ansible.builtin.openssl_csr_info (v2.9.27) — module

Install Ansible via pip

Install with pip install ansible==2.9.27

Description

This module allows one to query information on OpenSSL Certificate Signing Requests (CSR).

In case the CSR signature cannot be validated, the module will fail. In this case, all return variables are still returned.

It uses the pyOpenSSL or cryptography python library to interact with OpenSSL. If both the cryptography and PyOpenSSL libraries are available (and meet the minimum version requirements) cryptography will be preferred as a backend over PyOpenSSL (unless the backend is forced with C(select_crypto_backend)). Please note that the PyOpenSSL backend was deprecated in Ansible 2.9 and will be removed in Ansible 2.13.

Requirements

• PyOpenSSL >= 0.15 or cryptography >= 1.3

Usage examples

Scanned by Steampunk Spotter

• Success
  Steampunk Spotter scan finished with no errors, warnings or hints.

- name: Generate an OpenSSL Certificate Signing Request
  openssl_csr:
    path: /etc/ssl/csr/www.ansible.com.csr
    privatekey_path: /etc/ssl/private/ansible.com.pem
    common_name: www.ansible.com

Scanned by Steampunk Spotter

• Success
  Steampunk Spotter scan finished with no errors, warnings or hints.

- name: Get information on the CSR
  openssl_csr_info:
    path: /etc/ssl/csr/www.ansible.com.csr
  register: result

Scanned by Steampunk Spotter

• Success
  Steampunk Spotter scan finished with no errors, warnings or hints.

- name: Dump information
  debug:
    var: result

Inputs

    
path:
    description:
    - Remote absolute path where the CSR file is loaded from.
    required: true
    type: path

select_crypto_backend:
    choices:
    - auto
    - cryptography
    - pyopenssl
    default: auto
    description:
    - Determines which crypto backend to use.
    - The default choice is C(auto), which tries to use C(cryptography) if available,
      and falls back to C(pyopenssl).
    - If set to C(pyopenssl), will try to use the L(pyOpenSSL,https://pypi.org/project/pyOpenSSL/)
      library.
    - If set to C(cryptography), will try to use the L(cryptography,https://cryptography.io/)
      library.
    - Please note that the C(pyopenssl) backend has been deprecated in Ansible 2.9, and
      will be removed in Ansible 2.13. From that point on, only the C(cryptography) backend
      will be available.
    type: str

Outputs

authority_cert_issuer:
  description:
  - The CSR's authority cert issuer as a list of general names.
  - Is C(none) if the C(AuthorityKeyIdentifier) extension is not present.
  elements: str
  returned: success and if the pyOpenSSL backend is I(not) used
  sample: '[DNS:www.ansible.com, IP:1.2.3.4]'
  type: list
  version_added: '2.9'
  version_added_collection: ansible.builtin
authority_cert_serial_number:
  description:
  - The CSR's authority cert serial number.
  - Is C(none) if the C(AuthorityKeyIdentifier) extension is not present.
  returned: success and if the pyOpenSSL backend is I(not) used
  sample: '12345'
  type: int
  version_added: '2.9'
  version_added_collection: ansible.builtin
authority_key_identifier:
  description:
  - The CSR's authority key identifier.
  - The identifier is returned in hexadecimal, with C(:) used to separate bytes.
  - Is C(none) if the C(AuthorityKeyIdentifier) extension is not present.
  returned: success and if the pyOpenSSL backend is I(not) used
  sample: 00:11:22:33:44:55:66:77:88:99:aa:bb:cc:dd:ee:ff:00:11:22:33
  type: str
  version_added: '2.9'
  version_added_collection: ansible.builtin
basic_constraints:
  description: Entries in the C(basic_constraints) extension, or C(none) if extension
    is not present.
  elements: str
  returned: success
  sample: '[CA:TRUE, pathlen:1]'
  type: list
basic_constraints_critical:
  description: Whether the C(basic_constraints) extension is critical.
  returned: success
  type: bool
extended_key_usage:
  description: Entries in the C(extended_key_usage) extension, or C(none) if extension
    is not present.
  elements: str
  returned: success
  sample: '[Biometric Info, DVCS, Time Stamping]'
  type: list
extended_key_usage_critical:
  description: Whether the C(extended_key_usage) extension is critical.
  returned: success
  type: bool
extensions_by_oid:
  contains:
    critical:
      description: Whether the extension is critical.
      returned: success
      type: bool
    value:
      description: The Base64 encoded value (in DER format) of the extension
      returned: success
      sample: MAMCAQU=
      type: str
  description: Returns a dictionary for every extension OID
  returned: success
  sample: '{"1.3.6.1.5.5.7.1.24": { "critical": false, "value": "MAMCAQU="}}'
  type: dict
key_usage:
  description: Entries in the C(key_usage) extension, or C(none) if extension is not
    present.
  returned: success
  sample: '[Key Agreement, Data Encipherment]'
  type: str
key_usage_critical:
  description: Whether the C(key_usage) extension is critical.
  returned: success
  type: bool
ocsp_must_staple:
  description: C(yes) if the OCSP Must Staple extension is present, C(none) otherwise.
  returned: success
  type: bool
ocsp_must_staple_critical:
  description: Whether the C(ocsp_must_staple) extension is critical.
  returned: success
  type: bool
public_key:
  description: CSR's public key in PEM format
  returned: success
  sample: '-----BEGIN PUBLIC KEY-----

    MIICIjANBgkqhkiG9w0BAQEFAAOCAg8A...'
  type: str
public_key_fingerprints:
  description:
  - Fingerprints of CSR's public key.
  - For every hash algorithm available, the fingerprint is computed.
  returned: success
  sample: '{''sha256'': ''d4:b3:aa:6d:c8:04:ce:4e:ba:f6:29:4d:92:a3:94:b0:c2:ff:bd:bf:33:63:11:43:34:0f:51:b0:95:09:2f:63'',
    ''sha512'': ''f7:07:4a:f0:b0:f0:e6:8b:95:5f:f9:e6:61:0a:32:68:f1...'
  type: dict
signature_valid:
  description:
  - Whether the CSR's signature is valid.
  - In case the check returns C(no), the module will fail.
  returned: success
  type: bool
subject:
  description:
  - The CSR's subject as a dictionary.
  - Note that for repeated values, only the last one will be returned.
  returned: success
  sample: '{"commonName": "www.example.com", "emailAddress": "test@example.com"}'
  type: dict
subject_alt_name:
  description: Entries in the C(subject_alt_name) extension, or C(none) if extension
    is not present.
  elements: str
  returned: success
  sample: '[DNS:www.ansible.com, IP:1.2.3.4]'
  type: list
subject_alt_name_critical:
  description: Whether the C(subject_alt_name) extension is critical.
  returned: success
  type: bool
subject_key_identifier:
  description:
  - The CSR's subject key identifier.
  - The identifier is returned in hexadecimal, with C(:) used to separate bytes.
  - Is C(none) if the C(SubjectKeyIdentifier) extension is not present.
  returned: success and if the pyOpenSSL backend is I(not) used
  sample: 00:11:22:33:44:55:66:77:88:99:aa:bb:cc:dd:ee:ff:00:11:22:33
  type: str
  version_added: '2.9'
  version_added_collection: ansible.builtin
subject_ordered:
  description: The CSR's subject as an ordered list of tuples.
  elements: list
  returned: success
  sample: '[["commonName", "www.example.com"], ["emailAddress": "test@example.com"]]'
  type: list
  version_added: '2.9'
  version_added_collection: ansible.builtin

See also

• openssl_csr