T=devel/sanity/extra
-
-    - env: T=devel/units/2.6/1
-    - env: T=devel/units/2.7/1
-    - env: T=devel/units/3.5/1
-    - env: T=devel/units/3.6/1
-    - env: T=devel/units/3.7/1
-    - env: T=devel/units/3.8/1
-    - env: T=devel/units/3.9/1
-
-    - env: T=devel/osx/10.11/1
-    - env: T=devel/rhel/7.8/1
-    - env: T=devel/rhel/8.2/1
-    - env: T=devel/freebsd/11.1/1
-    - env: T=devel/freebsd/12.1/1
-    - env: T=devel/linux/centos6/1
-    - env: T=devel/linux/centos7/1
-    - env: T=devel/linux/centos8/1
-    - env: T=devel/linux/fedora30/1
-    - env: T=devel/linux/fedora31/1
-    - env: T=devel/linux/fedora32/1
-    - env: T=devel/linux/opensuse15py2/1
-    - env: T=devel/linux/opensuse15/1
-    - env: T=devel/linux/ubuntu1604/1
-    - env: T=devel/linux/ubuntu1804/1
-
-    - env: T=devel/cloud/2.6/1
-    - env: T=devel/cloud/2.7/1
-    - env: T=devel/cloud/3.5/1
-    - env: T=devel/cloud/3.6/1
-    - env: T=devel/cloud/3.7/1
-    - env: T=devel/cloud/3.8/1
-    - env: T=devel/cloud/3.9/1
-
-    # For Ansible 2.10, use a combination of different targets
-    - env: T=2.10/sanity/1
-    - env: T=2.10/units/2.7/1
-    - env: T=2.10/units/3.8/1
-    - env: T=2.10/rhel/7.8/1
-    - env: T=2.10/linux/ubuntu1804/1
-    - env: T=2.10/cloud/3.6/1
-
-    # For Ansible 2.9, use a combination of different targets
-    - env: T=2.9/sanity/1
-    - env: T=2.9/units/2.7/1
-    - env: T=2.9/units/3.8/1
-    - env: T=2.9/rhel/7.8/1
-    - env: T=2.9/linux/ubuntu1804/1
-    - env: T=2.9/cloud/3.5/1
-
-branches:
-  except:
-    - "*-patch-*"
-    - "revert-*-*"
-
-build:
-  ci:
-    - tests/utils/shippable/timing.sh tests/utils/shippable/shippable.sh $T
-
-integrations:
-  notifications:
-    - integrationName: email
-      type: email
-      on_success: never
-      on_failure: never
-      on_start: never
-      on_pull_request: never

tests/integration/targets/acme_account/tasks/impl.yml

@@ -1,20 +1,29 @@
-- name: Generate account keys
-  command: openssl ecparam -name prime256v1 -genkey -out {{ output_dir }}/{{ item }}.pem
-  loop:
-    - accountkey
-    - accountkey2
-    - accountkey3
-    - accountkey4
-    - accountkey5
+- block:
+  - name: Generate account keys
+    openssl_privatekey:
+      path: "{{ output_dir }}/{{ item.name }}.pem"
+      passphrase: "{{ item.pass | default(omit, true) }}"
+      cipher: "{{ 'auto' if item.pass | default() else omit }}"
+      type: ECC
+      curve: secp256r1
+      force: true
+    loop: "{{ account_keys }}"
 
-- name: Parse account keys (to ease debugging some test failures)
-  command: openssl ec -in {{ output_dir }}/{{ item }}.pem -noout -text
-  loop:
-    - accountkey
-    - accountkey2
-    - accountkey3
-    - accountkey4
-    - accountkey5
+  - name: Parse account keys (to ease debugging some test failures)
+    openssl_privatekey_info:
+      path: "{{ output_dir }}/{{ item.name }}.pem"
+      passphrase: "{{ item.pass | default(omit, true) }}"
+      return_private_key_data: true
+    loop: "{{ account_keys }}"
+
+  vars:
+    account_keys:
+      - name: accountkey
+      - name: accountkey2
+        pass: "{{ 'hunter2' if select_crypto_backend != 'openssl' else '' }}"
+      - name: accountkey3
+      - name: accountkey4
+      - name: accountkey5
 
 - name: Do not try to create account
   acme_account:
@@ -173,6 +182,7 @@
     acme_directory: https://{{ acme_host }}:14000/dir
     validate_certs: no
     new_account_key_src: "{{ output_dir }}/accountkey2.pem"
+    new_account_key_passphrase: "{{ 'hunter2' if select_crypto_backend != 'openssl' else omit }}"
     state: changed_key
     contact:
     - mailto:example@example.com
@@ -188,6 +198,7 @@
     acme_directory: https://{{ acme_host }}:14000/dir
     validate_certs: no
     new_account_key_src: "{{ output_dir }}/accountkey2.pem"
+    new_account_key_passphrase: "{{ 'hunter2' if select_crypto_backend != 'openssl' else omit }}"
     state: changed_key
     contact:
     - mailto:example@example.com
@@ -197,6 +208,7 @@
   acme_account:
     select_crypto_backend: "{{ select_crypto_backend }}"
     account_key_src: "{{ output_dir }}/accountkey2.pem"
+    account_key_passphrase: "{{ 'hunter2' if select_crypto_backend != 'openssl' else omit }}"
     acme_version: 2
     acme_directory: https://{{ acme_host }}:14000/dir
     validate_certs: no
@@ -209,6 +221,7 @@
   acme_account:
     select_crypto_backend: "{{ select_crypto_backend }}"
     account_key_src: "{{ output_dir }}/accountkey2.pem"
+    account_key_passphrase: "{{ 'hunter2' if select_crypto_backend != 'openssl' else omit }}"
     acme_version: 2
     acme_directory: https://{{ acme_host }}:14000/dir
     validate_certs: no
@@ -219,6 +232,7 @@
   acme_account:
     select_crypto_backend: "{{ select_crypto_backend }}"
     account_key_src: "{{ output_dir }}/accountkey2.pem"
+    account_key_passphrase: "{{ 'hunter2' if select_crypto_backend != 'openssl' else omit }}"
     acme_version: 2
     acme_directory: https://{{ acme_host }}:14000/dir
     validate_certs: no
@@ -229,6 +243,7 @@
   acme_account:
     select_crypto_backend: "{{ select_crypto_backend }}"
     account_key_src: "{{ output_dir }}/accountkey2.pem"
+    account_key_passphrase: "{{ 'hunter2' if select_crypto_backend != 'openssl' else omit }}"
     acme_version: 2
     acme_directory: https://{{ acme_host }}:14000/dir
     validate_certs: no

tests/integration/targets/acme_account/tasks/main.yml

@@ -1,4 +1,9 @@
 ---
+####################################################################
+# WARNING: These are designed specifically for Ansible tests       #
+# and should not be used as examples of how to write Ansible roles #
+####################################################################
+
 - block:
   - name: Running tests with OpenSSL backend
     include_tasks: impl.yml

tests/integration/targets/acme_account_info/tasks/impl.yml

@@ -1,12 +1,23 @@
 ---
-- name: Generate account key
-  command: openssl ecparam -name prime256v1 -genkey -out {{ output_dir }}/accountkey.pem
+- block:
+  - name: Generate account keys
+    openssl_privatekey:
+      path: "{{ output_dir }}/{{ item }}.pem"
+      type: ECC
+      curve: secp256r1
+      force: true
+    loop: "{{ account_keys }}"
 
-- name: Generate second account key
-  command: openssl ecparam -name prime256v1 -genkey -out {{ output_dir }}/accountkey2.pem
+  - name: Parse account keys (to ease debugging some test failures)
+    openssl_privatekey_info:
+      path: "{{ output_dir }}/{{ item }}.pem"
+      return_private_key_data: true
+    loop: "{{ account_keys }}"
 
-- name: Parse account key (to ease debugging some test failures)
-  command: openssl ec -in {{ output_dir }}/accountkey.pem -noout -text
+  vars:
+    account_keys:
+      - accountkey
+      - accountkey2
 
 - name: Check that account does not exist
   acme_account_info:

tests/integration/targets/acme_account_info/tasks/main.yml

@@ -1,4 +1,9 @@
 ---
+####################################################################
+# WARNING: These are designed specifically for Ansible tests       #
+# and should not be used as examples of how to write Ansible roles #
+####################################################################
+
 - block:
   - name: Running tests with OpenSSL backend
     include_tasks: impl.yml

tests/integration/targets/acme_certificate/tasks/impl.yml

@@ -1,11 +1,26 @@
 ---
 ## SET UP ACCOUNT KEYS ########################################################################
-- name: Create ECC256 account key
-  command: openssl ecparam -name prime256v1 -genkey -out {{ output_dir }}/account-ec256.pem
-- name: Create ECC384 account key
-  command: openssl ecparam -name secp384r1 -genkey -out {{ output_dir }}/account-ec384.pem
-- name: Create RSA-2048 account key
-  command: openssl genrsa -out {{ output_dir }}/account-rsa2048.pem 2048
+- block:
+  - name: Generate account keys
+    openssl_privatekey:
+      path: "{{ output_dir }}/{{ item.name }}.pem"
+      type: "{{ item.type }}"
+      size: "{{ item.size | default(omit) }}"
+      curve: "{{ item.curve | default(omit) }}"
+      force: true
+    loop: "{{ account_keys }}"
+
+  vars:
+    account_keys:
+      - name: account-ec256
+        type: ECC
+        curve: secp256r1
+      - name: account-ec384
+        type: ECC
+        curve: secp384r1
+      - name: account-rsa
+        type: RSA
+        size: "{{ default_rsa_key_size }}"
 ## SET UP ACCOUNTS ############################################################################
 - name: Make sure ECC256 account hasn't been created yet
   acme_account:
@@ -28,13 +43,13 @@
     contact:
     - mailto:example@example.org
     - mailto:example@example.com
-- name: Create RSA-2048 account
+- name: Create RSA account
   acme_account:
     select_crypto_backend: "{{ select_crypto_backend }}"
     acme_version: 2
     acme_directory: https://{{ acme_host }}:14000/dir
     validate_certs: no
-    account_key_src: "{{ output_dir }}/account-rsa2048.pem"
+    account_key_src: "{{ output_dir }}/account-rsa.pem"
     state: present
     allow_creation: yes
     terms_agreed: yes
@@ -46,7 +61,7 @@
     certgen_title: Certificate 1
     certificate_name: cert-1
     key_type: rsa
-    rsa_bits: 2048
+    rsa_bits: "{{ default_rsa_key_size }}"
     subject_alt_name: "DNS:example.com"
     subject_alt_name_critical: no
     account_key: account-ec256
@@ -62,6 +77,7 @@
     select_chain:
       - test_certificates: last
         issuer: "{{ acme_roots[1].subject }}"
+    use_csr_content: true
 - name: Store obtain results for cert 1
   set_fact:
     cert_1_obtain_results: "{{ certificate_obtain_result }}"
@@ -71,6 +87,7 @@
   vars:
     certgen_title: Certificate 2
     certificate_name: cert-2
+    certificate_passphrase: "{{ 'hunter2' if select_crypto_backend != 'openssl' else '' }}"
     key_type: ec256
     subject_alt_name: "DNS:*.example.com,DNS:example.com"
     subject_alt_name_critical: yes
@@ -93,6 +110,7 @@
         subject: "{{ acme_intermediates[0].subject }}"
       - test_certificates: all
         issuer: "{{ acme_roots[2].subject }}"
+    use_csr_content: false
 - name: Store obtain results for cert 2
   set_fact:
     cert_2_obtain_results: "{{ certificate_obtain_result }}"
@@ -105,7 +123,7 @@
     key_type: ec384
     subject_alt_name: "DNS:*.example.com,DNS:example.org,DNS:t1.example.com"
     subject_alt_name_critical: no
-    account_key_content: "{{ lookup('file', output_dir ~ '/account-rsa2048.pem') }}"
+    account_key_content: "{{ lookup('file', output_dir ~ '/account-rsa.pem') }}"
     challenge: dns-01
     modify_account: no
     deactivate_authzs: no
@@ -118,6 +136,7 @@
     select_chain:
       - test_certificates: last
         subject: "{{ acme_roots[1].subject }}"
+    use_csr_content: true
 - name: Store obtain results for cert 3
   set_fact:
     cert_3_obtain_results: "{{ certificate_obtain_result }}"
@@ -128,10 +147,10 @@
     certgen_title: Certificate 4
     certificate_name: cert-4
     key_type: rsa
-    rsa_bits: 2048
+    rsa_bits: "{{ default_rsa_key_size }}"
     subject_alt_name: "DNS:example.com,DNS:t1.example.com,DNS:test.t2.example.com,DNS:example.org,DNS:test.example.org"
     subject_alt_name_critical: no
-    account_key: account-rsa2048
+    account_key: account-rsa
     challenge: http-01
     modify_account: no
     deactivate_authzs: yes
@@ -145,6 +164,7 @@
         issuer: "{{ acme_roots[2].subject }}"
       - test_certificates: last
         issuer: "{{ acme_roots[1].subject }}"
+    use_csr_content: false
 - name: Store obtain results for cert 4
   set_fact:
     cert_4_obtain_results: "{{ certificate_obtain_result }}"
@@ -165,6 +185,7 @@
     remaining_days: 10
     terms_agreed: no
     account_email: ""
+    use_csr_content: true
 - name: Store obtain results for cert 5a
   set_fact:
     cert_5a_obtain_results: "{{ certificate_obtain_result }}"
@@ -185,6 +206,7 @@
     remaining_days: 10
     terms_agreed: no
     account_email: ""
+    use_csr_content: false
 - name: Store obtain results for cert 5b
   set_fact:
     cert_5_recreate_1: "{{ challenge_data is changed }}"
@@ -204,6 +226,7 @@
     remaining_days: 1000
     terms_agreed: no
     account_email: ""
+    use_csr_content: true
 - name: Store obtain results for cert 5c
   set_fact:
     cert_5_recreate_2: "{{ challenge_data is changed }}"
@@ -224,6 +247,7 @@
     remaining_days: 10
     terms_agreed: no
     account_email: ""
+    use_csr_content: false
 - name: Store obtain results for cert 5d
   set_fact:
     cert_5_recreate_3: "{{ challenge_data is changed }}"
@@ -234,7 +258,7 @@
     certgen_title: Certificate 6
     certificate_name: cert-6
     key_type: rsa
-    rsa_bits: 2048
+    rsa_bits: "{{ default_rsa_key_size }}"
     subject_alt_name: "DNS:example.org"
     subject_alt_name_critical: no
     account_key: account-ec256
@@ -255,6 +279,7 @@
         subject_key_identifier: "{{ acme_intermediates[0].subject_key_identifier }}"
       - test_certificates: last
         issuer: "{{ acme_roots[1].subject }}"
+    use_csr_content: true
 - name: Store obtain results for cert 6
   set_fact:
     cert_6_obtain_results: "{{ certificate_obtain_result }}"
@@ -265,7 +290,7 @@
     certgen_title: Certificate 7
     certificate_name: cert-7
     key_type: rsa
-    rsa_bits: 2048
+    rsa_bits: "{{ default_rsa_key_size }}"
     subject_alt_name:
     - "IP:127.0.0.1"
     # - "IP:::1"
@@ -282,6 +307,7 @@
     select_chain:
       - test_certificates: last
         authority_key_identifier: "{{ acme_roots[2].subject_key_identifier }}"
+    use_csr_content: false
 - name: Store obtain results for cert 7
   set_fact:
     cert_7_obtain_results: "{{ certificate_obtain_result }}"
@@ -292,7 +318,7 @@
     certgen_title: Certificate 8
     certificate_name: cert-8
     key_type: rsa
-    rsa_bits: 2048
+    rsa_bits: "{{ default_rsa_key_size }}"
     subject_alt_name:
     - "IP:127.0.0.1"
     # IPv4 only since our test validation server doesn't work
@@ -307,6 +333,7 @@
     remaining_days: 10
     terms_agreed: yes
     account_email: "example@example.org"
+    use_csr_content: true
 - name: Store obtain results for cert 8
   set_fact:
     cert_8_obtain_results: "{{ certificate_obtain_result }}"
@@ -314,61 +341,61 @@
 ## DISSECT CERTIFICATES #######################################################################
 # Make sure certificates are valid. Root certificate for Pebble equals the chain certificate.
 - name: Verifying cert 1
-  command: openssl verify -CAfile "{{ output_dir }}/cert-1-root.pem" -untrusted "{{ output_dir }}/cert-1-chain.pem" "{{ output_dir }}/cert-1.pem"
+  command: '{{ openssl_binary }} verify -CAfile "{{ output_dir }}/cert-1-root.pem" -untrusted "{{ output_dir }}/cert-1-chain.pem" "{{ output_dir }}/cert-1.pem"'
   ignore_errors: yes
   register: cert_1_valid
 - name: Verifying cert 2
-  command: openssl verify -CAfile "{{ output_dir }}/cert-2-root.pem" -untrusted "{{ output_dir }}/cert-2-chain.pem" "{{ output_dir }}/cert-2.pem"
+  command: '{{ openssl_binary }} verify -CAfile "{{ output_dir }}/cert-2-root.pem" -untrusted "{{ output_dir }}/cert-2-chain.pem" "{{ output_dir }}/cert-2.pem"'
   ignore_errors: yes
   register: cert_2_valid
 - name: Verifying cert 3
-  command: openssl verify -CAfile "{{ output_dir }}/cert-3-root.pem" -untrusted "{{ output_dir }}/cert-3-chain.pem" "{{ output_dir }}/cert-3.pem"
+  command: '{{ openssl_binary }} verify -CAfile "{{ output_dir }}/cert-3-root.pem" -untrusted "{{ output_dir }}/cert-3-chain.pem" "{{ output_dir }}/cert-3.pem"'
   ignore_errors: yes
   register: cert_3_valid
 - name: Verifying cert 4
-  command: openssl verify -CAfile "{{ output_dir }}/cert-4-root.pem" -untrusted "{{ output_dir }}/cert-4-chain.pem" "{{ output_dir }}/cert-4.pem"
+  command: '{{ openssl_binary }} verify -CAfile "{{ output_dir }}/cert-4-root.pem" -untrusted "{{ output_dir }}/cert-4-chain.pem" "{{ output_dir }}/cert-4.pem"'
   ignore_errors: yes
   register: cert_4_valid
 - name: Verifying cert 5
-  command: openssl verify -CAfile "{{ output_dir }}/cert-5-root.pem" -untrusted "{{ output_dir }}/cert-5-chain.pem" "{{ output_dir }}/cert-5.pem"
+  command: '{{ openssl_binary }} verify -CAfile "{{ output_dir }}/cert-5-root.pem" -untrusted "{{ output_dir }}/cert-5-chain.pem" "{{ output_dir }}/cert-5.pem"'
   ignore_errors: yes
   register: cert_5_valid
 - name: Verifying cert 6
-  command: openssl verify -CAfile "{{ output_dir }}/cert-6-root.pem" -untrusted "{{ output_dir }}/cert-6-chain.pem" "{{ output_dir }}/cert-6.pem"
+  command: '{{ openssl_binary }} verify -CAfile "{{ output_dir }}/cert-6-root.pem" -untrusted "{{ output_dir }}/cert-6-chain.pem" "{{ output_dir }}/cert-6.pem"'
   ignore_errors: yes
   register: cert_6_valid
 - name: Verifying cert 7
-  command: openssl verify -CAfile "{{ output_dir }}/cert-7-root.pem" -untrusted "{{ output_dir }}/cert-7-chain.pem" "{{ output_dir }}/cert-7.pem"
+  command: '{{ openssl_binary }} verify -CAfile "{{ output_dir }}/cert-7-root.pem" -untrusted "{{ output_dir }}/cert-7-chain.pem" "{{ output_dir }}/cert-7.pem"'
   ignore_errors: yes
   register: cert_7_valid
 - name: Verifying cert 8
-  command: openssl verify -CAfile "{{ output_dir }}/cert-8-root.pem" -untrusted "{{ output_dir }}/cert-8-chain.pem" "{{ output_dir }}/cert-8.pem"
+  command: '{{ openssl_binary }} verify -CAfile "{{ output_dir }}/cert-8-root.pem" -untrusted "{{ output_dir }}/cert-8-chain.pem" "{{ output_dir }}/cert-8.pem"'
   ignore_errors: yes
   register: cert_8_valid
 # Dump certificate info
 - name: Dumping cert 1
-  command: openssl x509 -in "{{ output_dir }}/cert-1.pem" -noout -text
+  command: '{{ openssl_binary }} x509 -in "{{ output_dir }}/cert-1.pem" -noout -text'
   register: cert_1_text
 - name: Dumping cert 2
-  command: openssl x509 -in "{{ output_dir }}/cert-2.pem" -noout -text
+  command: '{{ openssl_binary }} x509 -in "{{ output_dir }}/cert-2.pem" -noout -text'
   register: cert_2_text
 - name: Dumping cert 3
-  command: openssl x509 -in "{{ output_dir }}/cert-3.pem" -noout -text
+  command: '{{ openssl_binary }} x509 -in "{{ output_dir }}/cert-3.pem" -noout -text'
   register: cert_3_text
 - name: Dumping cert 4
-  command: openssl x509 -in "{{ output_dir }}/cert-4.pem" -noout -text
+  command: '{{ openssl_binary }} x509 -in "{{ output_dir }}/cert-4.pem" -noout -text'
   register: cert_4_text
 - name: Dumping cert 5
-  command: openssl x509 -in "{{ output_dir }}/cert-5.pem" -noout -text
+  command: '{{ openssl_binary }} x509 -in "{{ output_dir }}/cert-5.pem" -noout -text'
   register: cert_5_text
 - name: Dumping cert 6
-  command: openssl x509 -in "{{ output_dir }}/cert-6.pem" -noout -text
+  command: '{{ openssl_binary }} x509 -in "{{ output_dir }}/cert-6.pem" -noout -text'
   register: cert_6_text
 - name: Dumping cert 7
-  command: openssl x509 -in "{{ output_dir }}/cert-7.pem" -noout -text
+  command: '{{ openssl_binary }} x509 -in "{{ output_dir }}/cert-7.pem" -noout -text'
   register: cert_7_text
 - name: Dumping cert 8
-  command: openssl x509 -in "{{ output_dir }}/cert-8.pem" -noout -text
+  command: '{{ openssl_binary }} x509 -in "{{ output_dir }}/cert-8.pem" -noout -text'
   register: cert_8_text
 # Dump certificate info
 - name: Dumping cert 1

tests/integration/targets/acme_certificate/tasks/main.yml

@@ -1,4 +1,9 @@
 ---
+####################################################################
+# WARNING: These are designed specifically for Ansible tests       #
+# and should not be used as examples of how to write Ansible roles #
+####################################################################
+
 - block:
   - name: Obtain root and intermediate certificates
     get_url:

tests/integration/targets/acme_certificate/tests/validate.yml

@@ -121,6 +121,9 @@
       - "'account' in account_orders_urls"
       - "'orders' in account_orders_urls"
       - "account_orders_urls.orders[0] is string"
+      - "'order_uris' in account_orders_urls"
+      - "account_orders_urls.order_uris[0] is string"
+      - "account_orders_urls.order_uris == account_orders_urls.orders"
 
 - name: Validate that orders were retrieved as list of URLs (2/2)
   assert:
@@ -128,6 +131,9 @@
       - "'account' in account_orders_urls2"
       - "'orders' in account_orders_urls2"
       - "account_orders_urls2.orders[0] is string"
+      - "'order_uris' in account_orders_urls2"
+      - "account_orders_urls2.order_uris[0] is string"
+      - "account_orders_urls2.order_uris == account_orders_urls2.orders"
 
 - name: Validate that orders were retrieved as list of objects (1/2)
   assert:
@@ -135,6 +141,8 @@
       - "'account' in account_orders_full"
       - "'orders' in account_orders_full"
       - "account_orders_full.orders[0].status is string"
+      - "'order_uris' in account_orders_full"
+      - "account_orders_full.order_uris[0] is string"
 
 - name: Validate that orders were retrieved as list of objects (2/2)
   assert:
@@ -142,3 +150,5 @@
       - "'account' in account_orders_full2"
       - "'orders' in account_orders_full2"
       - "account_orders_full2.orders[0].status is string"
+      - "'order_uris' in account_orders_full2"
+      - "account_orders_full2.order_uris[0] is string"

tests/integration/targets/acme_certificate_revoke/tasks/impl.yml

@@ -1,11 +1,26 @@
 ---
 ## SET UP ACCOUNT KEYS ########################################################################
-- name: Create ECC256 account key
-  command: openssl ecparam -name prime256v1 -genkey -out {{ output_dir }}/account-ec256.pem
-- name: Create ECC384 account key
-  command: openssl ecparam -name secp384r1 -genkey -out {{ output_dir }}/account-ec384.pem
-- name: Create RSA-2048 account key
-  command: openssl genrsa -out {{ output_dir }}/account-rsa2048.pem 2048
+- block:
+  - name: Generate account keys
+    openssl_privatekey:
+      path: "{{ output_dir }}/{{ item.name }}.pem"
+      type: "{{ item.type }}"
+      size: "{{ item.size | default(omit) }}"
+      curve: "{{ item.curve | default(omit) }}"
+      force: true
+    loop: "{{ account_keys }}"
+
+  vars:
+    account_keys:
+      - name: account-ec256
+        type: ECC
+        curve: secp256r1
+      - name: account-ec384
+        type: ECC
+        curve: secp384r1
+      - name: account-rsa
+        type: RSA
+        size: "{{ default_rsa_key_size }}"
 ## CREATE ACCOUNTS AND OBTAIN CERTIFICATES ####################################################
 - name: Obtain cert 1
   include_tasks: obtain-cert.yml
@@ -13,7 +28,7 @@
     certgen_title: Certificate 1 for revocation
     certificate_name: cert-1
     key_type: rsa
-    rsa_bits: 2048
+    rsa_bits: "{{ default_rsa_key_size }}"
     subject_alt_name: "DNS:example.com"
     subject_alt_name_critical: no
     account_key_content: "{{ lookup('file', output_dir ~ '/account-ec256.pem') }}"
@@ -29,6 +44,7 @@
   vars:
     certgen_title: Certificate 2 for revocation
     certificate_name: cert-2
+    certificate_passphrase: "{{ 'hunter2' if select_crypto_backend != 'openssl' else '' }}"
     key_type: ec256
     subject_alt_name: "DNS:*.example.com"
     subject_alt_name_critical: yes
@@ -48,7 +64,7 @@
     key_type: ec384
     subject_alt_name: "DNS:t1.example.com"
     subject_alt_name_critical: no
-    account_key: account-rsa2048
+    account_key: account-rsa
     challenge: dns-01
     modify_account: yes
     deactivate_authzs: no
@@ -71,6 +87,7 @@
   acme_certificate_revoke:
     select_crypto_backend: "{{ select_crypto_backend }}"
     private_key_src: "{{ output_dir }}/cert-2.key"
+    private_key_passphrase: "{{ 'hunter2' if select_crypto_backend != 'openssl' else omit }}"
     certificate: "{{ output_dir }}/cert-2.pem"
     acme_version: 2
     acme_directory: https://{{ acme_host }}:14000/dir
@@ -80,7 +97,7 @@
 - name: Revoke certificate 3 via account key (fullchain)
   acme_certificate_revoke:
     select_crypto_backend: "{{ select_crypto_backend }}"
-    account_key_content: "{{ lookup('file', output_dir ~ '/account-rsa2048.pem') }}"
+    account_key_content: "{{ lookup('file', output_dir ~ '/account-rsa.pem') }}"
     certificate: "{{ output_dir }}/cert-3-fullchain.pem"
     acme_version: 2
     acme_directory: https://{{ acme_host }}:14000/dir

tests/integration/targets/acme_certificate_revoke/tasks/main.yml

@@ -1,4 +1,9 @@
 ---
+####################################################################
+# WARNING: These are designed specifically for Ansible tests       #
+# and should not be used as examples of how to write Ansible roles #
+####################################################################
+
 - block:
   - name: Running tests with OpenSSL backend
     include_tasks: impl.yml

tests/integration/targets/acme_challenge_cert_helper/tasks/main.yml

@@ -1,7 +1,16 @@
 ---
+####################################################################
+# WARNING: These are designed specifically for Ansible tests       #
+# and should not be used as examples of how to write Ansible roles #
+####################################################################
+
 - block:
-  - name: Create ECC256 account key
-    command: openssl ecparam -name prime256v1 -genkey -out {{ output_dir }}/account-ec256.pem
+  - name: Generate ECC256 accoun keys
+    openssl_privatekey:
+      path: "{{ output_dir }}/account-ec256.pem"
+      type: ECC
+      curve: secp256r1
+      force: true
   - name: Obtain cert 1
     include_tasks: obtain-cert.yml
     vars:
@@ -9,7 +18,7 @@
       certgen_title: Certificate 1
       certificate_name: cert-1
       key_type: rsa
-      rsa_bits: 2048
+      rsa_bits: "{{ default_rsa_key_size }}"
       subject_alt_name: "DNS:example.com"
       subject_alt_name_critical: no
       account_key: account-ec256

tests/integration/targets/acme_inspect/tasks/impl.yml

@@ -1,9 +1,22 @@
 ---
-- name: Generate account key
-  command: openssl ecparam -name prime256v1 -genkey -out {{ output_dir }}/accountkey.pem
+- block:
+  - name: Generate account keys
+    openssl_privatekey:
+      path: "{{ output_dir }}/{{ item }}.pem"
+      type: ECC
+      curve: secp256r1
+      force: true
+    loop: "{{ account_keys }}"
 
-- name: Parse account key (to ease debugging some test failures)
-  command: openssl ec -in {{ output_dir }}/accountkey.pem -noout -text
+  - name: Parse account keys (to ease debugging some test failures)
+    openssl_privatekey_info:
+      path: "{{ output_dir }}/{{ item }}.pem"
+      return_private_key_data: true
+    loop: "{{ account_keys }}"
+
+  vars:
+    account_keys:
+      - accountkey
 
 - name: Get directory
   acme_inspect:

tests/integration/targets/acme_inspect/tasks/main.yml

@@ -1,4 +1,9 @@
 ---
+####################################################################
+# WARNING: These are designed specifically for Ansible tests       #
+# and should not be used as examples of how to write Ansible roles #
+####################################################################
+
 - block:
   - name: Running tests with OpenSSL backend
     include_tasks: impl.yml

tests/integration/targets/certificate_complete_chain/tasks/main.yml

@@ -1,3 +1,8 @@
+####################################################################
+# WARNING: These are designed specifically for Ansible tests       #
+# and should not be used as examples of how to write Ansible roles #
+####################################################################
+
 - name: register cryptography version
   command: '{{ ansible_python.executable }} -c ''import cryptography; print(cryptography.__version__)'''
   register: cryptography_version

tests/integration/targets/ecs_certificate/tasks/main.yml

@@ -1,4 +1,9 @@
 ---
+####################################################################
+# WARNING: These are designed specifically for Ansible tests       #
+# and should not be used as examples of how to write Ansible roles #
+####################################################################
+
 ## Verify that integration_config was specified
 - block:
   - assert:
@@ -201,7 +206,7 @@
 
   # For bug 61738, verify that the full chain is valid
   - name: Verify that the full chain path can be successfully imported
-    command: openssl verify "{{ example4_full_chain_path }}"
+    command: '{{ openssl_binary }} verify "{{ example4_full_chain_path }}"'
     register: openssl_result
 
   - assert:

tests/integration/targets/ecs_domain/tasks/main.yml

@@ -1,4 +1,9 @@
 ---
+####################################################################
+# WARNING: These are designed specifically for Ansible tests       #
+# and should not be used as examples of how to write Ansible roles #
+####################################################################
+
 ## Verify that integration_config was specified
 - block:
   - assert:

tests/integration/targets/get_certificate/meta/main.yml

@@ -1,3 +1,4 @@
 dependencies:
   - setup_openssl
+  - setup_pyopenssl
   - prepare_http_tests

tests/integration/targets/get_certificate/tasks/main.yml

@@ -1,4 +1,9 @@
 ---
+####################################################################
+# WARNING: These are designed specifically for Ansible tests       #
+# and should not be used as examples of how to write Ansible roles #
+####################################################################
+
 - block:
 
   - name: Get servers certificate with backend auto-detection

tests/integration/targets/get_certificate/tests/validate.yml

@@ -1,4 +1,38 @@
 ---
+- name: Get servers certificate for SNI test part 1
+  get_certificate:
+    host: "{{ httpbin_host }}"
+    port: 443
+    server_name: "{{ sni_host }}"
+  register: result
+
+- debug: var=result
+
+- assert:
+    that:
+      # This module should never change anything
+      - result is not changed
+      - result is not failed
+      # We got the correct ST from the cert
+      - "'{{ sni_host }}' == result.subject.CN"
+
+- name: Get servers certificate for SNI test part 2
+  get_certificate:
+    host: "{{ sni_host }}"
+    port: 443
+    server_name: "{{ httpbin_host }}"
+  register: result
+
+- debug: var=result
+
+- assert:
+    that:
+      # This module should never change anything
+      - result is not changed
+      - result is not failed
+      # We got the correct ST from the cert
+      - "'{{ httpbin_host }}' == result.subject.CN"
+
 - name: Get servers certificate
   get_certificate:
     host: "{{ httpbin_host }}"

tests/integration/targets/luks_device/aliases

@@ -1,5 +1,6 @@
 shippable/posix/group1
 skip/osx
+skip/macos
 skip/freebsd
 skip/docker
 needs/root

tests/integration/targets/luks_device/tasks/main.yml

@@ -1,4 +1,9 @@
 ---
+####################################################################
+# WARNING: These are designed specifically for Ansible tests       #
+# and should not be used as examples of how to write Ansible roles #
+####################################################################
+
 - name: Make sure cryptsetup is installed
   package:
     name: cryptsetup

tests/integration/targets/luks_device/tasks/tests/create-destroy.yml

@@ -4,6 +4,8 @@
     device: "{{ cryptfile_device }}"
     state: present
     keyfile: "{{ role_path }}/files/keyfile1"
+    pbkdf:
+      iteration_time: 0.1
   check_mode: yes
   become: yes
   register: create_check
@@ -12,6 +14,8 @@
     device: "{{ cryptfile_device }}"
     state: present
     keyfile: "{{ role_path }}/files/keyfile1"
+    pbkdf:
+      iteration_time: 0.1
   become: yes
   register: create
 - name: Create (idempotent)
@@ -19,6 +23,8 @@
     device: "{{ cryptfile_device }}"
     state: present
     keyfile: "{{ role_path }}/files/keyfile1"
+    pbkdf:
+      iteration_time: 0.1
   become: yes
   register: create_idem
 - name: Create (idempotent, check)
@@ -26,6 +32,8 @@
     device: "{{ cryptfile_device }}"
     state: present
     keyfile: "{{ role_path }}/files/keyfile1"
+    pbkdf:
+      iteration_time: 0.1
   check_mode: yes
   become: yes
   register: create_idem_check