ansible.builtin.openssl_pkcs12 (v2.7.7) — module

Install Ansible via pip

Install with pip install ansible==2.7.7

Description

This module allows one to (re-)generate PKCS#12.

Requirements

• python-pyOpenSSL

Usage examples

Scanned by Steampunk Spotter

• Success
  Steampunk Spotter scan finished with no errors, warnings or hints.

- name: 'Generate PKCS#12 file'
  openssl_pkcs12:
    action: export
    path: '/opt/certs/ansible.p12'
    friendly_name: 'raclette'
    privatekey_path: '/opt/certs/keys/key.pem'
    certificate_path: '/opt/certs/cert.pem'
    ca_certificates: '/opt/certs/ca.pem'
    state: present

Scanned by Steampunk Spotter

• Success
  Steampunk Spotter scan finished with no errors, warnings or hints.

- name: 'Change PKCS#12 file permission'
  openssl_pkcs12:
    action: export
    path: '/opt/certs/ansible.p12'
    friendly_name: 'raclette'
    privatekey_path: '/opt/certs/keys/key.pem'
    certificate_path: '/opt/certs/cert.pem'
    ca_certificates: '/opt/certs/ca.pem'
    state: present
    mode: 0600

Scanned by Steampunk Spotter

• Success
  Steampunk Spotter scan finished with no errors, warnings or hints.

- name: 'Regen PKCS#12 file'
  openssl_pkcs12:
    action: export
    src: '/opt/certs/ansible.p12'
    path: '/opt/certs/ansible.p12'
    friendly_name: 'raclette'
    privatekey_path: '/opt/certs/keys/key.pem'
    certificate_path: '/opt/certs/cert.pem'
    ca_certificates: '/opt/certs/ca.pem'
    state: present
    mode: 0600
    force: True

Scanned by Steampunk Spotter

• Success
  Steampunk Spotter scan finished with no errors, warnings or hints.

- name: 'Dump/Parse PKCS#12 file'
  openssl_pkcs12:
    action: parse
    src: '/opt/certs/ansible.p12'
    path: '/opt/certs/ansible.pem'
    state: present

Scanned by Steampunk Spotter

• Success
  Steampunk Spotter scan finished with no errors, warnings or hints.

- name: 'Remove PKCS#12 file'
  openssl_pkcs12:
    path: '/opt/certs/ansible.p12'
    state: absent

Inputs

    
src:
    description:
    - PKCS#12 file path to parse.

mode:
    description:
    - The permissions the resulting filesystem object should have.
    - For those used to I(/usr/bin/chmod) remember that modes are actually octal numbers.
      You must give Ansible enough information to parse them correctly. For consistent
      results, quote octal numbers (for example, V('644') or V('1777')) so Ansible receives
      a string and can do its own conversion from string into number. Adding a leading
      zero (for example, V(0755)) works sometimes, but can fail in loops and some other
      circumstances.
    - Giving Ansible a number without following either of these rules will end up with
      a decimal number which will have unexpected results.
    - As of Ansible 1.8, the mode may be specified as a symbolic mode (for example, V(u+rwx)
      or V(u=rw,g=r,o=r)).
    - If O(mode) is not specified and the destination filesystem object B(does not) exist,
      the default C(umask) on the system will be used when setting the mode for the newly
      created filesystem object.
    - If O(mode) is not specified and the destination filesystem object B(does) exist,
      the mode of the existing filesystem object will be used.
    - Specifying O(mode) is the best way to ensure filesystem objects are created with
      the correct permissions. See CVE-2020-1736 for further details.
    type: raw

path:
    description:
    - Filename to write the PKCS#12 file to.
    required: true

force:
    default: false
    description:
    - Should the file be regenerated even if it already exists.
    type: bool

group:
    description:
    - Name of the group that should own the filesystem object, as would be fed to I(chown).
    - When left unspecified, it uses the current group of the current user unless you
      are root, in which case it can preserve the previous ownership.
    type: str

owner:
    description:
    - Name of the user that should own the filesystem object, as would be fed to I(chown).
    - When left unspecified, it uses the current user unless you are root, in which case
      it can preserve the previous ownership.
    - Specifying a numeric username will be assumed to be a user ID and not a username.
      Avoid numeric usernames to avoid this confusion.
    type: str

state:
    choices:
    - present
    - absent
    default: present
    description:
    - Whether the file should exist or not. All parameters except C(path) are ignored
      when state is C(absent).

action:
    choices:
    - parse
    - export
    default: export
    description:
    - C(export) or C(parse) a PKCS#12.

serole:
    description:
    - The role part of the SELinux filesystem object context.
    - When set to V(_default), it will use the C(role) portion of the policy if available.
    type: str

setype:
    description:
    - The type part of the SELinux filesystem object context.
    - When set to V(_default), it will use the C(type) portion of the policy if available.
    type: str

seuser:
    description:
    - The user part of the SELinux filesystem object context.
    - By default it uses the V(system) policy, where applicable.
    - When set to V(_default), it will use the C(user) portion of the policy if available.
    type: str

selevel:
    description:
    - The level part of the SELinux filesystem object context.
    - This is the MLS/MCS attribute, sometimes known as the C(range).
    - When set to V(_default), it will use the C(level) portion of the policy if available.
    type: str

iter_size:
    default: 2048
    description:
    - Number of times to repeat the encryption step.

attributes:
    aliases:
    - attr
    description:
    - The attributes the resulting filesystem object should have.
    - To get supported flags look at the man page for I(chattr) on the target system.
    - This string should contain the attributes in the same order as the one displayed
      by I(lsattr).
    - The C(=) operator is assumed as default, otherwise C(+) or C(-) operators need to
      be included in the string.
    type: str
    version_added: '2.3'
    version_added_collection: ansible.builtin

passphrase:
    description:
    - The PKCS#12 password.

maciter_size:
    default: 1
    description:
    - Number of times to repeat the MAC step.

friendly_name:
    aliases:
    - name
    description:
    - Specifies the friendly name for the certificate and private key.

unsafe_writes:
    default: false
    description:
    - Influence when to use atomic operation to prevent data corruption or inconsistent
      reads from the target filesystem object.
    - By default this module uses atomic operations to prevent data corruption or inconsistent
      reads from the target filesystem objects, but sometimes systems are configured or
      just broken in ways that prevent this. One example is docker mounted filesystem
      objects, which cannot be updated atomically from inside the container and can only
      be written in an unsafe manner.
    - This option allows Ansible to fall back to unsafe methods of updating filesystem
      objects when atomic operations fail (however, it doesn't force Ansible to perform
      unsafe writes).
    - IMPORTANT! Unsafe writes are subject to race conditions and can lead to data corruption.
    type: bool
    version_added: '2.2'
    version_added_collection: ansible.builtin

ca_certificates:
    description:
    - List of CA certificate to include.

privatekey_path:
    description:
    - File to read private key from.

certificate_path:
    description:
    - The path to read certificates and private keys from.  Must be in PEM format.

privatekey_passphrase:
    description:
    - Passphrase source to decrypt any input private keys with.

Outputs

filename:
  description: Path to the generate PKCS#12 file.
  returned: changed or success
  sample: /opt/certs/ansible.p12
  type: string
privatekey:
  description: Path to the TLS/SSL private key the public key was generated from
  returned: changed or success
  sample: /etc/ssl/private/ansible.com.pem
  type: string