mirror of
https://github.com/ansible-collections/community.general.git
synced 2026-05-08 14:22:46 +00:00
New cryptography backend for openssl_certificate (#53924)
* New cryptography backend for openssl_certificate
load_* functions in module_utils/crypto.py now have a backend paramter
which when set to 'cryptography' will return cryptography objects so
they can be used for both pyopenssl and cryptography backends.
Added a select_message_digest function too returning a cryptography
digest hash from `cryptography.hazmat.primitives.hashes`
Added new classes for Cryptography backend
* Run test with various backends.
* Prefixing tests.
* Make sure we have the correct backend available.
* Linting (flake8).
* Moved cryptography import to separate try/except
* Make sure certificate is actually valid at some time in the past.
* Improve error handling.
* Trying to fix validation for cryptography backend.
* Fixed issue with keyUsage test in assertonly
* Fixed CI/Lint issues
* Fix private key problem for OwnCA.
* Cryptography backend doesn't support v2 certs.
* issue an expired cert with command when using cryptography backend
* Added warning when backend is auto and v2 cert is requested
* Bumped min cryptography version to 1.6
* Correctly check for failure when backend is cryptography and cert is v2
* Use self.backend where possible
* Use secp521r1 EC when testing on CentOS6
* Fixed pylint issue
* AcmeCertificate support for both backends
* Review fixes
* Fixed missing '(' when raising error
* Fixed date_fmt loop
* Updated docs and requirements with cryptography
* Add openssl_certificate to changelog.
This commit is contained in:
Andrea Tartaglia
committed by
John R Barker
John R Barker
parent
90c092a104
commit
36a790dcde
@@ -1,16 +1,16 @@
|
||||
---
|
||||
- name: Generate privatekey
|
||||
- name: (Assertonly, {{select_crypto_backend}}) - Generate privatekey
|
||||
openssl_privatekey:
|
||||
path: '{{ output_dir }}/privatekey.pem'
|
||||
|
||||
- name: Generate privatekey with password
|
||||
- name: (Assertonly, {{select_crypto_backend}}) - Generate privatekey with password
|
||||
openssl_privatekey:
|
||||
path: '{{ output_dir }}/privatekeypw.pem'
|
||||
passphrase: hunter2
|
||||
cipher: auto
|
||||
select_crypto_backend: cryptography
|
||||
|
||||
- name: Generate CSR (no extensions)
|
||||
- name: (Assertonly, {{select_crypto_backend}}) - Generate CSR (no extensions)
|
||||
openssl_csr:
|
||||
path: '{{ output_dir }}/csr_noext.csr'
|
||||
privatekey_path: '{{ output_dir }}/privatekey.pem'
|
||||
@@ -18,38 +18,42 @@
|
||||
commonName: www.example.com
|
||||
useCommonNameForSAN: no
|
||||
|
||||
- name: Generate selfsigned certificate (no extensions)
|
||||
- name: (Assertonly, {{select_crypto_backend}}) - Generate selfsigned certificate (no extensions)
|
||||
openssl_certificate:
|
||||
path: '{{ output_dir }}/cert_noext.pem'
|
||||
csr_path: '{{ output_dir }}/csr_noext.csr'
|
||||
privatekey_path: '{{ output_dir }}/privatekey.pem'
|
||||
provider: selfsigned
|
||||
selfsigned_digest: sha256
|
||||
select_crypto_backend: '{{ select_crypto_backend }}'
|
||||
|
||||
- name: Assert that subject_alt_name is there (should fail)
|
||||
- name: (Assertonly, {{select_crypto_backend}}) - Assert that subject_alt_name is there (should fail)
|
||||
openssl_certificate:
|
||||
path: '{{ output_dir }}/cert_noext.pem'
|
||||
provider: assertonly
|
||||
subject_alt_name:
|
||||
- "DNS:example.com"
|
||||
select_crypto_backend: '{{ select_crypto_backend }}'
|
||||
ignore_errors: yes
|
||||
register: extension_missing_san
|
||||
|
||||
- name: Assert that key_usage is there (should fail)
|
||||
- name: (Assertonly, {{select_crypto_backend}}) - Assert that key_usage is there (should fail)
|
||||
openssl_certificate:
|
||||
path: '{{ output_dir }}/cert_noext.pem'
|
||||
provider: assertonly
|
||||
key_usage:
|
||||
- digitalSignature
|
||||
select_crypto_backend: '{{ select_crypto_backend }}'
|
||||
ignore_errors: yes
|
||||
register: extension_missing_ku
|
||||
|
||||
- name: Assert that extended_key_usage is there (should fail)
|
||||
- name: (Assertonly, {{select_crypto_backend}}) - Assert that extended_key_usage is there (should fail)
|
||||
openssl_certificate:
|
||||
path: '{{ output_dir }}/cert_noext.pem'
|
||||
provider: assertonly
|
||||
extended_key_usage:
|
||||
- biometricInfo
|
||||
select_crypto_backend: '{{ select_crypto_backend }}'
|
||||
ignore_errors: yes
|
||||
register: extension_missing_eku
|
||||
|
||||
@@ -62,33 +66,36 @@
|
||||
- extension_missing_eku is failed
|
||||
- "'Found no extendedKeyUsage extension' in extension_missing_eku.msg"
|
||||
|
||||
- name: Check private key passphrase fail 1
|
||||
- name: (Assertonly, {{select_crypto_backend}}) - Check private key passphrase fail 1
|
||||
openssl_certificate:
|
||||
path: '{{ output_dir }}/cert_noext.pem'
|
||||
privatekey_path: '{{ output_dir }}/privatekey.pem'
|
||||
privatekey_passphrase: hunter2
|
||||
provider: assertonly
|
||||
select_crypto_backend: '{{ select_crypto_backend }}'
|
||||
ignore_errors: yes
|
||||
register: passphrase_error_1
|
||||
|
||||
- name: Check private key passphrase fail 2
|
||||
- name: (Assertonly, {{select_crypto_backend}}) - Check private key passphrase fail 2
|
||||
openssl_certificate:
|
||||
path: '{{ output_dir }}/cert_noext.pem'
|
||||
privatekey_path: '{{ output_dir }}/privatekeypw.pem'
|
||||
privatekey_passphrase: wrong_password
|
||||
provider: assertonly
|
||||
select_crypto_backend: '{{ select_crypto_backend }}'
|
||||
ignore_errors: yes
|
||||
register: passphrase_error_2
|
||||
|
||||
- name: Check private key passphrase fail 3
|
||||
- name: (Assertonly, {{select_crypto_backend}}) - Check private key passphrase fail 3
|
||||
openssl_certificate:
|
||||
path: '{{ output_dir }}/cert_noext.pem'
|
||||
privatekey_path: '{{ output_dir }}/privatekeypw.pem'
|
||||
provider: assertonly
|
||||
select_crypto_backend: '{{ select_crypto_backend }}'
|
||||
ignore_errors: yes
|
||||
register: passphrase_error_3
|
||||
|
||||
- name:
|
||||
- name: (Assertonly, {{select_crypto_backend}}) -
|
||||
assert:
|
||||
that:
|
||||
- passphrase_error_1 is failed
|
||||
|
||||
@@ -1,16 +1,16 @@
|
||||
---
|
||||
- name: Generate privatekey
|
||||
- name: (Expired, {{select_crypto_backend}}) Generate privatekey
|
||||
openssl_privatekey:
|
||||
path: '{{ output_dir }}/has_expired_privatekey.pem'
|
||||
|
||||
- name: Generate CSR
|
||||
- name: (Expired, {{select_crypto_backend}}) Generate CSR
|
||||
openssl_csr:
|
||||
path: '{{ output_dir }}/has_expired_csr.csr'
|
||||
privatekey_path: '{{ output_dir }}/has_expired_privatekey.pem'
|
||||
subject:
|
||||
commonName: www.example.com
|
||||
|
||||
- name: Generate expired selfsigned certificate
|
||||
- name: (Expired, {{select_crypto_backend}}) Generate expired selfsigned certificate
|
||||
openssl_certificate:
|
||||
path: '{{ output_dir }}/has_expired_cert.pem'
|
||||
csr_path: '{{ output_dir }}/has_expired_csr.csr'
|
||||
@@ -18,22 +18,31 @@
|
||||
provider: selfsigned
|
||||
selfsigned_digest: sha256
|
||||
selfsigned_not_after: "-1s"
|
||||
selfsigned_not_before: "-100s"
|
||||
select_crypto_backend: '{{ select_crypto_backend }}'
|
||||
when: select_crypto_backend == 'pyopenssl' # cryptography won't allow creating expired certificates
|
||||
|
||||
- name: "Check task fails because cert is expired (has_expired: false)"
|
||||
- name: (Expired, {{select_crypto_backend}}) Generate expired selfsigned certificate
|
||||
command: "openssl x509 -req -days -1 -in {{ output_dir }}/has_expired_csr.csr -signkey {{ output_dir }}/has_expired_privatekey.pem -out {{ output_dir }}/has_expired_cert.pem"
|
||||
when: select_crypto_backend == 'cryptography' # So we create it with 'command'
|
||||
|
||||
- name: "(Expired) Check task fails because cert is expired (has_expired: false)"
|
||||
openssl_certificate:
|
||||
provider: assertonly
|
||||
path: "{{ output_dir }}/has_expired_cert.pem"
|
||||
has_expired: false
|
||||
select_crypto_backend: '{{ select_crypto_backend }}'
|
||||
ignore_errors: true
|
||||
register: expired_cert_check
|
||||
|
||||
- name: Ensure previous task failed
|
||||
- name: (Expired, {{select_crypto_backend}}) Ensure previous task failed
|
||||
assert:
|
||||
that: expired_cert_check is failed
|
||||
|
||||
- name: "Check expired cert check is ignored (has_expired: true)"
|
||||
- name: "(Expired) Check expired cert check is ignored (has_expired: true)"
|
||||
openssl_certificate:
|
||||
provider: assertonly
|
||||
path: "{{ output_dir }}/has_expired_cert.pem"
|
||||
has_expired: true
|
||||
select_crypto_backend: '{{ select_crypto_backend }}'
|
||||
register: expired_cert_skip
|
||||
|
||||
@@ -0,0 +1,7 @@
|
||||
---
|
||||
- debug:
|
||||
msg: "Executing tests with backend {{ select_crypto_backend }}"
|
||||
- import_tasks: assertonly.yml
|
||||
- import_tasks: expired.yml
|
||||
- import_tasks: selfsigned.yml
|
||||
- import_tasks: ownca.yml
|
||||
@@ -1,12 +1,22 @@
|
||||
---
|
||||
- block:
|
||||
|
||||
- import_tasks: assertonly.yml
|
||||
|
||||
- import_tasks: expired.yml
|
||||
|
||||
- import_tasks: selfsigned.yml
|
||||
|
||||
- import_tasks: ownca.yml
|
||||
|
||||
- name: Running tests with pyOpenSSL backend
|
||||
include_tasks: impl.yml
|
||||
vars:
|
||||
select_crypto_backend: pyopenssl
|
||||
when: pyopenssl_version.stdout is version('0.15', '>=')
|
||||
|
||||
- name: Remove output directory
|
||||
file:
|
||||
path: "{{ output_dir }}"
|
||||
state: absent
|
||||
|
||||
- name: Re-create output directory
|
||||
file:
|
||||
path: "{{ output_dir }}"
|
||||
state: directory
|
||||
|
||||
- name: Running tests with cryptography backend
|
||||
include_tasks: impl.yml
|
||||
vars:
|
||||
select_crypto_backend: cryptography
|
||||
when: cryptography_version.stdout is version('1.6', '>=')
|
||||
|
||||
@@ -1,9 +1,9 @@
|
||||
---
|
||||
- name: Generate CA privatekey
|
||||
- name: (OwnCA, {{select_crypto_backend}}) Generate CA privatekey
|
||||
openssl_privatekey:
|
||||
path: '{{ output_dir }}/ca_privatekey.pem'
|
||||
|
||||
- name: Generate CA CSR
|
||||
- name: (OwnCA, {{select_crypto_backend}}) Generate CA CSR
|
||||
openssl_csr:
|
||||
path: '{{ output_dir }}/ca_csr.csr'
|
||||
privatekey_path: '{{ output_dir }}/ca_privatekey.pem'
|
||||
@@ -14,15 +14,16 @@
|
||||
- 'CA:TRUE'
|
||||
basic_constraints_critical: yes
|
||||
|
||||
- name: Generate selfsigned CA certificate
|
||||
- name: (OwnCA, {{select_crypto_backend}}) Generate selfsigned CA certificate
|
||||
openssl_certificate:
|
||||
path: '{{ output_dir }}/ca_cert.pem'
|
||||
csr_path: '{{ output_dir }}/ca_csr.csr'
|
||||
privatekey_path: '{{ output_dir }}/ca_privatekey.pem'
|
||||
provider: selfsigned
|
||||
selfsigned_digest: sha256
|
||||
select_crypto_backend: '{{ select_crypto_backend }}'
|
||||
|
||||
- name: Generate ownca certificate
|
||||
- name: (OwnCA, {{select_crypto_backend}}) Generate ownca certificate
|
||||
openssl_certificate:
|
||||
path: '{{ output_dir }}/ownca_cert.pem'
|
||||
csr_path: '{{ output_dir }}/csr.csr'
|
||||
@@ -31,9 +32,10 @@
|
||||
ownca_privatekey_path: '{{ output_dir }}/ca_privatekey.pem'
|
||||
provider: ownca
|
||||
ownca_digest: sha256
|
||||
select_crypto_backend: '{{ select_crypto_backend }}'
|
||||
register: ownca_certificate
|
||||
|
||||
- name: Generate ownca certificate
|
||||
- name: (OwnCA, {{select_crypto_backend}}) Generate ownca certificate
|
||||
openssl_certificate:
|
||||
path: '{{ output_dir }}/ownca_cert.pem'
|
||||
csr_path: '{{ output_dir }}/csr.csr'
|
||||
@@ -42,9 +44,10 @@
|
||||
ownca_privatekey_path: '{{ output_dir }}/ca_privatekey.pem'
|
||||
provider: ownca
|
||||
ownca_digest: sha256
|
||||
select_crypto_backend: '{{ select_crypto_backend }}'
|
||||
register: ownca_certificate_idempotence
|
||||
|
||||
- name: Generate ownca certificate (check mode)
|
||||
- name: (OwnCA, {{select_crypto_backend}}) Generate ownca certificate (check mode)
|
||||
openssl_certificate:
|
||||
path: '{{ output_dir }}/ownca_cert.pem'
|
||||
csr_path: '{{ output_dir }}/csr.csr'
|
||||
@@ -53,9 +56,10 @@
|
||||
ownca_privatekey_path: '{{ output_dir }}/ca_privatekey.pem'
|
||||
provider: ownca
|
||||
ownca_digest: sha256
|
||||
select_crypto_backend: '{{ select_crypto_backend }}'
|
||||
check_mode: yes
|
||||
|
||||
- name: Check ownca certificate
|
||||
- name: (OwnCA, {{select_crypto_backend}}) Check ownca certificate
|
||||
openssl_certificate:
|
||||
path: '{{ output_dir }}/ownca_cert.pem'
|
||||
privatekey_path: '{{ output_dir }}/privatekey.pem'
|
||||
@@ -69,8 +73,9 @@
|
||||
commonName: www.example.com
|
||||
issuer:
|
||||
commonName: Example CA
|
||||
select_crypto_backend: '{{ select_crypto_backend }}'
|
||||
|
||||
- name: Generate ownca v2 certificate
|
||||
- name: (OwnCA, {{select_crypto_backend}}) Generate ownca v2 certificate
|
||||
openssl_certificate:
|
||||
path: '{{ output_dir }}/ownca_cert_v2.pem'
|
||||
csr_path: '{{ output_dir }}/csr.csr'
|
||||
@@ -80,8 +85,11 @@
|
||||
provider: ownca
|
||||
ownca_digest: sha256
|
||||
ownca_version: 2
|
||||
select_crypto_backend: '{{ select_crypto_backend }}'
|
||||
register: ownca_v2_certificate
|
||||
ignore_errors: true
|
||||
|
||||
- name: Generate ownca certificate2
|
||||
- name: (OwnCA, {{select_crypto_backend}}) Generate ownca certificate2
|
||||
openssl_certificate:
|
||||
path: '{{ output_dir }}/ownca_cert2.pem'
|
||||
csr_path: '{{ output_dir }}/csr2.csr'
|
||||
@@ -90,8 +98,9 @@
|
||||
ownca_privatekey_path: '{{ output_dir }}/ca_privatekey.pem'
|
||||
provider: ownca
|
||||
ownca_digest: sha256
|
||||
select_crypto_backend: '{{ select_crypto_backend }}'
|
||||
|
||||
- name: Check ownca certificate2
|
||||
- name: (OwnCA, {{select_crypto_backend}}) Check ownca certificate2
|
||||
openssl_certificate:
|
||||
path: '{{ output_dir }}/ownca_cert2.pem'
|
||||
privatekey_path: '{{ output_dir }}/privatekey2.pem'
|
||||
@@ -117,8 +126,9 @@
|
||||
- biometricInfo
|
||||
issuer:
|
||||
commonName: Example CA
|
||||
select_crypto_backend: '{{ select_crypto_backend }}'
|
||||
|
||||
- name: Create ownca certificate with notBefore and notAfter
|
||||
- name: (OwnCA, {{select_crypto_backend}}) Create ownca certificate with notBefore and notAfter
|
||||
openssl_certificate:
|
||||
provider: ownca
|
||||
ownca_not_before: 20181023133742Z
|
||||
@@ -128,8 +138,9 @@
|
||||
privatekey_path: "{{ output_dir }}/privatekey3.pem"
|
||||
ownca_path: '{{ output_dir }}/ca_cert.pem'
|
||||
ownca_privatekey_path: '{{ output_dir }}/ca_privatekey.pem'
|
||||
select_crypto_backend: '{{ select_crypto_backend }}'
|
||||
|
||||
- name: Create ownca certificate with relative notBefore and notAfter
|
||||
- name: (OwnCA, {{select_crypto_backend}}) Create ownca certificate with relative notBefore and notAfter
|
||||
openssl_certificate:
|
||||
provider: ownca
|
||||
ownca_not_before: +1s
|
||||
@@ -139,8 +150,9 @@
|
||||
privatekey_path: "{{ output_dir }}/privatekey3.pem"
|
||||
ownca_path: '{{ output_dir }}/ca_cert.pem'
|
||||
ownca_privatekey_path: '{{ output_dir }}/ca_privatekey.pem'
|
||||
select_crypto_backend: '{{ select_crypto_backend }}'
|
||||
|
||||
- name: Generate ownca ECC certificate
|
||||
- name: (OwnCA, {{select_crypto_backend}}) Generate ownca ECC certificate
|
||||
openssl_certificate:
|
||||
path: '{{ output_dir }}/ownca_cert_ecc.pem'
|
||||
csr_path: '{{ output_dir }}/csr_ecc.csr'
|
||||
@@ -149,9 +161,10 @@
|
||||
ownca_privatekey_path: '{{ output_dir }}/ca_privatekey.pem'
|
||||
provider: ownca
|
||||
ownca_digest: sha256
|
||||
select_crypto_backend: '{{ select_crypto_backend }}'
|
||||
register: ownca_certificate_ecc
|
||||
|
||||
- name: Generate ownca certificate (failed passphrase 1)
|
||||
- name: (OwnCA, {{select_crypto_backend}}) Generate ownca certificate (failed passphrase 1)
|
||||
openssl_certificate:
|
||||
path: '{{ output_dir }}/ownca_cert_pw1.pem'
|
||||
csr_path: '{{ output_dir }}/csr_ecc.csr'
|
||||
@@ -160,10 +173,11 @@
|
||||
ownca_privatekey_passphrase: hunter2
|
||||
provider: ownca
|
||||
ownca_digest: sha256
|
||||
select_crypto_backend: '{{ select_crypto_backend }}'
|
||||
ignore_errors: yes
|
||||
register: passphrase_error_1
|
||||
|
||||
- name: Generate ownca certificate (failed passphrase 2)
|
||||
- name: (OwnCA, {{select_crypto_backend}}) Generate ownca certificate (failed passphrase 2)
|
||||
openssl_certificate:
|
||||
path: '{{ output_dir }}/ownca_cert_pw1.pem'
|
||||
csr_path: '{{ output_dir }}/csr_ecc.csr'
|
||||
@@ -172,10 +186,11 @@
|
||||
ownca_privatekey_passphrase: wrong_password
|
||||
provider: ownca
|
||||
ownca_digest: sha256
|
||||
select_crypto_backend: '{{ select_crypto_backend }}'
|
||||
ignore_errors: yes
|
||||
register: passphrase_error_2
|
||||
|
||||
- name: Generate ownca certificate (failed passphrase 3)
|
||||
- name: (OwnCA, {{select_crypto_backend}}) Generate ownca certificate (failed passphrase 3)
|
||||
openssl_certificate:
|
||||
path: '{{ output_dir }}/ownca_cert_pw3.pem'
|
||||
csr_path: '{{ output_dir }}/csr_ecc.csr'
|
||||
@@ -183,6 +198,7 @@
|
||||
ownca_privatekey_path: '{{ output_dir }}/privatekeypw.pem'
|
||||
provider: ownca
|
||||
ownca_digest: sha256
|
||||
select_crypto_backend: '{{ select_crypto_backend }}'
|
||||
ignore_errors: yes
|
||||
register: passphrase_error_3
|
||||
|
||||
|
||||
@@ -1,50 +1,53 @@
|
||||
---
|
||||
- name: Generate privatekey
|
||||
- name: (Selfsigned, {{select_crypto_backend}}) Generate privatekey
|
||||
openssl_privatekey:
|
||||
path: '{{ output_dir }}/privatekey.pem'
|
||||
|
||||
- name: Generate privatekey with password
|
||||
- name: (Selfsigned, {{select_crypto_backend}}) Generate privatekey with password
|
||||
openssl_privatekey:
|
||||
path: '{{ output_dir }}/privatekeypw.pem'
|
||||
passphrase: hunter2
|
||||
cipher: auto
|
||||
select_crypto_backend: cryptography
|
||||
|
||||
- name: Generate CSR
|
||||
- name: (Selfsigned, {{select_crypto_backend}}) Generate CSR
|
||||
openssl_csr:
|
||||
path: '{{ output_dir }}/csr.csr'
|
||||
privatekey_path: '{{ output_dir }}/privatekey.pem'
|
||||
subject:
|
||||
commonName: www.example.com
|
||||
|
||||
- name: Generate selfsigned certificate
|
||||
- name: (Selfsigned, {{select_crypto_backend}}) Generate selfsigned certificate
|
||||
openssl_certificate:
|
||||
path: '{{ output_dir }}/cert.pem'
|
||||
csr_path: '{{ output_dir }}/csr.csr'
|
||||
privatekey_path: '{{ output_dir }}/privatekey.pem'
|
||||
provider: selfsigned
|
||||
selfsigned_digest: sha256
|
||||
select_crypto_backend: '{{ select_crypto_backend }}'
|
||||
register: selfsigned_certificate
|
||||
|
||||
- name: Generate selfsigned certificate
|
||||
- name: (Selfsigned, {{select_crypto_backend}}) Generate selfsigned certificate - idempotency
|
||||
openssl_certificate:
|
||||
path: '{{ output_dir }}/cert.pem'
|
||||
csr_path: '{{ output_dir }}/csr.csr'
|
||||
privatekey_path: '{{ output_dir }}/privatekey.pem'
|
||||
provider: selfsigned
|
||||
selfsigned_digest: sha256
|
||||
select_crypto_backend: '{{ select_crypto_backend }}'
|
||||
register: selfsigned_certificate_idempotence
|
||||
|
||||
- name: Generate selfsigned certificate (check mode)
|
||||
- name: (Selfsigned, {{select_crypto_backend}}) Generate selfsigned certificate (check mode)
|
||||
openssl_certificate:
|
||||
path: '{{ output_dir }}/cert.pem'
|
||||
csr_path: '{{ output_dir }}/csr.csr'
|
||||
privatekey_path: '{{ output_dir }}/privatekey.pem'
|
||||
provider: selfsigned
|
||||
selfsigned_digest: sha256
|
||||
select_crypto_backend: '{{ select_crypto_backend }}'
|
||||
check_mode: yes
|
||||
|
||||
- name: Check selfsigned certificate
|
||||
- name: (Selfsigned, {{select_crypto_backend}}) Check selfsigned certificate
|
||||
openssl_certificate:
|
||||
path: '{{ output_dir }}/cert.pem'
|
||||
privatekey_path: '{{ output_dir }}/privatekey.pem'
|
||||
@@ -56,8 +59,9 @@
|
||||
- sha256WithECDSAEncryption
|
||||
subject:
|
||||
commonName: www.example.com
|
||||
select_crypto_backend: '{{ select_crypto_backend }}'
|
||||
|
||||
- name: Generate selfsigned v2 certificate
|
||||
- name: (Selfsigned, {{select_crypto_backend}}) Generate selfsigned v2 certificate
|
||||
openssl_certificate:
|
||||
path: '{{ output_dir }}/cert_v2.pem'
|
||||
csr_path: '{{ output_dir }}/csr.csr'
|
||||
@@ -65,12 +69,15 @@
|
||||
provider: selfsigned
|
||||
selfsigned_digest: sha256
|
||||
selfsigned_version: 2
|
||||
select_crypto_backend: "{{ select_crypto_backend }}"
|
||||
register: selfsigned_v2_cert
|
||||
ignore_errors: true
|
||||
|
||||
- name: Generate privatekey2
|
||||
- name: (Selfsigned, {{select_crypto_backend}}) Generate privatekey2
|
||||
openssl_privatekey:
|
||||
path: '{{ output_dir }}/privatekey2.pem'
|
||||
|
||||
- name: Generate CSR2
|
||||
- name: (Selfsigned, {{select_crypto_backend}}) Generate CSR2
|
||||
openssl_csr:
|
||||
subject:
|
||||
CN: www.example.com
|
||||
@@ -89,15 +96,16 @@
|
||||
- ipsecUser
|
||||
- biometricInfo
|
||||
|
||||
- name: Generate selfsigned certificate2
|
||||
- name: (Selfsigned, {{select_crypto_backend}}) Generate selfsigned certificate2
|
||||
openssl_certificate:
|
||||
path: '{{ output_dir }}/cert2.pem'
|
||||
csr_path: '{{ output_dir }}/csr2.csr'
|
||||
privatekey_path: '{{ output_dir }}/privatekey2.pem'
|
||||
provider: selfsigned
|
||||
selfsigned_digest: sha256
|
||||
select_crypto_backend: '{{ select_crypto_backend }}'
|
||||
|
||||
- name: Check selfsigned certificate2
|
||||
- name: (Selfsigned, {{select_crypto_backend}}) Check selfsigned certificate2
|
||||
openssl_certificate:
|
||||
path: '{{ output_dir }}/cert2.pem'
|
||||
privatekey_path: '{{ output_dir }}/privatekey2.pem'
|
||||
@@ -121,19 +129,20 @@
|
||||
extendedKeyUsage:
|
||||
- ipsecUser
|
||||
- biometricInfo
|
||||
select_crypto_backend: '{{ select_crypto_backend }}'
|
||||
|
||||
- name: Create private key 3
|
||||
- name: (Selfsigned, {{select_crypto_backend}}) Create private key 3
|
||||
openssl_privatekey:
|
||||
path: "{{ output_dir }}/privatekey3.pem"
|
||||
|
||||
- name: Create CSR 3
|
||||
- name: (Selfsigned, {{select_crypto_backend}}) Create CSR 3
|
||||
openssl_csr:
|
||||
subject:
|
||||
CN: www.example.com
|
||||
privatekey_path: "{{ output_dir }}/privatekey3.pem"
|
||||
path: "{{ output_dir }}/csr3.pem"
|
||||
|
||||
- name: Create certificate3 with notBefore and notAfter
|
||||
|
||||
- name: (Selfsigned, {{select_crypto_backend}}) Create certificate3 with notBefore and notAfter
|
||||
openssl_certificate:
|
||||
provider: selfsigned
|
||||
selfsigned_not_before: 20181023133742Z
|
||||
@@ -141,30 +150,33 @@
|
||||
path: "{{ output_dir }}/cert3.pem"
|
||||
csr_path: "{{ output_dir }}/csr3.pem"
|
||||
privatekey_path: "{{ output_dir }}/privatekey3.pem"
|
||||
select_crypto_backend: '{{ select_crypto_backend }}'
|
||||
|
||||
- name: Generate privatekey
|
||||
- name: (Selfsigned, {{select_crypto_backend}}) Generate privatekey
|
||||
openssl_privatekey:
|
||||
path: '{{ output_dir }}/privatekey_ecc.pem'
|
||||
type: ECC
|
||||
curve: secp256k1
|
||||
curve: "{{ (ansible_distribution == 'CentOS' and ansible_distribution_major_version == '6') | ternary('secp521r1', 'secp256k1') }}"
|
||||
# ^ cryptography on CentOS6 doesn't support secp256k1, so we use secp521r1 instead
|
||||
|
||||
- name: Generate CSR
|
||||
- name: (Selfsigned, {{select_crypto_backend}}) Generate CSR
|
||||
openssl_csr:
|
||||
path: '{{ output_dir }}/csr_ecc.csr'
|
||||
privatekey_path: '{{ output_dir }}/privatekey_ecc.pem'
|
||||
subject:
|
||||
commonName: www.example.com
|
||||
|
||||
- name: Generate selfsigned certificate
|
||||
- name: (Selfsigned, {{select_crypto_backend}}) Generate selfsigned certificate
|
||||
openssl_certificate:
|
||||
path: '{{ output_dir }}/cert_ecc.pem'
|
||||
csr_path: '{{ output_dir }}/csr_ecc.csr'
|
||||
privatekey_path: '{{ output_dir }}/privatekey_ecc.pem'
|
||||
provider: selfsigned
|
||||
selfsigned_digest: sha256
|
||||
select_crypto_backend: '{{ select_crypto_backend }}'
|
||||
register: selfsigned_certificate_ecc
|
||||
|
||||
- name: Generate selfsigned certificate (failed passphrase 1)
|
||||
- name: (Selfsigned, {{select_crypto_backend}}) Generate selfsigned certificate (failed passphrase 1)
|
||||
openssl_certificate:
|
||||
path: '{{ output_dir }}/cert_pw1.pem'
|
||||
csr_path: '{{ output_dir }}/csr_ecc.csr'
|
||||
@@ -172,10 +184,11 @@
|
||||
privatekey_passphrase: hunter2
|
||||
provider: selfsigned
|
||||
selfsigned_digest: sha256
|
||||
select_crypto_backend: '{{ select_crypto_backend }}'
|
||||
ignore_errors: yes
|
||||
register: passphrase_error_1
|
||||
|
||||
- name: Generate selfsigned certificate (failed passphrase 2)
|
||||
- name: (Selfsigned, {{select_crypto_backend}}) Generate selfsigned certificate (failed passphrase 2)
|
||||
openssl_certificate:
|
||||
path: '{{ output_dir }}/cert_pw2.pem'
|
||||
csr_path: '{{ output_dir }}/csr_ecc.csr'
|
||||
@@ -183,16 +196,18 @@
|
||||
privatekey_passphrase: wrong_password
|
||||
provider: selfsigned
|
||||
selfsigned_digest: sha256
|
||||
select_crypto_backend: '{{ select_crypto_backend }}'
|
||||
ignore_errors: yes
|
||||
register: passphrase_error_2
|
||||
|
||||
- name: Generate selfsigned certificate (failed passphrase 3)
|
||||
- name: (Selfsigned, {{select_crypto_backend}}) Generate selfsigned certificate (failed passphrase 3)
|
||||
openssl_certificate:
|
||||
path: '{{ output_dir }}/cert_pw3.pem'
|
||||
csr_path: '{{ output_dir }}/csr_ecc.csr'
|
||||
privatekey_path: '{{ output_dir }}/privatekeypw.pem'
|
||||
provider: selfsigned
|
||||
selfsigned_digest: sha256
|
||||
select_crypto_backend: '{{ select_crypto_backend }}'
|
||||
ignore_errors: yes
|
||||
register: passphrase_error_3
|
||||
|
||||
|
||||
@@ -1,21 +1,21 @@
|
||||
---
|
||||
- name: Validate ownca certificate (test - verify CA)
|
||||
- name: (OwnCA validation, {{select_crypto_backend}}) Validate ownca certificate (test - verify CA)
|
||||
shell: 'openssl verify -CAfile {{ output_dir }}/ca_cert.pem {{ output_dir }}/ownca_cert.pem | sed "s/.*: \(.*\)/\1/g"'
|
||||
register: ownca_verify_ca
|
||||
|
||||
- name: Validate ownca certificate (test - ownca certificate modulus)
|
||||
- name: (OwnCA validation, {{select_crypto_backend}}) Validate ownca certificate (test - ownca certificate modulus)
|
||||
shell: 'openssl x509 -noout -modulus -in {{ output_dir }}/ownca_cert.pem'
|
||||
register: ownca_cert_modulus
|
||||
|
||||
- name: Validate ownca certificate (test - ownca issuer value)
|
||||
- name: (OwnCA validation, {{select_crypto_backend}}) Validate ownca certificate (test - ownca issuer value)
|
||||
shell: 'openssl x509 -noout -in {{ output_dir}}/ownca_cert.pem -text | grep "Issuer" | sed "s/.*: \(.*\)/\1/g"'
|
||||
register: ownca_cert_issuer
|
||||
|
||||
- name: Validate ownca certificate (test - ownca certficate version == default == 3)
|
||||
- name: (OwnCA validation, {{select_crypto_backend}}) Validate ownca certificate (test - ownca certficate version == default == 3)
|
||||
shell: 'openssl x509 -noout -in {{ output_dir}}/ownca_cert.pem -text | grep "Version" | sed "s/.*: \(.*\) .*/\1/g"'
|
||||
register: ownca_cert_version
|
||||
|
||||
- name: Validate ownca certificate (assert)
|
||||
- name: (OwnCA validation, {{select_crypto_backend}}) Validate ownca certificate (assert)
|
||||
assert:
|
||||
that:
|
||||
- ownca_verify_ca.stdout == 'OK'
|
||||
@@ -24,65 +24,75 @@
|
||||
# openssl 1.1.x adds a space between the output
|
||||
- ownca_cert_issuer.stdout in ['CN=Example CA', 'CN = Example CA']
|
||||
|
||||
- name: Validate ownca certificate idempotence
|
||||
- name: (OwnCA validation, {{select_crypto_backend}}) Validate ownca certificate idempotence
|
||||
assert:
|
||||
that:
|
||||
- ownca_certificate.serial_number == ownca_certificate_idempotence.serial_number
|
||||
- ownca_certificate.notBefore == ownca_certificate_idempotence.notBefore
|
||||
- ownca_certificate.notAfter == ownca_certificate_idempotence.notAfter
|
||||
|
||||
- name: Validate ownca certificate v2 (test - ownca certificate version == 2)
|
||||
shell: 'openssl x509 -noout -in {{ output_dir}}/ownca_cert_v2.pem -text | grep "Version" | sed "s/.*: \(.*\) .*/\1/g"'
|
||||
register: ownca_cert_v2_version
|
||||
- block:
|
||||
- name: (OwnCA validation, {{select_crypto_backend}}) Validate ownca certificate v2 (test - ownca certificate version == 2)
|
||||
shell: 'openssl x509 -noout -in {{ output_dir}}/ownca_cert_v2.pem -text | grep "Version" | sed "s/.*: \(.*\) .*/\1/g"'
|
||||
register: ownca_cert_v2_version
|
||||
|
||||
- name: Validate ownca certificate version 2 (assert)
|
||||
- name: (OwnCA validation, {{select_crypto_backend}}) Validate ownca certificate version 2 (assert)
|
||||
assert:
|
||||
that:
|
||||
- ownca_cert_v2_version.stdout == '2'
|
||||
when: "select_crypto_backend != 'cryptography'"
|
||||
|
||||
- name: (OwnCA validation, {{select_crypto_backend}}) Validate ownca certificate v2 (test - ownca certificate version == 2)
|
||||
assert:
|
||||
that:
|
||||
- ownca_cert_v2_version.stdout == '2'
|
||||
- ownca_v2_certificate is failed
|
||||
- "'The cryptography backend does not support v2 certificates' in ownca_v2_certificate.msg"
|
||||
when: "select_crypto_backend == 'cryptography'"
|
||||
|
||||
- name: Validate ownca certificate2 (test - ownca certificate modulus)
|
||||
|
||||
- name: (OwnCA validation, {{select_crypto_backend}}) Validate ownca certificate2 (test - ownca certificate modulus)
|
||||
shell: 'openssl x509 -noout -modulus -in {{ output_dir }}/ownca_cert2.pem'
|
||||
register: ownca_cert2_modulus
|
||||
|
||||
- name: Validate ownca certificate2 (assert)
|
||||
- name: (OwnCA validation, {{select_crypto_backend}}) Validate ownca certificate2 (assert)
|
||||
assert:
|
||||
that:
|
||||
- ownca_cert2_modulus.stdout == privatekey2_modulus.stdout
|
||||
|
||||
- name: Validate owncal certificate3 (test - notBefore)
|
||||
- name: (OwnCA validation, {{select_crypto_backend}}) Validate owncal certificate3 (test - notBefore)
|
||||
shell: 'openssl x509 -noout -in {{ output_dir }}/ownca_cert3.pem -text | grep "Not Before" | sed "s/.*: \(.*\) .*/\1/g"'
|
||||
register: ownca_cert3_notBefore
|
||||
|
||||
- name: Validate ownca certificate3 (test - notAfter)
|
||||
- name: (OwnCA validation, {{select_crypto_backend}}) Validate ownca certificate3 (test - notAfter)
|
||||
shell: 'openssl x509 -noout -in {{ output_dir }}/ownca_cert3.pem -text | grep "Not After" | sed "s/.*: \(.*\) .*/\1/g"'
|
||||
register: ownca_cert3_notAfter
|
||||
|
||||
- name: Validate ownca certificate3 (assert - notBefore)
|
||||
- name: (OwnCA validation, {{select_crypto_backend}}) Validate ownca certificate3 (assert - notBefore)
|
||||
assert:
|
||||
that:
|
||||
- ownca_cert3_notBefore.stdout == 'Oct 23 13:37:42 2018'
|
||||
|
||||
- name: Validate ownca certificate3 (assert - notAfter)
|
||||
- name: (OwnCA validation, {{select_crypto_backend}}) Validate ownca certificate3 (assert - notAfter)
|
||||
assert:
|
||||
that:
|
||||
- ownca_cert3_notAfter.stdout == 'Oct 23 13:37:42 2019'
|
||||
|
||||
- name: Validate ownca ECC certificate (test - ownca certificate pubkey)
|
||||
- name: (OwnCA validation, {{select_crypto_backend}}) Validate ownca ECC certificate (test - ownca certificate pubkey)
|
||||
shell: 'openssl x509 -noout -pubkey -in {{ output_dir }}/ownca_cert_ecc.pem'
|
||||
register: ownca_cert_ecc_pubkey
|
||||
|
||||
- name: Validate ownca ECC certificate (test - ownca issuer value)
|
||||
- name: (OwnCA validation, {{select_crypto_backend}}) Validate ownca ECC certificate (test - ownca issuer value)
|
||||
shell: 'openssl x509 -noout -in {{ output_dir}}/ownca_cert_ecc.pem -text | grep "Issuer" | sed "s/.*: \(.*\)/\1/g"'
|
||||
register: ownca_cert_ecc_issuer
|
||||
|
||||
- name: Validate ownca ECC certificate (assert)
|
||||
- name: (OwnCA validation, {{select_crypto_backend}}) Validate ownca ECC certificate (assert)
|
||||
assert:
|
||||
that:
|
||||
- ownca_cert_ecc_pubkey.stdout == privatekey_ecc_pubkey.stdout
|
||||
# openssl 1.1.x adds a space between the output
|
||||
- ownca_cert_ecc_issuer.stdout in ['CN=Example CA', 'CN = Example CA']
|
||||
|
||||
- name:
|
||||
- name: (OwnCA validation, {{select_crypto_backend}})
|
||||
assert:
|
||||
that:
|
||||
- passphrase_error_1 is failed
|
||||
|
||||
@@ -1,89 +1,99 @@
|
||||
---
|
||||
- name: Validate certificate (test - privatekey modulus)
|
||||
- name: (Selfsigned validation, {{select_crypto_backend}}) Validate certificate (test - privatekey modulus)
|
||||
shell: 'openssl rsa -noout -modulus -in {{ output_dir }}/privatekey.pem'
|
||||
register: privatekey_modulus
|
||||
|
||||
- name: Validate certificate (test - certificate modulus)
|
||||
- name: (Selfsigned validation, {{select_crypto_backend}}) Validate certificate (test - certificate modulus)
|
||||
shell: 'openssl x509 -noout -modulus -in {{ output_dir }}/cert.pem'
|
||||
register: cert_modulus
|
||||
|
||||
- name: Validate certificate (test - issuer value)
|
||||
- name: (Selfsigned validation, {{select_crypto_backend}}) Validate certificate (test - issuer value)
|
||||
shell: 'openssl x509 -noout -in {{ output_dir}}/cert.pem -text | grep "Issuer" | sed "s/.*: \(.*\)/\1/g; s/ //g;"'
|
||||
register: cert_issuer
|
||||
|
||||
|
||||
- name: Validate certificate (test - certficate version == default == 3)
|
||||
- name: (Selfsigned validation, {{select_crypto_backend}}) Validate certificate (test - certficate version == default == 3)
|
||||
shell: 'openssl x509 -noout -in {{ output_dir}}/cert.pem -text | grep "Version" | sed "s/.*: \(.*\) .*/\1/g"'
|
||||
register: cert_version
|
||||
|
||||
- name: Validate certificate (assert)
|
||||
- name: (Selfsigned validation, {{select_crypto_backend}}) Validate certificate (assert)
|
||||
assert:
|
||||
that:
|
||||
- cert_modulus.stdout == privatekey_modulus.stdout
|
||||
- cert_version.stdout == '3'
|
||||
- cert_issuer.stdout == 'CN=www.example.com'
|
||||
|
||||
- name: Validate certificate idempotence
|
||||
- name: (Selfsigned validation, {{select_crypto_backend}}) Validate certificate idempotence
|
||||
assert:
|
||||
that:
|
||||
- selfsigned_certificate.serial_number == selfsigned_certificate_idempotence.serial_number
|
||||
- selfsigned_certificate.notBefore == selfsigned_certificate_idempotence.notBefore
|
||||
- selfsigned_certificate.notAfter == selfsigned_certificate_idempotence.notAfter
|
||||
|
||||
- name: Validate certificate v2 (test - certificate version == 2)
|
||||
shell: 'openssl x509 -noout -in {{ output_dir}}/cert_v2.pem -text | grep "Version" | sed "s/.*: \(.*\) .*/\1/g"'
|
||||
register: cert_v2_version
|
||||
- block:
|
||||
- name: (Selfsigned validation, {{select_crypto_backend}}) Validate certificate v2 (test - certificate version == 2)
|
||||
shell: 'openssl x509 -noout -in {{ output_dir}}/cert_v2.pem -text | grep "Version" | sed "s/.*: \(.*\) .*/\1/g"'
|
||||
register: cert_v2_version
|
||||
|
||||
- name: Validate certificate version 2 (assert)
|
||||
assert:
|
||||
that:
|
||||
- cert_v2_version.stdout == '2'
|
||||
- name: (Selfsigned validation, {{select_crypto_backend}}) Validate certificate version 2 (assert)
|
||||
assert:
|
||||
that:
|
||||
- cert_v2_version.stdout == '2'
|
||||
when: select_crypto_backend != 'cryptography'
|
||||
|
||||
- name: Validate certificate2 (test - privatekey modulus)
|
||||
- block:
|
||||
- name: (Selfsigned validateion, {{ select_crypto_backend }} Validate certificate v2 is failed
|
||||
assert:
|
||||
that:
|
||||
- selfsigned_v2_cert is failed
|
||||
- "'The cryptography backend does not support v2 certificates' in selfsigned_v2_cert.msg"
|
||||
when: select_crypto_backend == 'cryptography'
|
||||
|
||||
- name: (Selfsigned validation, {{select_crypto_backend}}) Validate certificate2 (test - privatekey modulus)
|
||||
shell: 'openssl rsa -noout -modulus -in {{ output_dir }}/privatekey2.pem'
|
||||
register: privatekey2_modulus
|
||||
|
||||
- name: Validate certificate2 (test - certificate modulus)
|
||||
- name: (Selfsigned validation, {{select_crypto_backend}}) Validate certificate2 (test - certificate modulus)
|
||||
shell: 'openssl x509 -noout -modulus -in {{ output_dir }}/cert2.pem'
|
||||
register: cert2_modulus
|
||||
|
||||
- name: Validate certificate2 (assert)
|
||||
- name: (Selfsigned validation, {{select_crypto_backend}}) Validate certificate2 (assert)
|
||||
assert:
|
||||
that:
|
||||
- cert2_modulus.stdout == privatekey2_modulus.stdout
|
||||
|
||||
- name: Validate certificate3 (test - notBefore)
|
||||
- name: (Selfsigned validation, {{select_crypto_backend}}) Validate certificate3 (test - notBefore)
|
||||
shell: 'openssl x509 -noout -in {{ output_dir }}/cert3.pem -text | grep "Not Before" | sed "s/.*: \(.*\) .*/\1/g"'
|
||||
register: cert3_notBefore
|
||||
|
||||
- name: Validate certificate3 (test - notAfter)
|
||||
- name: (Selfsigned validation, {{select_crypto_backend}}) Validate certificate3 (test - notAfter)
|
||||
shell: 'openssl x509 -noout -in {{ output_dir }}/cert3.pem -text | grep "Not After" | sed "s/.*: \(.*\) .*/\1/g"'
|
||||
register: cert3_notAfter
|
||||
|
||||
- name: Validate certificate3 (assert - notBefore)
|
||||
- name: (Selfsigned validation, {{select_crypto_backend}}) Validate certificate3 (assert - notBefore)
|
||||
assert:
|
||||
that:
|
||||
- cert3_notBefore.stdout == 'Oct 23 13:37:42 2018'
|
||||
|
||||
- name: Validate certificate3 (assert - notAfter)
|
||||
- name: (Selfsigned validation, {{select_crypto_backend}}) Validate certificate3 (assert - notAfter)
|
||||
assert:
|
||||
that:
|
||||
- cert3_notAfter.stdout == 'Oct 23 13:37:42 2019'
|
||||
|
||||
- name: Validate ECC certificate (test - privatekey's pubkey)
|
||||
- name: (Selfsigned validation, {{select_crypto_backend}}) Validate ECC certificate (test - privatekey's pubkey)
|
||||
shell: 'openssl ec -pubout -in {{ output_dir }}/privatekey_ecc.pem'
|
||||
register: privatekey_ecc_pubkey
|
||||
|
||||
- name: Validate ECC certificate (test - certificate pubkey)
|
||||
- name: (Selfsigned validation, {{select_crypto_backend}}) Validate ECC certificate (test - certificate pubkey)
|
||||
shell: 'openssl x509 -noout -pubkey -in {{ output_dir }}/cert_ecc.pem'
|
||||
register: cert_ecc_pubkey
|
||||
|
||||
- name: Validate ECC certificate (assert)
|
||||
- name: (Selfsigned validation, {{select_crypto_backend}}) Validate ECC certificate (assert)
|
||||
assert:
|
||||
that:
|
||||
- cert_ecc_pubkey.stdout == privatekey_ecc_pubkey.stdout
|
||||
|
||||
- name:
|
||||
- name: (Selfsigned validation, {{select_crypto_backend}})
|
||||
assert:
|
||||
that:
|
||||
- passphrase_error_1 is failed
|
||||
|
||||
Reference in New Issue
Block a user