---
- name : fail with invalid store location
win_certificate_store :
state : present
path : '{{win_cert_dir}}\subj-cert.pem'
store_location : FakeLocation
register : fail_fake_location
failed_when : "fail_fake_location.msg != 'value of store_location must be one of: CurrentUser, LocalMachine. Got no match for: FakeLocation'"
- name : fail with invalid store name
win_certificate_store :
state : present
path : '{{win_cert_dir}}\subj-cert.pem'
store_name : FakeName
register : fail_fake_name
failed_when : "fail_fake_name.msg != 'value of store_name must be one of: AddressBook, AuthRoot, CertificateAuthority, Disallowed, My, Root, TrustedPeople, TrustedPublisher. Got no match for: FakeName'"
- name : fail when state=present and no path is set
win_certificate_store :
state : present
register : fail_present_no_path
failed_when : "fail_present_no_path.msg != 'state is present but all of the following are missing: path'"
- name : fail when state=exported and no path is set
win_certificate_store :
state : exported
thumbprint : ABC
register : fail_export_no_path
failed_when : "fail_export_no_path.msg != 'state is exported but all of the following are missing: path'"
- name : fail when state=exported and no thumbprint is set
win_certificate_store :
state : exported
path : '{{win_cert_dir}}'
register : fail_export_no_thumbprint
failed_when : "fail_export_no_thumbprint.msg != 'state is exported but all of the following are missing: thumbprint'"
- name : fail to export thumbprint when path is a dir
win_certificate_store :
state : exported
thumbprint : '{{subj_thumbprint}}'
path : '{{win_cert_dir}}'
register : fail_export_path_is_dir
failed_when : fail_export_path_is_dir.msg != "Cannot export cert to path '" + win_cert_dir + "' as it is a directory"
- name : fail when state=absent and not path or thumbprint is set
win_certificate_store :
state : absent
register : fail_absent_no_path_or_thumbprint
failed_when : "fail_absent_no_path_or_thumbprint.msg != 'state is absent but any of the following are missing: path, thumbprint'"
- name : import pem certificate (check)
win_certificate_store :
path : '{{win_cert_dir}}\subj-cert.pem'
state : present
register : import_pem_check
check_mode : yes
- name : get result of import pem certificate (check)
win_shell : if (Get-ChildItem -Path Cert:\LocalMachine\My | Where-Object { $_.Thumbprint -eq "{{subj_thumbprint}}" }) { $true } else { $false }
register : import_pem_result_check
- name : assert results of import pem certificate (check)
assert :
that :
- import_pem_check is changed
- import_pem_check.thumbprints == [subj_thumbprint]
- import_pem_result_check.stdout_lines[0] == "False"
- name : import pem certificate
win_certificate_store :
path : '{{win_cert_dir}}\subj-cert.pem'
state : present
register : import_pem
- name : get result of import pem certificate
win_shell : if (Get-ChildItem -Path Cert:\LocalMachine\My | Where-Object { $_.Thumbprint -eq "{{subj_thumbprint}}" }) { $true } else { $false }
register : import_pem_result
- name : assert results of import pem certificate
assert :
that :
- import_pem is changed
- import_pem.thumbprints == [subj_thumbprint]
- import_pem_result.stdout_lines[0] == "True"
- name : import pem certificate (idempotent)
win_certificate_store :
path : '{{win_cert_dir}}\subj-cert.pem'
state : present
register : import_pem_again
- name : assert results of import pem certificate (idempotent)
assert :
that :
- not import_pem_again is changed
- name : remove certificate based on thumbprint (check)
win_certificate_store :
thumbprint : '{{subj_thumbprint}}'
state : absent
register : remove_thumbprint_check
check_mode : yes
- name : get result of remove certificate based on thumbprint (check)
win_shell : if (Get-ChildItem -Path Cert:\LocalMachine\My | Where-Object { $_.Thumbprint -eq "{{subj_thumbprint}}" }) { $true } else { $false }
register : remove_thumbprint_result_check
- name : assert results of remove certificate based on thumbprint (check)
assert :
that :
- remove_thumbprint_check is changed
- remove_thumbprint_check.thumbprints == [subj_thumbprint]
- remove_thumbprint_result_check.stdout_lines[0] == "True"
- name : remove certificate based on thumbprint
win_certificate_store :
thumbprint : '{{subj_thumbprint}}'
state : absent
register : remove_thumbprint
- name : get result of remove certificate based on thumbprint
win_shell : if (Get-ChildItem -Path Cert:\LocalMachine\My | Where-Object { $_.Thumbprint -eq "{{subj_thumbprint}}" }) { $true } else { $false }
register : remove_thumbprint_result
- name : assert results of remove certificate based on thumbprint
assert :
that :
- remove_thumbprint is changed
- remove_thumbprint.thumbprints == [subj_thumbprint]
- remove_thumbprint_result.stdout_lines[0] == "False"
- name : remove certificate based on thumbprint (idempotent)
win_certificate_store :
thumbprint : '{{subj_thumbprint}}'
state : absent
register : remove_thumbprint_again
- name : assert results of remove certificate based on thumbprint (idempotent)
assert :
that :
- not remove_thumbprint_again is changed
- name : import der certificate (check)
win_certificate_store :
path : '{{win_cert_dir}}\subj-cert.cer'
state : present
register : import_der_check
check_mode : yes
- name : get result of import der certificate (check)
win_shell : if (Get-ChildItem -Path Cert:\LocalMachine\My | Where-Object { $_.Thumbprint -eq "{{subj_thumbprint}}" }) { $true } else { $false }
register : import_der_result_check
- name : assert results of import der certificate (check)
assert :
that :
- import_der_check is changed
- import_der_check.thumbprints == [subj_thumbprint]
- import_der_result_check.stdout_lines[0] == "False"
- name : import der certificate
win_certificate_store :
path : '{{win_cert_dir}}\subj-cert.cer'
state : present
register : import_der
- name : get result of import der certificate
win_shell : if (Get-ChildItem -Path Cert:\LocalMachine\My | Where-Object { $_.Thumbprint -eq "{{subj_thumbprint}}" }) { $true } else { $false }
register : import_der_result
- name : assert results of import der certificate
assert :
that :
- import_der is changed
- import_der.thumbprints == [subj_thumbprint]
- import_der_result.stdout_lines[0] == "True"
- name : import der certificate (idempotent)
win_certificate_store :
path : '{{win_cert_dir}}\subj-cert.cer'
state : present
register : import_der_again
- name : assert results of import der certificate (idempotent)
assert :
that :
- not import_der_again is changed
- name : remove certificate based on path (check)
win_certificate_store :
path : '{{win_cert_dir}}\subj-cert.cer'
state : absent
register : remove_path_check
check_mode : yes
- name : get result of remove certificate based on path (check)
win_shell : if (Get-ChildItem -Path Cert:\LocalMachine\My | Where-Object { $_.Thumbprint -eq "{{subj_thumbprint}}" }) { $true } else { $false }
register : remove_path_result_check
- name : assert results of remove certificate based on path (check)
assert :
that :
- remove_path_check is changed
- remove_path_check.thumbprints == [subj_thumbprint]
- remove_path_result_check.stdout_lines[0] == "True"
- name : remove certificate based on path
win_certificate_store :
path : '{{win_cert_dir}}\subj-cert.cer'
state : absent
register : remove_path
- name : get result of remove certificate based on path
win_shell : if (Get-ChildItem -Path Cert:\LocalMachine\My | Where-Object { $_.Thumbprint -eq "{{subj_thumbprint}}" }) { $true } else { $false }
register : remove_path_result
- name : assert results of remove certificate based on path
assert :
that :
- remove_path is changed
- remove_path.thumbprints == [subj_thumbprint]
- remove_path_result.stdout_lines[0] == "False"
- name : remove certificate based on path (idempotent)
win_certificate_store :
path : '{{win_cert_dir}}\subj-cert.cer'
state : absent
register : remove_path_again
- name : assert results of remove certificate based on path (idempotent)
assert :
that :
- not remove_path_again is changed
- name : import PEM encoded p7b chain (check)
win_certificate_store :
path : '{{win_cert_dir}}\chain.pem'
state : present
register : import_pem_p7b_check
check_mode : yes
- name : get result of subj in p7b chain (check)
win_shell : if (Get-ChildItem -Path Cert:\LocalMachine\My | Where-Object { $_.Thumbprint -eq "{{subj_thumbprint}}" }) { $true } else { $false }
register : import_pem_p7b_subj_result_check
- name : get result of root in p7b chain (check)
win_shell : if (Get-ChildItem -Path Cert:\LocalMachine\My | Where-Object { $_.Thumbprint -eq "{{root_thumbprint}}" }) { $true } else { $false }
register : import_pem_p7b_root_result_check
- name : assert results of import PEM encoded p7b chain (check)
assert :
that :
- import_pem_p7b_check is changed
- import_pem_p7b_check.thumbprints|count == 2
- subj_thumbprint in import_pem_p7b_check.thumbprints
- root_thumbprint in import_pem_p7b_check.thumbprints
- import_pem_p7b_subj_result_check.stdout_lines[0] == "False"
- import_pem_p7b_root_result_check.stdout_lines[0] == "False"
- name : import PEM encoded p7b chain
win_certificate_store :
path : '{{win_cert_dir}}\chain.pem'
state : present
register : import_pem_p7b
- name : get result of subj in p7b chain
win_shell : if (Get-ChildItem -Path Cert:\LocalMachine\My | Where-Object { $_.Thumbprint -eq "{{subj_thumbprint}}" }) { $true } else { $false }
register : import_pem_p7b_subj_result
- name : get result of root in p7b chain
win_shell : if (Get-ChildItem -Path Cert:\LocalMachine\My | Where-Object { $_.Thumbprint -eq "{{root_thumbprint}}" }) { $true } else { $false }
register : import_pem_p7b_root_result
- name : assert results of import PEM encoded p7b chain
assert :
that :
- import_pem_p7b is changed
- import_pem_p7b.thumbprints|count == 2
- subj_thumbprint in import_pem_p7b.thumbprints
- root_thumbprint in import_pem_p7b.thumbprints
- import_pem_p7b_subj_result.stdout_lines[0] == "True"
- import_pem_p7b_root_result.stdout_lines[0] == "True"
- name : import PEM encoded p7b chain (idempotent)
win_certificate_store :
path : '{{win_cert_dir}}\chain.pem'
state : present
register : import_pem_p7b_again
- name : assert results of import PEM encoded p7b chain (idempotent)
assert :
that :
- not import_pem_p7b_again is changed
- name : remove p7b chain certs
win_certificate_store :
thumbprint : '{{item}}'
state : absent
with_items :
- '{{subj_thumbprint}}'
- '{{root_thumbprint}}'
- name : import DER encoded p7b chain into custom store (check)
win_certificate_store :
path : '{{win_cert_dir}}\chain.p7b'
state : present
store_name : TrustedPeople
store_location : CurrentUser
register : import_der_p7b_check
check_mode : yes
- name : get result of subj in p7b chain in custom store (check)
win_shell : if (Get-ChildItem -Path Cert:\CurrentUser\TrustedPeople | Where-Object { $_.Thumbprint -eq "{{subj_thumbprint}}" }) { $true } else { $false }
register : import_der_p7b_subj_result_check
- name : get result of root in p7b chain in custom store (check)
win_shell : if (Get-ChildItem -Path Cert:\CurrentUser\TrustedPeople | Where-Object { $_.Thumbprint -eq "{{root_thumbprint}}" }) { $true } else { $false }
register : import_der_p7b_root_result_check
- name : assert results of import DER encoded p7b chain into custom store (check)
assert :
that :
- import_der_p7b_check is changed
- import_der_p7b_check.thumbprints|count == 2
- subj_thumbprint in import_der_p7b_check.thumbprints
- root_thumbprint in import_der_p7b_check.thumbprints
- import_der_p7b_subj_result_check.stdout_lines[0] == "False"
- import_der_p7b_root_result_check.stdout_lines[0] == "False"
- name : import DER encoded p7b chain into custom store
win_certificate_store :
path : '{{win_cert_dir}}\chain.p7b'
state : present
store_name : TrustedPeople
store_location : CurrentUser
register : import_der_p7b
- name : get result of subj in p7b chain in custom store
win_shell : if (Get-ChildItem -Path Cert:\CurrentUser\TrustedPeople | Where-Object { $_.Thumbprint -eq "{{subj_thumbprint}}" }) { $true } else { $false }
register : import_der_p7b_subj_result
- name : get result of root in p7b chain in custom store
win_shell : if (Get-ChildItem -Path Cert:\CurrentUser\TrustedPeople | Where-Object { $_.Thumbprint -eq "{{root_thumbprint}}" }) { $true } else { $false }
register : import_der_p7b_root_result
- name : assert results of import DER encoded p7b chain into custom store
assert :
that :
- import_der_p7b is changed
- import_der_p7b.thumbprints|count == 2
- subj_thumbprint in import_der_p7b.thumbprints
- root_thumbprint in import_der_p7b.thumbprints
- import_der_p7b_root_result.stdout_lines[0] == "True"
- import_der_p7b_root_result.stdout_lines[0] == "True"
- name : import DER encoded p7b chain into custom store (idempotent)
win_certificate_store :
path : '{{win_cert_dir}}\chain.p7b'
state : present
store_name : TrustedPeople
store_location : CurrentUser
register : import_der_p7b_again
- name : assert results of import DER encoded p7b chain into custom store (idempotent)
assert :
that :
- not import_der_p7b_again is changed
- name : remove p7b chain certs from custom store
win_certificate_store :
thumbprint : '{{item}}'
state : absent
store_name : TrustedPeople
store_location : CurrentUser
with_items :
- '{{subj_thumbprint}}'
- '{{root_thumbprint}}'
- name : import pfx without password and non exportable (check)
win_certificate_store :
path : '{{win_cert_dir}}\subj-cert-without-pass.pfx'
state : present
key_exportable : no
vars : &become_vars
ansible_become : yes
ansible_become_method : runas
ansible_become_user : '{{ansible_user}}'
ansible_become_pass : '{{ansible_password}}'
register : import_pfx_without_pass_check
check_mode : yes
- name : get results of import pfx without password and non exportable (check)
win_shell : if (Get-ChildItem -Path Cert:\LocalMachine\My | Where-Object { $_.Thumbprint -eq "{{subj_thumbprint}}" }) { $true } else { $false }
register : import_pfx_without_pass_result_check
- name : assert results of import pfx without password and non exportable (check)
assert :
that :
- import_pfx_without_pass_check is changed
- import_pfx_without_pass_check.thumbprints == [subj_thumbprint]
- import_pfx_without_pass_result_check.stdout_lines[0] == "False"
- name : import pfx without password and non exportable
win_certificate_store :
path : '{{win_cert_dir}}\subj-cert-without-pass.pfx'
state : present
key_exportable : no
vars : *become_vars
register : import_pfx_without_pass
- name : get results of import pfx without password and non exportable
win_shell : (Get-ChildItem -Path Cert:\LocalMachine\My | Where-Object { $_.Thumbprint -eq "{{subj_thumbprint}}" }).PrivateKey.CspKeyContainerInfo.Exportable
vars : *become_vars
register : import_pfx_without_pass_result
- name : assert results of import pfx without password and non exportable
assert :
that :
- import_pfx_without_pass is changed
- import_pfx_without_pass.thumbprints == [subj_thumbprint]
- import_pfx_without_pass_result.stdout_lines[0] == "False"
- name : import pfx without password and non exportable (idempotent)
win_certificate_store :
path : '{{win_cert_dir}}\subj-cert-without-pass.pfx'
state : present
key_exportable : no
vars : *become_vars
register : import_pfx_without_pass_again
- name : assert results of import pfx without password and non exportable (idempotent)
assert :
that :
- not import_pfx_without_pass_again is changed
- name : fail import pfx with password and none set
win_certificate_store :
path : '{{win_cert_dir}}\subj-cert-with-pass.pfx'
state : present
store_location : CurrentUser
store_name : TrustedPeople
register : fail_import_pfx_with_password
failed_when : "'Failed to load cert from file' not in fail_import_pfx_with_password.msg and 'The specified network password is not correct' not in fail_import_pfx_with_password.msg"
- name : import pfx with password (check)
win_certificate_store :
path : '{{win_cert_dir}}\subj-cert-with-pass.pfx'
state : present
password : '{{key_password}}'
store_location : CurrentUser
store_name : TrustedPeople
register : import_pfx_with_pass_check
vars : *become_vars
check_mode : yes
- name : get results of import pfx with password (check)
win_shell : if (Get-ChildItem -Path Cert:\CurrentUser\TrustedPeople | Where-Object { $_.Thumbprint -eq "{{subj_thumbprint}}" }) { $true } else { $false }
register : import_pfx_with_pass_result_check
- name : assert results of import pfx with password (check)
assert :
that :
- import_pfx_with_pass_check is changed
- import_pfx_with_pass_check.thumbprints == [subj_thumbprint]
- import_pfx_with_pass_result_check.stdout_lines[0] == "False"
- name : import pfx with password
win_certificate_store :
path : '{{win_cert_dir}}\subj-cert-with-pass.pfx'
state : present
password : '{{key_password}}'
store_location : CurrentUser
store_name : TrustedPeople
vars : *become_vars
register : import_pfx_with_pass
- name : get results of import pfx with password
win_shell : (Get-ChildItem -Path Cert:\CurrentUser\TrustedPeople | Where-Object { $_.Thumbprint -eq "{{subj_thumbprint}}" }).PrivateKey.CspKeyContainerInfo.Exportable
vars : *become_vars
register : import_pfx_with_pass_result
- name : assert results of import pfx with password
assert :
that :
- import_pfx_with_pass is changed
- import_pfx_with_pass.thumbprints == [subj_thumbprint]
- import_pfx_with_pass_result.stdout_lines[0] == "True"
- name : import pfx with password (idempotent)
win_certificate_store :
path : '{{win_cert_dir}}\subj-cert-with-pass.pfx'
state : present
password : '{{key_password}}'
store_location : CurrentUser
store_name : TrustedPeople
vars : *become_vars
register : import_pfx_with_pass_again
- name : assert results of import pfx with password (idempotent)
assert :
that :
- not import_pfx_with_pass_again is changed
- name : import root cert for export tests
win_certificate_store :
path : '{{win_cert_dir}}\root-cert.pem'
state : present
- name : export cert as pem (check)
win_certificate_store :
path : '{{win_cert_dir}}\exported\cert.pem'
thumbprint : '{{subj_thumbprint}}'
state : exported
file_type : pem
register : export_pem_check
check_mode : yes
- name : get result of export cert as pem (check)
win_stat :
path : '{{win_cert_dir}}\exported\cert.pem'
register : export_pem_result_check
- name : assert results of export cert as pem (check)
assert :
that :
- export_pem_check is changed
- export_pem_check.thumbprints == [subj_thumbprint]
- export_pem_result_check.stat.exists == False
- name : export cert as pem
win_certificate_store :
path : '{{win_cert_dir}}\exported\cert.pem'
thumbprint : '{{subj_thumbprint}}'
state : exported
file_type : pem
register : export_pem
- name : get result of export cert as pem
win_stat :
path : '{{win_cert_dir}}\exported\cert.pem'
register : export_pem_result
- name : assert results of export cert as pem
assert :
that :
- export_pem is changed
- export_pem.thumbprints == [subj_thumbprint]
- export_pem_result.stat.checksum == '1ebf5467d18230e9f611940a74d12f1d0bc819b7'
- name : export cert as pem (idempotent)
win_certificate_store :
path : '{{win_cert_dir}}\exported\cert.pem'
thumbprint : '{{subj_thumbprint}}'
state : exported
file_type : pem
register : export_pem_again
- name : assert results of export cert as pem
assert :
that :
- not export_pem_again is changed
- name : export cert as der (check)
win_certificate_store :
path : '{{win_cert_dir}}\exported\cert.cer'
thumbprint : '{{subj_thumbprint}}'
state : exported
file_type : der
register : export_der_check
check_mode : yes
- name : get result of export cert as der (check)
win_stat :
path : '{{win_cert_dir}}\exported\cert.cer'
register : export_der_result_check
- name : assert results of export cert as der (check)
assert :
that :
- export_der_check is changed
- export_der_check.thumbprints == [subj_thumbprint]
- export_der_result_check.stat.exists == False
- name : export cert as der
win_certificate_store :
path : '{{win_cert_dir}}\exported\cert.cer'
thumbprint : '{{subj_thumbprint}}'
state : exported
file_type : der
register : export_der
- name : get result of export cert as der
win_stat :
path : '{{win_cert_dir}}\exported\cert.cer'
register : export_der_result
- name : assert results of export cert as der
assert :
that :
- export_der is changed
- export_der.thumbprints == [subj_thumbprint]
- export_der_result.stat.checksum == 'bd7af104cf1872bdb518d95c9534ea941665fd27'
- name : export cert as der (idempotent)
win_certificate_store :
path : '{{win_cert_dir}}\exported\cert.cer'
thumbprint : '{{subj_thumbprint}}'
state : exported
file_type : der
register : export_der_again
- name : assert results of export cert as der
assert :
that :
- not export_der_again is changed
- name : export cert as der replacing pem
win_certificate_store :
path : '{{win_cert_dir}}\exported\cert.pem'
thumbprint : '{{subj_thumbprint}}'
state : exported
file_type : der
register : export_der_over_pem
- name : get result of export cert as der replacing pem
win_stat :
path : '{{win_cert_dir}}\exported\cert.pem'
register : export_der_over_pem_result
- name : assert results of export cert as der replacing pem
assert :
that :
- export_der_over_pem is changed
- export_der_over_pem.thumbprints == [subj_thumbprint]
- export_der_over_pem_result.stat.checksum == 'bd7af104cf1872bdb518d95c9534ea941665fd27'
- name : export cert as pem replacing der
win_certificate_store :
path : '{{win_cert_dir}}\exported\cert.cer'
thumbprint : '{{subj_thumbprint}}'
state : exported
file_type : pem
register : export_pem_over_der
- name : get result of export cert as pem replacing der
win_stat :
path : '{{win_cert_dir}}\exported\cert.cer'
register : export_pem_over_der_result
- name : assert results of export cert as pem replacing der
assert :
that :
- export_pem_over_der is changed
- export_pem_over_der.thumbprints == [subj_thumbprint]
- export_pem_over_der_result.stat.checksum == '1ebf5467d18230e9f611940a74d12f1d0bc819b7'
- name : export cert with key and password as pfx (check)
win_certificate_store :
path : '{{win_cert_dir}}\exported\cert-pass.pfx'
thumbprint : '{{subj_thumbprint}}'
state : exported
file_type : pkcs12
store_location : CurrentUser
store_name : TrustedPeople
password : '{{key_password}}'
register : export_pfx_with_pass_check
vars : *become_vars
check_mode : yes
- name : get result of export cert with key and password as pfx (check)
win_stat :
path : '{{win_cert_dir}}\exported\cert-pass.pfx'
register : export_pfx_with_pass_result_check
- name : assert results of export cert with key and password as pfx (check)
assert :
that :
- export_pfx_with_pass_check is changed
- export_pfx_with_pass_check.thumbprints == [subj_thumbprint]
- export_pfx_with_pass_result_check.stat.exists == False
- name : export cert with key and password as pfx
win_certificate_store :
path : '{{win_cert_dir}}\exported\cert-pass.pfx'
thumbprint : '{{subj_thumbprint}}'
state : exported
file_type : pkcs12
store_location : CurrentUser
store_name : TrustedPeople
password : '{{key_password}}'
vars : *become_vars
register : export_pfx_with_pass
- name : get result of export cert with key and password as pfx
win_shell : |
$cert = New-Object -TypeName System.Security.Cryptography.X509Certificates.X509Certificate2
$cert.Import("{{win_cert_dir}}\exported\cert-pass.pfx", "{{key_password}}", 0)
$cert.HasPrivateKey
vars : *become_vars
register : export_pfx_with_pass_result
- name : assert results of export cert with key and password as pfx
assert :
that :
- export_pfx_with_pass is changed
- export_pfx_with_pass.thumbprints == [subj_thumbprint]
- export_pfx_with_pass_result.stdout_lines[0] == "True"
- name : export cert with key and password as pfx (idempotent)
win_certificate_store :
path : '{{win_cert_dir}}\exported\cert-pass.pfx'
thumbprint : '{{subj_thumbprint}}'
state : exported
file_type : pkcs12
store_location : CurrentUser
store_name : TrustedPeople
password : '{{key_password}}'
vars : *become_vars
register : export_pfx_with_pass_again
- name : assert results of export cert with key and password as pfx (idempotent)
assert :
that :
- not export_pfx_with_pass_again is changed
- name : export cert with key without password as pfx (check)
win_certificate_store :
path : '{{win_cert_dir}}\exported\cert-without-pass.pfx'
thumbprint : '{{subj_thumbprint}}'
state : exported
file_type : pkcs12
store_location : CurrentUser
store_name : TrustedPeople
vars : *become_vars
register : export_pfx_without_pass_check
check_mode : yes
- name : get result of export cert with key without password as pfx (check)
win_stat :
path : '{{win_cert_dir}}\exported\cert-without-pass.pfx'
register : export_pfx_without_pass_result_check
- name : assert results of export cert with key without password as pfx (check)
assert :
that :
- export_pfx_without_pass_check is changed
- export_pfx_without_pass_check.thumbprints == [subj_thumbprint]
- export_pfx_without_pass_result_check.stat.exists == False
- name : export cert with key without password as pfx
win_certificate_store :
path : '{{win_cert_dir}}\exported\cert-without-pass.pfx'
thumbprint : '{{subj_thumbprint}}'
state : exported
file_type : pkcs12
store_location : CurrentUser
store_name : TrustedPeople
vars : *become_vars
register : export_pfx_without_pass
- name : get result of export cert with key without password as pfx
win_shell : |
$cert = New-Object -TypeName System.Security.Cryptography.X509Certificates.X509Certificate2
$cert.Import("{{win_cert_dir}}\exported\cert-without-pass.pfx", $null, 0)
$cert.HasPrivateKey
vars : *become_vars
register : export_pfx_without_pass_result
- name : assert results of export cert with key without password as pfx
assert :
that :
- export_pfx_without_pass is changed
- export_pfx_without_pass.thumbprints == [subj_thumbprint]
- export_pfx_without_pass_result.stdout_lines[0] == "True"
- name : export cert with key without password as pfx (idempotent)
win_certificate_store :
path : '{{win_cert_dir}}\exported\cert-without-pass.pfx'
thumbprint : '{{subj_thumbprint}}'
state : exported
file_type : pkcs12
store_location : CurrentUser
store_name : TrustedPeople
vars : *become_vars
register : export_pfx_without_pass_again
- name : assert results of export cert with key without password as pfx (idempotent)
assert :
that :
- not export_pfx_without_pass_again is changed
- name : fail to export cert with key as pfx when not marked as exportable
win_certificate_store :
path : '{{win_cert_dir}}\exported\cert-fail.pfx'
thumbprint : '{{subj_thumbprint}}'
state : exported
file_type : pkcs12
vars : *become_vars
register : fail_export_non_exportable
failed_when : fail_export_non_exportable.msg != 'Cannot export cert with key as PKCS12 when the key is not marked as exportable or not accessible by the current user'
