mirror of
https://github.com/ansible-collections/community.crypto.git
synced 2026-05-06 13:22:58 +00:00
4d8dcad190
* Improve openssh_* tests. * Use 2048 instead of 4096 bit keys in many places. ci_complete * Parameterize default RSA key length for tests. * Reduce default RSA key size to 1024. ci_complete * Fix error. ci_complete * Use variable more often. * Use 2048 bits for RSA keys for certificates on RHEL8 and CentOS8. ci_complete * Fix missing constant. ci_complete * Print default key sizes.
104 lines
3.6 KiB
YAML
104 lines
3.6 KiB
YAML
---
|
|
- name: ({{select_crypto_backend}}) Create key
|
|
openssl_privatekey_pipe:
|
|
select_crypto_backend: '{{ select_crypto_backend }}'
|
|
register: result
|
|
|
|
- name: ({{select_crypto_backend}}) Get key info
|
|
openssl_privatekey_info:
|
|
content: "{{ result.privatekey }}"
|
|
register: result_info
|
|
|
|
- assert:
|
|
that:
|
|
- result is changed
|
|
- result.privatekey.startswith('----')
|
|
- result_info.type == 'RSA'
|
|
- result_info.public_data.size == 4096
|
|
- result_info.public_data.exponent >= 5
|
|
|
|
- assert:
|
|
that:
|
|
- result_info.public_key_fingerprints.sha256 | length > 10
|
|
- result.fingerprint.sha256 == result_info.public_key_fingerprints.sha256
|
|
when: result.fingerprint is not none
|
|
|
|
- name: ({{select_crypto_backend}}) Update key (check mode)
|
|
openssl_privatekey_pipe:
|
|
select_crypto_backend: '{{ select_crypto_backend }}'
|
|
content: "{{ result.privatekey }}"
|
|
size: '{{ default_rsa_key_size }}'
|
|
register: update_check
|
|
check_mode: true
|
|
|
|
- name: ({{select_crypto_backend}}) Update key (check mode, with return_current_key=true)
|
|
openssl_privatekey_pipe:
|
|
select_crypto_backend: '{{ select_crypto_backend }}'
|
|
content: "{{ result.privatekey }}"
|
|
size: '{{ default_rsa_key_size }}'
|
|
return_current_key: true
|
|
register: update_check_return
|
|
check_mode: true
|
|
|
|
- name: ({{select_crypto_backend}}) Update key
|
|
openssl_privatekey_pipe:
|
|
select_crypto_backend: '{{ select_crypto_backend }}'
|
|
content: "{{ result.privatekey }}"
|
|
size: '{{ default_rsa_key_size }}'
|
|
register: update
|
|
|
|
- name: ({{select_crypto_backend}}) Update key (idempotent, check mode)
|
|
openssl_privatekey_pipe:
|
|
select_crypto_backend: '{{ select_crypto_backend }}'
|
|
content: "{{ update.privatekey }}"
|
|
size: '{{ default_rsa_key_size }}'
|
|
register: update_idempotent_check
|
|
check_mode: true
|
|
|
|
- name: ({{select_crypto_backend}}) Update key (idempotent)
|
|
openssl_privatekey_pipe:
|
|
select_crypto_backend: '{{ select_crypto_backend }}'
|
|
content: "{{ update.privatekey }}"
|
|
size: '{{ default_rsa_key_size }}'
|
|
register: update_idempotent
|
|
|
|
- name: ({{select_crypto_backend}}) Update key (idempotent, check mode, with return_current_key=true)
|
|
openssl_privatekey_pipe:
|
|
select_crypto_backend: '{{ select_crypto_backend }}'
|
|
content: "{{ update.privatekey }}"
|
|
size: '{{ default_rsa_key_size }}'
|
|
return_current_key: true
|
|
register: update_idempotent_return_check
|
|
check_mode: true
|
|
|
|
- name: ({{select_crypto_backend}}) Update key (idempotent, with return_current_key=true)
|
|
openssl_privatekey_pipe:
|
|
select_crypto_backend: '{{ select_crypto_backend }}'
|
|
content: "{{ update.privatekey }}"
|
|
size: '{{ default_rsa_key_size }}'
|
|
return_current_key: true
|
|
register: update_idempotent_return
|
|
|
|
- name: ({{select_crypto_backend}}) Get key info
|
|
openssl_privatekey_info:
|
|
content: "{{ update.privatekey }}"
|
|
register: update_info
|
|
|
|
- assert:
|
|
that:
|
|
- update_check is changed
|
|
- update_check.privatekey == 'VALUE_SPECIFIED_IN_NO_LOG_PARAMETER'
|
|
- update_check_return is changed
|
|
- update_check_return.privatekey == result.privatekey
|
|
- update is changed
|
|
- update.privatekey != result.privatekey
|
|
- update_info.public_data.size == default_rsa_key_size
|
|
- update_idempotent_check is not changed
|
|
- update_idempotent_check.privatekey is undefined
|
|
- update_idempotent is not changed
|
|
- update_idempotent.privatekey is undefined
|
|
- update_idempotent_return_check is not changed
|
|
- update_idempotent_return_check.privatekey == update.privatekey
|
|
- update_idempotent_return is not changed
|
|
- update_idempotent_return.privatekey == update.privatekey
|