community.general/test/integration/targets/openssl_certificate/tests/validate_ownca.yml

- name: Validate ownca certificate (test - verify CA)
  shell: 'openssl verify -CAfile {{ output_dir }}/ca_cert.pem {{ output_dir }}/ownca_cert.pem | sed "s/.*: \(.*\)/\1/g"'
  register: ownca_verify_ca

- name: Validate ownca certificate (test - ownca certificate modulus)
  shell: 'openssl x509 -noout -modulus -in {{ output_dir }}/ownca_cert.pem'
  register: ownca_cert_modulus

- name: Validate ownca certificate (test - ownca issuer value)
  shell: 'openssl x509 -noout  -in {{ output_dir}}/ownca_cert.pem -text | grep "Issuer" | sed "s/.*: \(.*\)/\1/g"'
  register: ownca_cert_issuer

- name: Validate ownca certificate (test - ownca certficate version == default == 3)
  shell: 'openssl x509 -noout  -in {{ output_dir}}/ownca_cert.pem -text | grep "Version" | sed "s/.*: \(.*\) .*/\1/g"'
  register: ownca_cert_version

- name: Validate ownca certificate (assert)
  assert:
    that:
      - ownca_verify_ca.stdout == 'OK'
      - ownca_cert_modulus.stdout == privatekey_modulus.stdout
      - ownca_cert_version.stdout == '3'
      # openssl 1.1.x adds a space between the output
      - ownca_cert_issuer.stdout in ['CN=Example CA', 'CN = Example CA']

- name: Validate ownca certificate idempotence
  assert:
    that:
      - ownca_certificate.serial_number == ownca_certificate_idempotence.serial_number
      - ownca_certificate.notBefore == ownca_certificate_idempotence.notBefore
      - ownca_certificate.notAfter == ownca_certificate_idempotence.notAfter

- name: Validate ownca certificate v2 (test - ownca certificate version == 2)
  shell: 'openssl x509 -noout  -in {{ output_dir}}/ownca_cert_v2.pem -text | grep "Version" | sed "s/.*: \(.*\) .*/\1/g"'
  register: ownca_cert_v2_version

- name: Validate ownca certificate version 2 (assert)
  assert:
    that:
      - ownca_cert_v2_version.stdout == '2'

- name: Validate ownca certificate2 (test - ownca certificate modulus)
  shell: 'openssl x509 -noout -modulus -in {{ output_dir }}/ownca_cert2.pem'
  register: ownca_cert2_modulus

- name: Validate ownca certificate2 (assert)
  assert:
    that:
      - ownca_cert2_modulus.stdout == privatekey2_modulus.stdout