mirror of https://github.com/ansible/ansible.git
openssl_csr: Allow to use cryptography as backend (#50324)
* Allow to use cryptography as backend for openssl_csr. * Use different curve. * Adding changelog. Includes changelog fragment for #49416, which didn't include one.pull/50875/head
parent
644057e9ec
commit
409f8a15bd
@ -0,0 +1,3 @@
|
|||||||
|
minor_changes:
|
||||||
|
- "openssl_csr - now works with both PyOpenSSL and cryptography Python libraries. Autodetection can be overridden with ``select_crypto_backend`` option."
|
||||||
|
- "openssl_privatekey - now works with both PyOpenSSL and cryptography Python libraries. Autodetection can be overridden with ``select_crypto_backend`` option."
|
@ -0,0 +1,148 @@
|
|||||||
|
---
|
||||||
|
- name: Generate privatekey
|
||||||
|
openssl_privatekey:
|
||||||
|
path: '{{ output_dir }}/privatekey.pem'
|
||||||
|
|
||||||
|
- name: Generate CSR (check mode)
|
||||||
|
openssl_csr:
|
||||||
|
path: '{{ output_dir }}/csr.csr'
|
||||||
|
privatekey_path: '{{ output_dir }}/privatekey.pem'
|
||||||
|
subject:
|
||||||
|
commonName: www.ansible.com
|
||||||
|
select_crypto_backend: '{{ select_crypto_backend }}'
|
||||||
|
check_mode: yes
|
||||||
|
register: generate_csr_check
|
||||||
|
|
||||||
|
- name: Generate CSR
|
||||||
|
openssl_csr:
|
||||||
|
path: '{{ output_dir }}/csr.csr'
|
||||||
|
privatekey_path: '{{ output_dir }}/privatekey.pem'
|
||||||
|
subject:
|
||||||
|
commonName: www.ansible.com
|
||||||
|
select_crypto_backend: '{{ select_crypto_backend }}'
|
||||||
|
register: generate_csr
|
||||||
|
|
||||||
|
- name: Generate CSR (idempotent)
|
||||||
|
openssl_csr:
|
||||||
|
path: '{{ output_dir }}/csr.csr'
|
||||||
|
privatekey_path: '{{ output_dir }}/privatekey.pem'
|
||||||
|
subject:
|
||||||
|
commonName: www.ansible.com
|
||||||
|
select_crypto_backend: '{{ select_crypto_backend }}'
|
||||||
|
register: generate_csr_check_idempotent
|
||||||
|
|
||||||
|
- name: Generate CSR (idempotent, check mode)
|
||||||
|
openssl_csr:
|
||||||
|
path: '{{ output_dir }}/csr.csr'
|
||||||
|
privatekey_path: '{{ output_dir }}/privatekey.pem'
|
||||||
|
subject:
|
||||||
|
commonName: www.ansible.com
|
||||||
|
select_crypto_backend: '{{ select_crypto_backend }}'
|
||||||
|
check_mode: yes
|
||||||
|
register: generate_csr_check_idempotent_check
|
||||||
|
|
||||||
|
# keyUsage longname and shortname should be able to be used
|
||||||
|
# interchangeably. Hence the long name is specified here
|
||||||
|
# but the short name is used to test idempotency for ipsecuser
|
||||||
|
# and vice-versa for biometricInfo
|
||||||
|
- name: Generate CSR with KU and XKU
|
||||||
|
openssl_csr:
|
||||||
|
path: '{{ output_dir }}/csr_ku_xku.csr'
|
||||||
|
privatekey_path: '{{ output_dir }}/privatekey.pem'
|
||||||
|
subject:
|
||||||
|
CN: www.ansible.com
|
||||||
|
keyUsage:
|
||||||
|
- digitalSignature
|
||||||
|
- keyAgreement
|
||||||
|
extendedKeyUsage:
|
||||||
|
- qcStatements
|
||||||
|
- DVCS
|
||||||
|
- IPSec User
|
||||||
|
- biometricInfo
|
||||||
|
select_crypto_backend: '{{ select_crypto_backend }}'
|
||||||
|
|
||||||
|
- name: Generate CSR with KU and XKU (test idempotency)
|
||||||
|
openssl_csr:
|
||||||
|
path: '{{ output_dir }}/csr_ku_xku.csr'
|
||||||
|
privatekey_path: '{{ output_dir }}/privatekey.pem'
|
||||||
|
subject:
|
||||||
|
commonName: 'www.ansible.com'
|
||||||
|
keyUsage:
|
||||||
|
- Key Agreement
|
||||||
|
- digitalSignature
|
||||||
|
extendedKeyUsage:
|
||||||
|
- ipsecUser
|
||||||
|
- qcStatements
|
||||||
|
- DVCS
|
||||||
|
- Biometric Info
|
||||||
|
select_crypto_backend: '{{ select_crypto_backend }}'
|
||||||
|
register: csr_ku_xku
|
||||||
|
|
||||||
|
- name: Generate CSR with KU and XKU (test XKU change)
|
||||||
|
openssl_csr:
|
||||||
|
path: '{{ output_dir }}/csr_ku_xku.csr'
|
||||||
|
privatekey_path: '{{ output_dir }}/privatekey.pem'
|
||||||
|
subject:
|
||||||
|
commonName: 'www.ansible.com'
|
||||||
|
keyUsage:
|
||||||
|
- digitalSignature
|
||||||
|
- keyAgreement
|
||||||
|
extendedKeyUsage:
|
||||||
|
- ipsecUser
|
||||||
|
- qcStatements
|
||||||
|
- Biometric Info
|
||||||
|
select_crypto_backend: '{{ select_crypto_backend }}'
|
||||||
|
register: csr_ku_xku_change
|
||||||
|
|
||||||
|
- name: Generate CSR with KU and XKU (test KU change)
|
||||||
|
openssl_csr:
|
||||||
|
path: '{{ output_dir }}/csr_ku_xku.csr'
|
||||||
|
privatekey_path: '{{ output_dir }}/privatekey.pem'
|
||||||
|
subject:
|
||||||
|
commonName: 'www.ansible.com'
|
||||||
|
keyUsage:
|
||||||
|
- digitalSignature
|
||||||
|
extendedKeyUsage:
|
||||||
|
- ipsecUser
|
||||||
|
- qcStatements
|
||||||
|
- Biometric Info
|
||||||
|
select_crypto_backend: '{{ select_crypto_backend }}'
|
||||||
|
register: csr_ku_xku_change_2
|
||||||
|
|
||||||
|
- name: Generate CSR with old API
|
||||||
|
openssl_csr:
|
||||||
|
path: '{{ output_dir }}/csr_oldapi.csr'
|
||||||
|
privatekey_path: '{{ output_dir }}/privatekey.pem'
|
||||||
|
commonName: www.ansible.com
|
||||||
|
select_crypto_backend: '{{ select_crypto_backend }}'
|
||||||
|
|
||||||
|
- name: Generate CSR with OCSP Must Staple
|
||||||
|
openssl_csr:
|
||||||
|
path: '{{ output_dir }}/csr_ocsp.csr'
|
||||||
|
privatekey_path: '{{ output_dir }}/privatekey.pem'
|
||||||
|
subject_alt_name: "DNS:www.ansible.com"
|
||||||
|
ocsp_must_staple: true
|
||||||
|
select_crypto_backend: '{{ select_crypto_backend }}'
|
||||||
|
|
||||||
|
- name: Generate CSR with OCSP Must Staple (test idempotency)
|
||||||
|
openssl_csr:
|
||||||
|
path: '{{ output_dir }}/csr_ocsp.csr'
|
||||||
|
privatekey_path: '{{ output_dir }}/privatekey.pem'
|
||||||
|
subject_alt_name: "DNS:www.ansible.com"
|
||||||
|
ocsp_must_staple: true
|
||||||
|
select_crypto_backend: '{{ select_crypto_backend }}'
|
||||||
|
register: csr_ocsp_idempotency
|
||||||
|
|
||||||
|
- name: Generate ECC privatekey
|
||||||
|
openssl_privatekey:
|
||||||
|
path: '{{ output_dir }}/privatekey2.pem'
|
||||||
|
type: ECC
|
||||||
|
curve: secp384r1
|
||||||
|
|
||||||
|
- name: Generate CSR with ECC privatekey
|
||||||
|
openssl_csr:
|
||||||
|
path: '{{ output_dir }}/csr2.csr'
|
||||||
|
privatekey_path: '{{ output_dir }}/privatekey2.pem'
|
||||||
|
subject:
|
||||||
|
commonName: www.ansible.com
|
||||||
|
select_crypto_backend: '{{ select_crypto_backend }}'
|
@ -1,141 +1,30 @@
|
|||||||
---
|
---
|
||||||
- block:
|
- block:
|
||||||
- name: Generate privatekey
|
- name: Running tests with pyOpenSSL backend
|
||||||
openssl_privatekey:
|
include_tasks: impl.yml
|
||||||
path: '{{ output_dir }}/privatekey.pem'
|
vars:
|
||||||
|
select_crypto_backend: pyopenssl
|
||||||
|
|
||||||
- name: Generate CSR (check mode)
|
- import_tasks: ../tests/validate.yml
|
||||||
openssl_csr:
|
|
||||||
path: '{{ output_dir }}/csr.csr'
|
|
||||||
privatekey_path: '{{ output_dir }}/privatekey.pem'
|
|
||||||
subject:
|
|
||||||
commonName: www.ansible.com
|
|
||||||
check_mode: yes
|
|
||||||
register: generate_csr_check
|
|
||||||
|
|
||||||
- name: Generate CSR
|
|
||||||
openssl_csr:
|
|
||||||
path: '{{ output_dir }}/csr.csr'
|
|
||||||
privatekey_path: '{{ output_dir }}/privatekey.pem'
|
|
||||||
subject:
|
|
||||||
commonName: www.ansible.com
|
|
||||||
register: generate_csr
|
|
||||||
|
|
||||||
- name: Generate CSR (idempotent)
|
|
||||||
openssl_csr:
|
|
||||||
path: '{{ output_dir }}/csr.csr'
|
|
||||||
privatekey_path: '{{ output_dir }}/privatekey.pem'
|
|
||||||
subject:
|
|
||||||
commonName: www.ansible.com
|
|
||||||
register: generate_csr_check_idempotent
|
|
||||||
|
|
||||||
- name: Generate CSR (idempotent, check mode)
|
|
||||||
openssl_csr:
|
|
||||||
path: '{{ output_dir }}/csr.csr'
|
|
||||||
privatekey_path: '{{ output_dir }}/privatekey.pem'
|
|
||||||
subject:
|
|
||||||
commonName: www.ansible.com
|
|
||||||
check_mode: yes
|
|
||||||
register: generate_csr_check_idempotent_check
|
|
||||||
|
|
||||||
# keyUsage longname and shortname should be able to be used
|
|
||||||
# interchangeably. Hence the long name is specified here
|
|
||||||
# but the short name is used to test idempotency for ipsecuser
|
|
||||||
# and vice-versa for biometricInfo
|
|
||||||
- name: Generate CSR with KU and XKU
|
|
||||||
openssl_csr:
|
|
||||||
path: '{{ output_dir }}/csr_ku_xku.csr'
|
|
||||||
privatekey_path: '{{ output_dir }}/privatekey.pem'
|
|
||||||
subject:
|
|
||||||
CN: www.ansible.com
|
|
||||||
keyUsage:
|
|
||||||
- digitalSignature
|
|
||||||
- keyAgreement
|
|
||||||
extendedKeyUsage:
|
|
||||||
- qcStatements
|
|
||||||
- DVCS
|
|
||||||
- IPSec User
|
|
||||||
- biometricInfo
|
|
||||||
|
|
||||||
- name: Generate CSR with KU and XKU (test idempotency)
|
|
||||||
openssl_csr:
|
|
||||||
path: '{{ output_dir }}/csr_ku_xku.csr'
|
|
||||||
privatekey_path: '{{ output_dir }}/privatekey.pem'
|
|
||||||
subject:
|
|
||||||
commonName: 'www.ansible.com'
|
|
||||||
keyUsage:
|
|
||||||
- Key Agreement
|
|
||||||
- digitalSignature
|
|
||||||
extendedKeyUsage:
|
|
||||||
- ipsecUser
|
|
||||||
- qcStatements
|
|
||||||
- DVCS
|
|
||||||
- Biometric Info
|
|
||||||
register: csr_ku_xku
|
|
||||||
|
|
||||||
- name: Generate CSR with KU and XKU (test XKU change)
|
|
||||||
openssl_csr:
|
|
||||||
path: '{{ output_dir }}/csr_ku_xku.csr'
|
|
||||||
privatekey_path: '{{ output_dir }}/privatekey.pem'
|
|
||||||
subject:
|
|
||||||
commonName: 'www.ansible.com'
|
|
||||||
keyUsage:
|
|
||||||
- digitalSignature
|
|
||||||
- keyAgreement
|
|
||||||
extendedKeyUsage:
|
|
||||||
- ipsecUser
|
|
||||||
- qcStatements
|
|
||||||
- Biometric Info
|
|
||||||
register: csr_ku_xku_change
|
|
||||||
|
|
||||||
- name: Generate CSR with KU and XKU (test KU change)
|
|
||||||
openssl_csr:
|
|
||||||
path: '{{ output_dir }}/csr_ku_xku.csr'
|
|
||||||
privatekey_path: '{{ output_dir }}/privatekey.pem'
|
|
||||||
subject:
|
|
||||||
commonName: 'www.ansible.com'
|
|
||||||
keyUsage:
|
|
||||||
- digitalSignature
|
|
||||||
extendedKeyUsage:
|
|
||||||
- ipsecUser
|
|
||||||
- qcStatements
|
|
||||||
- Biometric Info
|
|
||||||
register: csr_ku_xku_change_2
|
|
||||||
|
|
||||||
- name: Generate CSR with old API
|
|
||||||
openssl_csr:
|
|
||||||
path: '{{ output_dir }}/csr_oldapi.csr'
|
|
||||||
privatekey_path: '{{ output_dir }}/privatekey.pem'
|
|
||||||
commonName: www.ansible.com
|
|
||||||
|
|
||||||
- name: Generate CSR with OCSP Must Staple
|
when: pyopenssl_version.stdout is version('0.15', '>=')
|
||||||
openssl_csr:
|
|
||||||
path: '{{ output_dir }}/csr_ocsp.csr'
|
|
||||||
privatekey_path: '{{ output_dir }}/privatekey.pem'
|
|
||||||
subject_alt_name: "DNS:www.ansible.com"
|
|
||||||
ocsp_must_staple: true
|
|
||||||
|
|
||||||
- name: Generate CSR with OCSP Must Staple (test idempotency)
|
- name: Remove output directory
|
||||||
openssl_csr:
|
file:
|
||||||
path: '{{ output_dir }}/csr_ocsp.csr'
|
path: "{{ output_dir }}"
|
||||||
privatekey_path: '{{ output_dir }}/privatekey.pem'
|
state: absent
|
||||||
subject_alt_name: "DNS:www.ansible.com"
|
|
||||||
ocsp_must_staple: true
|
|
||||||
register: csr_ocsp_idempotency
|
|
||||||
|
|
||||||
- name: Generate ECC privatekey
|
- name: Re-create output directory
|
||||||
openssl_privatekey:
|
file:
|
||||||
path: '{{ output_dir }}/privatekey2.pem'
|
path: "{{ output_dir }}"
|
||||||
type: ECC
|
state: directory
|
||||||
curve: secp256k1
|
|
||||||
|
|
||||||
- name: Generate CSR with ECC privatekey
|
- block:
|
||||||
openssl_csr:
|
- name: Running tests with cryptography backend
|
||||||
path: '{{ output_dir }}/csr2.csr'
|
include_tasks: impl.yml
|
||||||
privatekey_path: '{{ output_dir }}/privatekey2.pem'
|
vars:
|
||||||
subject:
|
select_crypto_backend: cryptography
|
||||||
commonName: www.ansible.com
|
|
||||||
|
|
||||||
- import_tasks: ../tests/validate.yml
|
- import_tasks: ../tests/validate.yml
|
||||||
|
|
||||||
when: pyopenssl_version.stdout is version('0.15', '>=')
|
when: cryptography_version.stdout is version('1.3', '>=')
|
||||||
|
Loading…
Reference in New Issue