mirror of
https://github.com/ansible-collections/community.general.git
synced 2024-09-14 20:13:21 +02:00
36a790dcde
* New cryptography backend for openssl_certificate
load_* functions in module_utils/crypto.py now have a backend paramter
which when set to 'cryptography' will return cryptography objects so
they can be used for both pyopenssl and cryptography backends.
Added a select_message_digest function too returning a cryptography
digest hash from `cryptography.hazmat.primitives.hashes`
Added new classes for Cryptography backend
* Run test with various backends.
* Prefixing tests.
* Make sure we have the correct backend available.
* Linting (flake8).
* Moved cryptography import to separate try/except
* Make sure certificate is actually valid at some time in the past.
* Improve error handling.
* Trying to fix validation for cryptography backend.
* Fixed issue with keyUsage test in assertonly
* Fixed CI/Lint issues
* Fix private key problem for OwnCA.
* Cryptography backend doesn't support v2 certs.
* issue an expired cert with command when using cryptography backend
* Added warning when backend is auto and v2 cert is requested
* Bumped min cryptography version to 1.6
* Correctly check for failure when backend is cryptography and cert is v2
* Use self.backend where possible
* Use secp521r1 EC when testing on CentOS6
* Fixed pylint issue
* AcmeCertificate support for both backends
* Review fixes
* Fixed missing '(' when raising error
* Fixed date_fmt loop
* Updated docs and requirements with cryptography
* Add openssl_certificate to changelog.
103 lines
5 KiB
YAML
103 lines
5 KiB
YAML
---
|
|
- name: (OwnCA validation, {{select_crypto_backend}}) Validate ownca certificate (test - verify CA)
|
|
shell: 'openssl verify -CAfile {{ output_dir }}/ca_cert.pem {{ output_dir }}/ownca_cert.pem | sed "s/.*: \(.*\)/\1/g"'
|
|
register: ownca_verify_ca
|
|
|
|
- name: (OwnCA validation, {{select_crypto_backend}}) Validate ownca certificate (test - ownca certificate modulus)
|
|
shell: 'openssl x509 -noout -modulus -in {{ output_dir }}/ownca_cert.pem'
|
|
register: ownca_cert_modulus
|
|
|
|
- name: (OwnCA validation, {{select_crypto_backend}}) Validate ownca certificate (test - ownca issuer value)
|
|
shell: 'openssl x509 -noout -in {{ output_dir}}/ownca_cert.pem -text | grep "Issuer" | sed "s/.*: \(.*\)/\1/g"'
|
|
register: ownca_cert_issuer
|
|
|
|
- name: (OwnCA validation, {{select_crypto_backend}}) Validate ownca certificate (test - ownca certficate version == default == 3)
|
|
shell: 'openssl x509 -noout -in {{ output_dir}}/ownca_cert.pem -text | grep "Version" | sed "s/.*: \(.*\) .*/\1/g"'
|
|
register: ownca_cert_version
|
|
|
|
- name: (OwnCA validation, {{select_crypto_backend}}) Validate ownca certificate (assert)
|
|
assert:
|
|
that:
|
|
- ownca_verify_ca.stdout == 'OK'
|
|
- ownca_cert_modulus.stdout == privatekey_modulus.stdout
|
|
- ownca_cert_version.stdout == '3'
|
|
# openssl 1.1.x adds a space between the output
|
|
- ownca_cert_issuer.stdout in ['CN=Example CA', 'CN = Example CA']
|
|
|
|
- name: (OwnCA validation, {{select_crypto_backend}}) Validate ownca certificate idempotence
|
|
assert:
|
|
that:
|
|
- ownca_certificate.serial_number == ownca_certificate_idempotence.serial_number
|
|
- ownca_certificate.notBefore == ownca_certificate_idempotence.notBefore
|
|
- ownca_certificate.notAfter == ownca_certificate_idempotence.notAfter
|
|
|
|
- block:
|
|
- name: (OwnCA validation, {{select_crypto_backend}}) Validate ownca certificate v2 (test - ownca certificate version == 2)
|
|
shell: 'openssl x509 -noout -in {{ output_dir}}/ownca_cert_v2.pem -text | grep "Version" | sed "s/.*: \(.*\) .*/\1/g"'
|
|
register: ownca_cert_v2_version
|
|
|
|
- name: (OwnCA validation, {{select_crypto_backend}}) Validate ownca certificate version 2 (assert)
|
|
assert:
|
|
that:
|
|
- ownca_cert_v2_version.stdout == '2'
|
|
when: "select_crypto_backend != 'cryptography'"
|
|
|
|
- name: (OwnCA validation, {{select_crypto_backend}}) Validate ownca certificate v2 (test - ownca certificate version == 2)
|
|
assert:
|
|
that:
|
|
- ownca_v2_certificate is failed
|
|
- "'The cryptography backend does not support v2 certificates' in ownca_v2_certificate.msg"
|
|
when: "select_crypto_backend == 'cryptography'"
|
|
|
|
|
|
- name: (OwnCA validation, {{select_crypto_backend}}) Validate ownca certificate2 (test - ownca certificate modulus)
|
|
shell: 'openssl x509 -noout -modulus -in {{ output_dir }}/ownca_cert2.pem'
|
|
register: ownca_cert2_modulus
|
|
|
|
- name: (OwnCA validation, {{select_crypto_backend}}) Validate ownca certificate2 (assert)
|
|
assert:
|
|
that:
|
|
- ownca_cert2_modulus.stdout == privatekey2_modulus.stdout
|
|
|
|
- name: (OwnCA validation, {{select_crypto_backend}}) Validate owncal certificate3 (test - notBefore)
|
|
shell: 'openssl x509 -noout -in {{ output_dir }}/ownca_cert3.pem -text | grep "Not Before" | sed "s/.*: \(.*\) .*/\1/g"'
|
|
register: ownca_cert3_notBefore
|
|
|
|
- name: (OwnCA validation, {{select_crypto_backend}}) Validate ownca certificate3 (test - notAfter)
|
|
shell: 'openssl x509 -noout -in {{ output_dir }}/ownca_cert3.pem -text | grep "Not After" | sed "s/.*: \(.*\) .*/\1/g"'
|
|
register: ownca_cert3_notAfter
|
|
|
|
- name: (OwnCA validation, {{select_crypto_backend}}) Validate ownca certificate3 (assert - notBefore)
|
|
assert:
|
|
that:
|
|
- ownca_cert3_notBefore.stdout == 'Oct 23 13:37:42 2018'
|
|
|
|
- name: (OwnCA validation, {{select_crypto_backend}}) Validate ownca certificate3 (assert - notAfter)
|
|
assert:
|
|
that:
|
|
- ownca_cert3_notAfter.stdout == 'Oct 23 13:37:42 2019'
|
|
|
|
- name: (OwnCA validation, {{select_crypto_backend}}) Validate ownca ECC certificate (test - ownca certificate pubkey)
|
|
shell: 'openssl x509 -noout -pubkey -in {{ output_dir }}/ownca_cert_ecc.pem'
|
|
register: ownca_cert_ecc_pubkey
|
|
|
|
- name: (OwnCA validation, {{select_crypto_backend}}) Validate ownca ECC certificate (test - ownca issuer value)
|
|
shell: 'openssl x509 -noout -in {{ output_dir}}/ownca_cert_ecc.pem -text | grep "Issuer" | sed "s/.*: \(.*\)/\1/g"'
|
|
register: ownca_cert_ecc_issuer
|
|
|
|
- name: (OwnCA validation, {{select_crypto_backend}}) Validate ownca ECC certificate (assert)
|
|
assert:
|
|
that:
|
|
- ownca_cert_ecc_pubkey.stdout == privatekey_ecc_pubkey.stdout
|
|
# openssl 1.1.x adds a space between the output
|
|
- ownca_cert_ecc_issuer.stdout in ['CN=Example CA', 'CN = Example CA']
|
|
|
|
- name: (OwnCA validation, {{select_crypto_backend}})
|
|
assert:
|
|
that:
|
|
- passphrase_error_1 is failed
|
|
- "'assphrase' in passphrase_error_1.msg or 'assword' in passphrase_error_1.msg"
|
|
- passphrase_error_2 is failed
|
|
- "'assphrase' in passphrase_error_1.msg or 'assword' in passphrase_error_2.msg"
|
|
- passphrase_error_3 is failed
|
|
- "'assphrase' in passphrase_error_1.msg or 'assword' in passphrase_error_3.msg"
|