internet/community.crypto
3
0
Fork 0
mirror of https://github.com/ansible-collections/community.crypto.git synced 2026-05-08 06:13:03 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
main
community.crypto/tests/integration/targets/x509_certificate/tasks/ownca.yml
Felix Fontein 8792635bef Fix some ansible-lint issues (#907) 
* Fix fqcn[action-core].

* Fix fqcn[action].

* Fix jinja[spacing].
2025-05-30 22:03:16 +02:00

664 lines
28 KiB
YAML
Raw Permalink Blame History

---
# Copyright (c) Ansible Project
# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
# SPDX-License-Identifier: GPL-3.0-or-later
- name: (OwnCA, {{ select_crypto_backend }}) Generate CA privatekey
community.crypto.openssl_privatekey:
path: '{{ remote_tmp_dir }}/ca_privatekey.pem'
size: '{{ default_rsa_key_size_certificates }}'
- name: (OwnCA, {{ select_crypto_backend }}) Generate CA privatekey with passphrase
community.crypto.openssl_privatekey:
path: '{{ remote_tmp_dir }}/ca_privatekey_pw.pem'
passphrase: hunter2
select_crypto_backend: cryptography
size: '{{ default_rsa_key_size_certificates }}'
- name: (OwnCA, {{ select_crypto_backend }}) Generate CA CSR
community.crypto.openssl_csr:
path: '{{ item.path }}'
privatekey_path: '{{ remote_tmp_dir }}/ca_privatekey.pem'
subject: '{{ item.subject }}'
useCommonNameForSAN: false
basic_constraints:
- 'CA:TRUE'
basic_constraints_critical: true
loop:
- path: '{{ remote_tmp_dir }}/ca_csr.csr'
subject:
commonName: Example CA
- path: '{{ remote_tmp_dir }}/ca_csr2.csr'
subject:
commonName: Example CA 2
- name: (OwnCA, {{ select_crypto_backend }}) Generate CA CSR (privatekey passphrase)
community.crypto.openssl_csr:
path: '{{ remote_tmp_dir }}/ca_csr_pw.csr'
privatekey_path: '{{ remote_tmp_dir }}/ca_privatekey_pw.pem'
privatekey_passphrase: hunter2
subject:
commonName: Example CA
useCommonNameForSAN: false
basic_constraints:
- 'CA:TRUE'
basic_constraints_critical: true
- name: (OwnCA, {{ select_crypto_backend }}) Generate selfsigned CA certificate (check mode)
community.crypto.x509_certificate:
path: '{{ remote_tmp_dir }}/ca_cert.pem'
csr_path: '{{ remote_tmp_dir }}/ca_csr.csr'
privatekey_path: '{{ remote_tmp_dir }}/ca_privatekey.pem'
provider: selfsigned
selfsigned_digest: sha256
select_crypto_backend: '{{ select_crypto_backend }}'
check_mode: true
register: result_check_mode
- name: (OwnCA, {{ select_crypto_backend }}) Generate selfsigned CA certificate
community.crypto.x509_certificate:
path: '{{ remote_tmp_dir }}/ca_cert.pem'
csr_path: '{{ remote_tmp_dir }}/ca_csr.csr'
privatekey_path: '{{ remote_tmp_dir }}/ca_privatekey.pem'
provider: selfsigned
selfsigned_digest: sha256
select_crypto_backend: '{{ select_crypto_backend }}'
register: result
- name: (OwnCA, {{ select_crypto_backend }}) Verify changed
ansible.builtin.assert:
that:
- result_check_mode is changed
- result is changed
- name: (OwnCA, {{ select_crypto_backend }}) Generate selfsigned CA certificate with different commonName
community.crypto.x509_certificate:
path: '{{ remote_tmp_dir }}/ca_cert2.pem'
csr_path: '{{ remote_tmp_dir }}/ca_csr2.csr'
privatekey_path: '{{ remote_tmp_dir }}/ca_privatekey.pem'
provider: selfsigned
selfsigned_digest: sha256
select_crypto_backend: '{{ select_crypto_backend }}'
- name: (OwnCA, {{ select_crypto_backend }}) Generate selfsigned CA certificate (privatekey passphrase)
community.crypto.x509_certificate:
path: '{{ remote_tmp_dir }}/ca_cert_pw.pem'
csr_path: '{{ remote_tmp_dir }}/ca_csr_pw.csr'
privatekey_path: '{{ remote_tmp_dir }}/ca_privatekey_pw.pem'
privatekey_passphrase: hunter2
provider: selfsigned
selfsigned_digest: sha256
select_crypto_backend: '{{ select_crypto_backend }}'
- name: (OwnCA, {{ select_crypto_backend }}) Generate ownca certificate
community.crypto.x509_certificate:
path: '{{ remote_tmp_dir }}/ownca_cert.pem'
csr_path: '{{ remote_tmp_dir }}/csr.csr'
privatekey_path: '{{ remote_tmp_dir }}/privatekey.pem'
ownca_path: '{{ remote_tmp_dir }}/ca_cert.pem'
ownca_privatekey_path: '{{ remote_tmp_dir }}/ca_privatekey.pem'
provider: ownca
ownca_digest: sha256
select_crypto_backend: '{{ select_crypto_backend }}'
return_content: true
register: ownca_certificate
- name: (OwnCA, {{ select_crypto_backend }}) Generate ownca certificate (idempotent)
community.crypto.x509_certificate:
path: '{{ remote_tmp_dir }}/ownca_cert.pem'
csr_path: '{{ remote_tmp_dir }}/csr.csr'
privatekey_path: '{{ remote_tmp_dir }}/privatekey.pem'
ownca_path: '{{ remote_tmp_dir }}/ca_cert.pem'
ownca_privatekey_path: '{{ remote_tmp_dir }}/ca_privatekey.pem'
provider: ownca
ownca_digest: sha256
select_crypto_backend: '{{ select_crypto_backend }}'
return_content: true
register: ownca_certificate_idempotence
- name: (OwnCA, {{ select_crypto_backend }}) Generate ownca certificate (check mode)
community.crypto.x509_certificate:
path: '{{ remote_tmp_dir }}/ownca_cert.pem'
csr_path: '{{ remote_tmp_dir }}/csr.csr'
privatekey_path: '{{ remote_tmp_dir }}/privatekey.pem'
ownca_path: '{{ remote_tmp_dir }}/ca_cert.pem'
ownca_privatekey_path: '{{ remote_tmp_dir }}/ca_privatekey.pem'
provider: ownca
ownca_digest: sha256
select_crypto_backend: '{{ select_crypto_backend }}'
check_mode: true
- name: (OwnCA, {{ select_crypto_backend }}) Copy ownca certificate to new file to check regeneration
ansible.builtin.copy:
src: '{{ remote_tmp_dir }}/ownca_cert.pem'
dest: '{{ item }}'
remote_src: true
loop:
- '{{ remote_tmp_dir }}/ownca_cert_ca_cn.pem'
- '{{ remote_tmp_dir }}/ownca_cert_ca_key.pem'
- name: (OwnCA, {{ select_crypto_backend }}) Regenerate ownca certificate with different CA subject
community.crypto.x509_certificate:
path: '{{ remote_tmp_dir }}/ownca_cert_ca_cn.pem'
csr_path: '{{ remote_tmp_dir }}/csr.csr'
privatekey_path: '{{ remote_tmp_dir }}/privatekey.pem'
ownca_path: '{{ remote_tmp_dir }}/ca_cert2.pem'
ownca_privatekey_path: '{{ remote_tmp_dir }}/ca_privatekey.pem'
provider: ownca
ownca_digest: sha256
select_crypto_backend: '{{ select_crypto_backend }}'
return_content: true
register: ownca_certificate_ca_subject_changed
- name: (OwnCA, {{ select_crypto_backend }}) Regenerate ownca certificate with different CA key
community.crypto.x509_certificate:
path: '{{ remote_tmp_dir }}/ownca_cert_ca_key.pem'
csr_path: '{{ remote_tmp_dir }}/csr.csr'
privatekey_path: '{{ remote_tmp_dir }}/privatekey.pem'
ownca_path: '{{ remote_tmp_dir }}/ca_cert_pw.pem'
ownca_privatekey_path: '{{ remote_tmp_dir }}/ca_privatekey_pw.pem'
ownca_privatekey_passphrase: hunter2
provider: ownca
ownca_digest: sha256
select_crypto_backend: '{{ select_crypto_backend }}'
return_content: true
register: ownca_certificate_ca_key_changed
- name: (OwnCA, {{ select_crypto_backend }}) Get certificate information
community.crypto.x509_certificate_info:
path: '{{ remote_tmp_dir }}/ownca_cert.pem'
select_crypto_backend: '{{ select_crypto_backend }}'
register: result
- name: (OwnCA, {{ select_crypto_backend }}) Get private key information
community.crypto.openssl_privatekey_info:
path: '{{ remote_tmp_dir }}/privatekey.pem'
select_crypto_backend: '{{ select_crypto_backend }}'
register: result_privatekey
- name: (OwnCA, {{ select_crypto_backend }}) Check ownca certificate
ansible.builtin.assert:
that:
- result.public_key == result_privatekey.public_key
- "result.signature_algorithm == 'sha256WithRSAEncryption' or result.signature_algorithm == 'sha256WithECDSAEncryption'"
- "result.subject.commonName == 'www.example.com'"
- "result.issuer.commonName == 'Example CA'"
- not result.expired
- result.version == 3
- name: (OwnCA, {{ select_crypto_backend }}) Generate ownca v2 certificate
community.crypto.x509_certificate:
path: '{{ remote_tmp_dir }}/ownca_cert_v2.pem'
csr_path: '{{ remote_tmp_dir }}/csr.csr'
privatekey_path: '{{ remote_tmp_dir }}/privatekey.pem'
ownca_path: '{{ remote_tmp_dir }}/ca_cert.pem'
ownca_privatekey_path: '{{ remote_tmp_dir }}/ca_privatekey.pem'
provider: ownca
ownca_digest: sha256
ownca_version: 2
select_crypto_backend: '{{ select_crypto_backend }}'
register: ownca_v2_certificate
ignore_errors: true
- name: (OwnCA, {{ select_crypto_backend }}) Generate ownca certificate2
community.crypto.x509_certificate:
path: '{{ remote_tmp_dir }}/ownca_cert2.pem'
csr_path: '{{ remote_tmp_dir }}/csr2.csr'
privatekey_path: '{{ remote_tmp_dir }}/privatekey2.pem'
ownca_path: '{{ remote_tmp_dir }}/ca_cert.pem'
ownca_privatekey_path: '{{ remote_tmp_dir }}/ca_privatekey.pem'
provider: ownca
ownca_digest: sha256
select_crypto_backend: '{{ select_crypto_backend }}'
- name: (OwnCA, {{ select_crypto_backend }}) Get certificate information
community.crypto.x509_certificate_info:
path: '{{ remote_tmp_dir }}/ownca_cert2.pem'
select_crypto_backend: '{{ select_crypto_backend }}'
register: result
- name: (OwnCA, {{ select_crypto_backend }}) Get private key information
community.crypto.openssl_privatekey_info:
path: '{{ remote_tmp_dir }}/privatekey2.pem'
select_crypto_backend: '{{ select_crypto_backend }}'
register: result_privatekey
- name: (OwnCA, {{ select_crypto_backend }}) Check ownca certificate2
ansible.builtin.assert:
that:
- result.public_key == result_privatekey.public_key
- "result.signature_algorithm == 'sha256WithRSAEncryption' or result.signature_algorithm == 'sha256WithECDSAEncryption'"
- "result.subject.commonName == 'www.example.com'"
- "result.subject.countryName == 'US'"
- "result.subject.localityName == 'Los Angeles'" # L
- "result.subject.organizationName == 'ACME Inc.'"
- "['organizationalUnitName', 'Pyrotechnics'] in result.subject_ordered"
- "['organizationalUnitName', 'Roadrunner pest control'] in result.subject_ordered"
- "result.issuer.commonName == 'Example CA'"
- not result.expired
- result.version == 3
- "'Digital Signature' in result.key_usage"
- "'IPSec User' in result.extended_key_usage"
- "'Biometric Info' in result.extended_key_usage"
- name: (OwnCA, {{ select_crypto_backend }}) Create ownca certificate with notBefore and notAfter
community.crypto.x509_certificate:
provider: ownca
ownca_not_before: 20181023133742Z
ownca_not_after: 20191023133742Z
path: "{{ remote_tmp_dir }}/ownca_cert3.pem"
csr_path: "{{ remote_tmp_dir }}/csr.csr"
privatekey_path: "{{ remote_tmp_dir }}/privatekey.pem"
ownca_path: '{{ remote_tmp_dir }}/ca_cert.pem'
ownca_privatekey_path: '{{ remote_tmp_dir }}/ca_privatekey.pem'
select_crypto_backend: '{{ select_crypto_backend }}'
- name: (OwnCA, {{ select_crypto_backend }}) Create ownca certificate with notBefore and notAfter (idempotent)
community.crypto.x509_certificate:
provider: ownca
ownca_not_before: 20181023133742Z
ownca_not_after: 20191023133742Z
ignore_timestamps: false
path: "{{ remote_tmp_dir }}/ownca_cert3.pem"
csr_path: "{{ remote_tmp_dir }}/csr.csr"
privatekey_path: "{{ remote_tmp_dir }}/privatekey.pem"
ownca_path: '{{ remote_tmp_dir }}/ca_cert.pem'
ownca_privatekey_path: '{{ remote_tmp_dir }}/ca_privatekey.pem'
select_crypto_backend: '{{ select_crypto_backend }}'
register: ownca_cert3_idem
- name: (OwnCA, {{ select_crypto_backend }}) Create ownca certificate with relative notBefore and notAfter
community.crypto.x509_certificate:
provider: ownca
ownca_not_before: +1s
ownca_not_after: +52w
path: "{{ remote_tmp_dir }}/ownca_cert4.pem"
csr_path: "{{ remote_tmp_dir }}/csr.csr"
privatekey_path: "{{ remote_tmp_dir }}/privatekey3.pem"
ownca_path: '{{ remote_tmp_dir }}/ca_cert.pem'
ownca_privatekey_path: '{{ remote_tmp_dir }}/ca_privatekey.pem'
select_crypto_backend: '{{ select_crypto_backend }}'
- name: (OwnCA, {{ select_crypto_backend }}) Generate ownca ECC certificate
community.crypto.x509_certificate:
path: '{{ remote_tmp_dir }}/ownca_cert_ecc.pem'
csr_path: '{{ remote_tmp_dir }}/csr_ecc.csr'
privatekey_path: '{{ remote_tmp_dir }}/privatekey_ecc.pem'
ownca_path: '{{ remote_tmp_dir }}/ca_cert.pem'
ownca_privatekey_path: '{{ remote_tmp_dir }}/ca_privatekey.pem'
provider: ownca
ownca_digest: sha256
select_crypto_backend: '{{ select_crypto_backend }}'
register: ownca_certificate_ecc
- name: (OwnCA, {{ select_crypto_backend }}) Generate selfsigned certificate (privatekey passphrase)
community.crypto.x509_certificate:
path: '{{ remote_tmp_dir }}/ownca_cert_ecc_2.pem'
csr_path: '{{ remote_tmp_dir }}/csr_ecc.csr'
ownca_path: '{{ remote_tmp_dir }}/ca_cert_pw.pem'
ownca_privatekey_path: '{{ remote_tmp_dir }}/ca_privatekey_pw.pem'
ownca_privatekey_passphrase: hunter2
provider: ownca
ownca_digest: sha256
select_crypto_backend: '{{ select_crypto_backend }}'
register: selfsigned_certificate_passphrase
- name: (OwnCA, {{ select_crypto_backend }}) Generate ownca certificate (failed passphrase 1)
community.crypto.x509_certificate:
path: '{{ remote_tmp_dir }}/ownca_cert_pw1.pem'
csr_path: '{{ remote_tmp_dir }}/csr_ecc.csr'
ownca_path: '{{ remote_tmp_dir }}/ca_cert.pem'
ownca_privatekey_path: '{{ remote_tmp_dir }}/ca_privatekey.pem'
ownca_privatekey_passphrase: hunter2
provider: ownca
ownca_digest: sha256
select_crypto_backend: '{{ select_crypto_backend }}'
ignore_errors: true
register: passphrase_error_1
- name: (OwnCA, {{ select_crypto_backend }}) Generate ownca certificate (failed passphrase 2)
community.crypto.x509_certificate:
path: '{{ remote_tmp_dir }}/ownca_cert_pw2.pem'
csr_path: '{{ remote_tmp_dir }}/csr_ecc.csr'
ownca_path: '{{ remote_tmp_dir }}/ca_cert.pem'
ownca_privatekey_path: '{{ remote_tmp_dir }}/privatekeypw.pem'
ownca_privatekey_passphrase: wrong_password
provider: ownca
ownca_digest: sha256
select_crypto_backend: '{{ select_crypto_backend }}'
ignore_errors: true
register: passphrase_error_2
- name: (OwnCA, {{ select_crypto_backend }}) Generate ownca certificate (failed passphrase 3)
community.crypto.x509_certificate:
path: '{{ remote_tmp_dir }}/ownca_cert_pw3.pem'
csr_path: '{{ remote_tmp_dir }}/csr_ecc.csr'
ownca_path: '{{ remote_tmp_dir }}/ca_cert.pem'
ownca_privatekey_path: '{{ remote_tmp_dir }}/privatekeypw.pem'
provider: ownca
ownca_digest: sha256
select_crypto_backend: '{{ select_crypto_backend }}'
ignore_errors: true
register: passphrase_error_3
- name: (OwnCA, {{ select_crypto_backend }}) Create broken certificate
ansible.builtin.copy:
dest: "{{ remote_tmp_dir }}/ownca_broken.pem"
content: "broken"
- name: (OwnCA, {{ select_crypto_backend }}) Regenerate broken cert
community.crypto.x509_certificate:
path: '{{ remote_tmp_dir }}/ownca_broken.pem'
csr_path: '{{ remote_tmp_dir }}/csr_ecc.csr'
privatekey_path: '{{ remote_tmp_dir }}/privatekey_ecc.pem'
ownca_path: '{{ remote_tmp_dir }}/ca_cert.pem'
ownca_privatekey_path: '{{ remote_tmp_dir }}/ca_privatekey.pem'
provider: ownca
ownca_digest: sha256
register: ownca_broken
- name: (OwnCA, {{ select_crypto_backend }}) Backup test
community.crypto.x509_certificate:
path: '{{ remote_tmp_dir }}/ownca_cert_backup.pem'
csr_path: '{{ remote_tmp_dir }}/csr_ecc.csr'
ownca_path: '{{ remote_tmp_dir }}/ca_cert.pem'
ownca_privatekey_path: '{{ remote_tmp_dir }}/ca_privatekey.pem'
provider: ownca
ownca_digest: sha256
backup: true
select_crypto_backend: '{{ select_crypto_backend }}'
register: ownca_backup_1
- name: (OwnCA, {{ select_crypto_backend }}) Backup test (idempotent)
community.crypto.x509_certificate:
path: '{{ remote_tmp_dir }}/ownca_cert_backup.pem'
csr_path: '{{ remote_tmp_dir }}/csr_ecc.csr'
ownca_path: '{{ remote_tmp_dir }}/ca_cert.pem'
ownca_privatekey_path: '{{ remote_tmp_dir }}/ca_privatekey.pem'
provider: ownca
ownca_digest: sha256
backup: true
select_crypto_backend: '{{ select_crypto_backend }}'
register: ownca_backup_2
- name: (OwnCA, {{ select_crypto_backend }}) Backup test (change)
community.crypto.x509_certificate:
path: '{{ remote_tmp_dir }}/ownca_cert_backup.pem'
csr_path: '{{ remote_tmp_dir }}/csr.csr'
ownca_path: '{{ remote_tmp_dir }}/ca_cert.pem'
ownca_privatekey_path: '{{ remote_tmp_dir }}/ca_privatekey.pem'
provider: ownca
ownca_digest: sha256
backup: true
select_crypto_backend: '{{ select_crypto_backend }}'
register: ownca_backup_3
- name: (OwnCA, {{ select_crypto_backend }}) Backup test (remove)
community.crypto.x509_certificate:
path: '{{ remote_tmp_dir }}/ownca_cert_backup.pem'
state: absent
provider: ownca
backup: true
select_crypto_backend: '{{ select_crypto_backend }}'
register: ownca_backup_4
- name: (OwnCA, {{ select_crypto_backend }}) Backup test (remove, idempotent)
community.crypto.x509_certificate:
path: '{{ remote_tmp_dir }}/ownca_cert_backup.pem'
state: absent
provider: ownca
backup: true
select_crypto_backend: '{{ select_crypto_backend }}'
register: ownca_backup_5
- name: (OwnCA, {{ select_crypto_backend }}) Create subject key identifier
community.crypto.x509_certificate:
path: '{{ remote_tmp_dir }}/ownca_cert_ski.pem'
csr_path: '{{ remote_tmp_dir }}/csr_ecc.csr'
ownca_path: '{{ remote_tmp_dir }}/ca_cert.pem'
ownca_privatekey_path: '{{ remote_tmp_dir }}/ca_privatekey.pem'
provider: ownca
ownca_digest: sha256
ownca_create_subject_key_identifier: always_create
select_crypto_backend: '{{ select_crypto_backend }}'
register: ownca_subject_key_identifier_1
- name: (OwnCA, {{ select_crypto_backend }}) Create subject key identifier (idempotency)
community.crypto.x509_certificate:
path: '{{ remote_tmp_dir }}/ownca_cert_ski.pem'
csr_path: '{{ remote_tmp_dir }}/csr_ecc.csr'
ownca_path: '{{ remote_tmp_dir }}/ca_cert.pem'
ownca_privatekey_path: '{{ remote_tmp_dir }}/ca_privatekey.pem'
provider: ownca
ownca_digest: sha256
ownca_create_subject_key_identifier: always_create
select_crypto_backend: '{{ select_crypto_backend }}'
register: ownca_subject_key_identifier_2
- name: (OwnCA, {{ select_crypto_backend }}) Create subject key identifier (remove)
community.crypto.x509_certificate:
path: '{{ remote_tmp_dir }}/ownca_cert_ski.pem'
csr_path: '{{ remote_tmp_dir }}/csr_ecc.csr'
ownca_path: '{{ remote_tmp_dir }}/ca_cert.pem'
ownca_privatekey_path: '{{ remote_tmp_dir }}/ca_privatekey.pem'
provider: ownca
ownca_digest: sha256
ownca_create_subject_key_identifier: never_create
select_crypto_backend: '{{ select_crypto_backend }}'
register: ownca_subject_key_identifier_3
- name: (OwnCA, {{ select_crypto_backend }}) Create subject key identifier (remove idempotency)
community.crypto.x509_certificate:
path: '{{ remote_tmp_dir }}/ownca_cert_ski.pem'
csr_path: '{{ remote_tmp_dir }}/csr_ecc.csr'
ownca_path: '{{ remote_tmp_dir }}/ca_cert.pem'
ownca_privatekey_path: '{{ remote_tmp_dir }}/ca_privatekey.pem'
provider: ownca
ownca_digest: sha256
ownca_create_subject_key_identifier: never_create
select_crypto_backend: '{{ select_crypto_backend }}'
register: ownca_subject_key_identifier_4
- name: (OwnCA, {{ select_crypto_backend }}) Create subject key identifier (re-enable)
community.crypto.x509_certificate:
path: '{{ remote_tmp_dir }}/ownca_cert_ski.pem'
csr_path: '{{ remote_tmp_dir }}/csr_ecc.csr'
ownca_path: '{{ remote_tmp_dir }}/ca_cert.pem'
ownca_privatekey_path: '{{ remote_tmp_dir }}/ca_privatekey.pem'
provider: ownca
ownca_digest: sha256
ownca_create_subject_key_identifier: always_create
select_crypto_backend: '{{ select_crypto_backend }}'
register: ownca_subject_key_identifier_5
- name: (OwnCA, {{ select_crypto_backend }}) Create authority key identifier
community.crypto.x509_certificate:
path: '{{ remote_tmp_dir }}/ownca_cert_aki.pem'
csr_path: '{{ remote_tmp_dir }}/csr_ecc.csr'
ownca_path: '{{ remote_tmp_dir }}/ca_cert.pem'
ownca_privatekey_path: '{{ remote_tmp_dir }}/ca_privatekey.pem'
provider: ownca
ownca_digest: sha256
ownca_create_authority_key_identifier: true
select_crypto_backend: '{{ select_crypto_backend }}'
register: ownca_authority_key_identifier_1
- name: (OwnCA, {{ select_crypto_backend }}) Create authority key identifier (idempotency)
community.crypto.x509_certificate:
path: '{{ remote_tmp_dir }}/ownca_cert_aki.pem'
csr_path: '{{ remote_tmp_dir }}/csr_ecc.csr'
ownca_path: '{{ remote_tmp_dir }}/ca_cert.pem'
ownca_privatekey_path: '{{ remote_tmp_dir }}/ca_privatekey.pem'
provider: ownca
ownca_digest: sha256
ownca_create_authority_key_identifier: true
select_crypto_backend: '{{ select_crypto_backend }}'
register: ownca_authority_key_identifier_2
- name: (OwnCA, {{ select_crypto_backend }}) Create authority key identifier (remove)
community.crypto.x509_certificate:
path: '{{ remote_tmp_dir }}/ownca_cert_aki.pem'
csr_path: '{{ remote_tmp_dir }}/csr_ecc.csr'
ownca_path: '{{ remote_tmp_dir }}/ca_cert.pem'
ownca_privatekey_path: '{{ remote_tmp_dir }}/ca_privatekey.pem'
provider: ownca
ownca_digest: sha256
ownca_create_authority_key_identifier: false
select_crypto_backend: '{{ select_crypto_backend }}'
register: ownca_authority_key_identifier_3
- name: (OwnCA, {{ select_crypto_backend }}) Create authority key identifier (remove idempotency)
community.crypto.x509_certificate:
path: '{{ remote_tmp_dir }}/ownca_cert_aki.pem'
csr_path: '{{ remote_tmp_dir }}/csr_ecc.csr'
ownca_path: '{{ remote_tmp_dir }}/ca_cert.pem'
ownca_privatekey_path: '{{ remote_tmp_dir }}/ca_privatekey.pem'
provider: ownca
ownca_digest: sha256
ownca_create_authority_key_identifier: false
select_crypto_backend: '{{ select_crypto_backend }}'
register: ownca_authority_key_identifier_4
- name: (OwnCA, {{ select_crypto_backend }}) Create authority key identifier (re-add)
community.crypto.x509_certificate:
path: '{{ remote_tmp_dir }}/ownca_cert_aki.pem'
csr_path: '{{ remote_tmp_dir }}/csr_ecc.csr'
ownca_path: '{{ remote_tmp_dir }}/ca_cert.pem'
ownca_privatekey_path: '{{ remote_tmp_dir }}/ca_privatekey.pem'
provider: ownca
ownca_digest: sha256
ownca_create_authority_key_identifier: true
select_crypto_backend: '{{ select_crypto_backend }}'
register: ownca_authority_key_identifier_5
- name: (OwnCA, {{ select_crypto_backend }}) Ed25519 and Ed448 tests (for cryptography >= 2.6)
block:
- name: (OwnCA, {{ select_crypto_backend }}) Generate privatekeys
community.crypto.openssl_privatekey:
path: '{{ remote_tmp_dir }}/privatekey_{{ item }}.pem'
type: '{{ item }}'
loop:
- Ed25519
- Ed448
register: ownca_certificate_ed25519_ed448_privatekey
ignore_errors: true
- name: (OwnCA, {{ select_crypto_backend }}) Generate CSR etc. if private key generation succeeded
when: ownca_certificate_ed25519_ed448_privatekey is not failed
block:
- name: (OwnCA, {{ select_crypto_backend }}) Generate CSR
community.crypto.openssl_csr:
path: '{{ remote_tmp_dir }}/csr_{{ item }}.csr'
privatekey_path: '{{ remote_tmp_dir }}/privatekey_{{ item }}.pem'
subject:
commonName: www.ansible.com
select_crypto_backend: '{{ select_crypto_backend }}'
loop:
- Ed25519
- Ed448
ignore_errors: true
- name: (OwnCA, {{ select_crypto_backend }}) Generate ownca certificate
community.crypto.x509_certificate:
path: '{{ remote_tmp_dir }}/ownca_cert_{{ item }}.pem'
csr_path: '{{ remote_tmp_dir }}/csr_{{ item }}.csr'
ownca_path: '{{ remote_tmp_dir }}/ca_cert.pem'
ownca_privatekey_path: '{{ remote_tmp_dir }}/ca_privatekey.pem'
provider: ownca
ownca_digest: sha256
select_crypto_backend: '{{ select_crypto_backend }}'
loop:
- Ed25519
- Ed448
register: ownca_certificate_ed25519_ed448
ignore_errors: true
- name: (OwnCA, {{ select_crypto_backend }}) Generate ownca certificate (idempotent)
community.crypto.x509_certificate:
path: '{{ remote_tmp_dir }}/ownca_cert_{{ item }}.pem'
csr_path: '{{ remote_tmp_dir }}/csr_{{ item }}.csr'
ownca_path: '{{ remote_tmp_dir }}/ca_cert.pem'
ownca_privatekey_path: '{{ remote_tmp_dir }}/ca_privatekey.pem'
provider: ownca
ownca_digest: sha256
select_crypto_backend: '{{ select_crypto_backend }}'
loop:
- Ed25519
- Ed448
register: ownca_certificate_ed25519_ed448_idempotence
ignore_errors: true
- name: (OwnCA, {{ select_crypto_backend }}) Generate CA privatekey
community.crypto.openssl_privatekey:
path: '{{ remote_tmp_dir }}/ca_privatekey_{{ item }}.pem'
type: '{{ item }}'
passphrase: Test123
ignore_errors: true
loop:
- Ed25519
- Ed448
- name: (OwnCA, {{ select_crypto_backend }}) Generate CA CSR
community.crypto.openssl_csr:
path: '{{ remote_tmp_dir }}/ca_csr_{{ item }}.csr'
privatekey_path: '{{ remote_tmp_dir }}/ca_privatekey_{{ item }}.pem'
privatekey_passphrase: Test123
subject:
commonName: Example CA
useCommonNameForSAN: false
basic_constraints:
- 'CA:TRUE'
basic_constraints_critical: true
key_usage:
- cRLSign
- keyCertSign
loop:
- Ed25519
- Ed448
ignore_errors: true
- name: (OwnCA, {{ select_crypto_backend }}) Generate selfsigned CA certificate
community.crypto.x509_certificate:
path: '{{ remote_tmp_dir }}/ca_cert_{{ item }}.pem'
csr_path: '{{ remote_tmp_dir }}/ca_csr_{{ item }}.csr'
privatekey_path: '{{ remote_tmp_dir }}/ca_privatekey_{{ item }}.pem'
privatekey_passphrase: Test123
provider: selfsigned
select_crypto_backend: '{{ select_crypto_backend }}'
loop:
- Ed25519
- Ed448
ignore_errors: true
- name: (OwnCA, {{ select_crypto_backend }}) Generate ownca certificate
community.crypto.x509_certificate:
path: '{{ remote_tmp_dir }}/ownca_cert_{{ item }}_2.pem'
csr_path: '{{ remote_tmp_dir }}/csr.csr'
ownca_path: '{{ remote_tmp_dir }}/ca_cert_{{ item }}.pem'
ownca_privatekey_path: '{{ remote_tmp_dir }}/ca_privatekey_{{ item }}.pem'
ownca_privatekey_passphrase: Test123
provider: ownca
ownca_digest: sha256
select_crypto_backend: '{{ select_crypto_backend }}'
loop:
- Ed25519
- Ed448
register: ownca_certificate_ed25519_ed448_2
ignore_errors: true
- name: (OwnCA, {{ select_crypto_backend }}) Generate ownca certificate (idempotent)
community.crypto.x509_certificate:
path: '{{ remote_tmp_dir }}/ownca_cert_{{ item }}_2.pem'
csr_path: '{{ remote_tmp_dir }}/csr.csr'
ownca_path: '{{ remote_tmp_dir }}/ca_cert_{{ item }}.pem'
ownca_privatekey_path: '{{ remote_tmp_dir }}/ca_privatekey_{{ item }}.pem'
ownca_privatekey_passphrase: Test123
provider: ownca
ownca_digest: sha256
select_crypto_backend: '{{ select_crypto_backend }}'
loop:
- Ed25519
- Ed448
register: ownca_certificate_ed25519_ed448_2_idempotence
ignore_errors: true
when: select_crypto_backend == 'cryptography' and cryptography_version is version('3.3', '>=')
- ansible.builtin.import_tasks: ../tests/validate_ownca.yml
Reference in New Issue View Git Blame Copy Permalink