mirror of
https://github.com/ansible-collections/community.crypto.git
synced 2026-05-07 22:03:01 +00:00
02ee3fb974
* Remove superfluous remote_src. * Use temp dir twice instead of output_dir. * Use remote temp directory instead of output_dir. * Fix syntax error. * Add some fixes. * Copy more files to remote. * More fixes. * Fixing ACME/'cloud' tests. * Forgot when. * Try to fix filters. * Skip unnecessary steps. * Avoid collision.
167 lines
6.1 KiB
YAML
167 lines
6.1 KiB
YAML
---
|
|
- name: (Assertonly, {{select_crypto_backend}}) - Generate privatekey
|
|
openssl_privatekey:
|
|
path: '{{ remote_tmp_dir }}/privatekey.pem'
|
|
size: '{{ default_rsa_key_size_certifiates }}'
|
|
|
|
- name: (Assertonly, {{select_crypto_backend}}) - Generate privatekey with password
|
|
openssl_privatekey:
|
|
path: '{{ remote_tmp_dir }}/privatekeypw.pem'
|
|
passphrase: hunter2
|
|
cipher: auto
|
|
select_crypto_backend: cryptography
|
|
size: '{{ default_rsa_key_size_certifiates }}'
|
|
|
|
- name: (Assertonly, {{select_crypto_backend}}) - Generate CSR (no extensions)
|
|
openssl_csr:
|
|
path: '{{ remote_tmp_dir }}/csr_noext.csr'
|
|
privatekey_path: '{{ remote_tmp_dir }}/privatekey.pem'
|
|
subject:
|
|
commonName: www.example.com
|
|
useCommonNameForSAN: no
|
|
|
|
- name: (Assertonly, {{select_crypto_backend}}) - Generate CSR (with SANs)
|
|
openssl_csr:
|
|
path: '{{ remote_tmp_dir }}/csr_sans.csr'
|
|
privatekey_path: '{{ remote_tmp_dir }}/privatekey.pem'
|
|
subject:
|
|
commonName: www.example.com
|
|
subject_alt_name:
|
|
- "DNS:ansible.com"
|
|
- "IP:127.0.0.1"
|
|
- "IP:::1"
|
|
useCommonNameForSAN: no
|
|
|
|
- name: (Assertonly, {{select_crypto_backend}}) - Generate selfsigned certificate (no extensions)
|
|
x509_certificate:
|
|
path: '{{ remote_tmp_dir }}/cert_noext.pem'
|
|
csr_path: '{{ remote_tmp_dir }}/csr_noext.csr'
|
|
privatekey_path: '{{ remote_tmp_dir }}/privatekey.pem'
|
|
provider: selfsigned
|
|
selfsigned_digest: sha256
|
|
select_crypto_backend: '{{ select_crypto_backend }}'
|
|
|
|
- name: (Assertonly, {{select_crypto_backend}}) - Generate selfsigned certificate (with SANs)
|
|
x509_certificate:
|
|
path: '{{ remote_tmp_dir }}/cert_sans.pem'
|
|
csr_path: '{{ remote_tmp_dir }}/csr_sans.csr'
|
|
privatekey_path: '{{ remote_tmp_dir }}/privatekey.pem'
|
|
provider: selfsigned
|
|
selfsigned_digest: sha256
|
|
select_crypto_backend: '{{ select_crypto_backend }}'
|
|
|
|
- name: (Assertonly, {{select_crypto_backend}}) - Assert that subject_alt_name is there (should fail)
|
|
x509_certificate:
|
|
path: '{{ remote_tmp_dir }}/cert_noext.pem'
|
|
provider: assertonly
|
|
subject_alt_name:
|
|
- "DNS:example.com"
|
|
select_crypto_backend: '{{ select_crypto_backend }}'
|
|
ignore_errors: yes
|
|
register: extension_missing_san
|
|
|
|
- name: (Assertonly, {{select_crypto_backend}}) - Assert that subject_alt_name is there
|
|
x509_certificate:
|
|
path: '{{ remote_tmp_dir }}/cert_sans.pem'
|
|
provider: assertonly
|
|
subject_alt_name:
|
|
- "DNS:ansible.com"
|
|
- "IP:127.0.0.1"
|
|
- "IP:::1"
|
|
select_crypto_backend: '{{ select_crypto_backend }}'
|
|
register: extension_san
|
|
|
|
- name: (Assertonly, {{select_crypto_backend}}) - Assert that subject_alt_name is there (strict)
|
|
x509_certificate:
|
|
path: '{{ remote_tmp_dir }}/cert_sans.pem'
|
|
provider: assertonly
|
|
subject_alt_name:
|
|
- "DNS:ansible.com"
|
|
- "IP:127.0.0.1"
|
|
- "IP:::1"
|
|
subject_alt_name_strict: yes
|
|
select_crypto_backend: '{{ select_crypto_backend }}'
|
|
register: extension_san_strict
|
|
|
|
- name: (Assertonly, {{select_crypto_backend}}) - Assert that key_usage is there (should fail)
|
|
x509_certificate:
|
|
path: '{{ remote_tmp_dir }}/cert_noext.pem'
|
|
provider: assertonly
|
|
key_usage:
|
|
- digitalSignature
|
|
select_crypto_backend: '{{ select_crypto_backend }}'
|
|
ignore_errors: yes
|
|
register: extension_missing_ku
|
|
|
|
- name: (Assertonly, {{select_crypto_backend}}) - Assert that extended_key_usage is there (should fail)
|
|
x509_certificate:
|
|
path: '{{ remote_tmp_dir }}/cert_noext.pem'
|
|
provider: assertonly
|
|
extended_key_usage:
|
|
- biometricInfo
|
|
select_crypto_backend: '{{ select_crypto_backend }}'
|
|
ignore_errors: yes
|
|
register: extension_missing_eku
|
|
|
|
- assert:
|
|
that:
|
|
- extension_missing_san is failed
|
|
- "'Found no subjectAltName extension' in extension_missing_san.msg"
|
|
- extension_san is succeeded
|
|
- extension_san_strict is succeeded
|
|
- extension_missing_ku is failed
|
|
- "'Found no keyUsage extension' in extension_missing_ku.msg"
|
|
- extension_missing_eku is failed
|
|
- "'Found no extendedKeyUsage extension' in extension_missing_eku.msg"
|
|
|
|
- name: (Assertonly, {{select_crypto_backend}}) - Check wrong key fail
|
|
x509_certificate:
|
|
path: '{{ remote_tmp_dir }}/cert_noext.pem'
|
|
privatekey_path: '{{ remote_tmp_dir }}/privatekeypw.pem'
|
|
privatekey_passphrase: hunter2
|
|
provider: assertonly
|
|
select_crypto_backend: '{{ select_crypto_backend }}'
|
|
ignore_errors: yes
|
|
register: private_key_error
|
|
|
|
- name: (Assertonly, {{select_crypto_backend}}) - Check private key passphrase fail 1
|
|
x509_certificate:
|
|
path: '{{ remote_tmp_dir }}/cert_noext.pem'
|
|
privatekey_path: '{{ remote_tmp_dir }}/privatekey.pem'
|
|
privatekey_passphrase: hunter2
|
|
provider: assertonly
|
|
select_crypto_backend: '{{ select_crypto_backend }}'
|
|
ignore_errors: yes
|
|
register: passphrase_error_1
|
|
|
|
- name: (Assertonly, {{select_crypto_backend}}) - Check private key passphrase fail 2
|
|
x509_certificate:
|
|
path: '{{ remote_tmp_dir }}/cert_noext.pem'
|
|
privatekey_path: '{{ remote_tmp_dir }}/privatekeypw.pem'
|
|
privatekey_passphrase: wrong_password
|
|
provider: assertonly
|
|
select_crypto_backend: '{{ select_crypto_backend }}'
|
|
ignore_errors: yes
|
|
register: passphrase_error_2
|
|
|
|
- name: (Assertonly, {{select_crypto_backend}}) - Check private key passphrase fail 3
|
|
x509_certificate:
|
|
path: '{{ remote_tmp_dir }}/cert_noext.pem'
|
|
privatekey_path: '{{ remote_tmp_dir }}/privatekeypw.pem'
|
|
provider: assertonly
|
|
select_crypto_backend: '{{ select_crypto_backend }}'
|
|
ignore_errors: yes
|
|
register: passphrase_error_3
|
|
|
|
- name: (Assertonly, {{select_crypto_backend}}) -
|
|
assert:
|
|
that:
|
|
- private_key_error is failed
|
|
- "'Certificate and private key ' in private_key_error.msg and ' do not match' in private_key_error.msg"
|
|
- passphrase_error_1 is failed
|
|
- "'assphrase' in passphrase_error_1.msg or 'assword' in passphrase_error_1.msg"
|
|
- passphrase_error_2 is failed
|
|
- "'assphrase' in passphrase_error_2.msg or 'assword' in passphrase_error_2.msg or 'serializ' in passphrase_error_2.msg"
|
|
- passphrase_error_3 is failed
|
|
- "'assphrase' in passphrase_error_3.msg or 'assword' in passphrase_error_3.msg or 'serializ' in passphrase_error_3.msg"
|