Try SpotterCreate a Java keystore in JKS format
Authors: Guillaume Grossetie (@Mogztter), quidame (@quidame)
Install with ansible-galaxy collection install community.general:==8.5.0
collections:
- name: community.general
version: 8.5.0Bundle a x509 certificate and its private key into a Java Keystore in JKS format.
- name: Create a keystore for the given certificate/private key pair (inline)
community.general.java_keystore:
name: example
certificate: |
-----BEGIN CERTIFICATE-----
h19dUZ2co2fI/ibYiwxWk4aeNE6KWvCaTQOMQ8t6Uo2XKhpL/xnjoAgh1uCQN/69
MG+34+RhUWzCfdZH7T8/qDxJw2kEPKluaYh7KnMsba+5jHjmtzix5QIDAQABo4IB
-----END CERTIFICATE-----
private_key: |
-----BEGIN RSA PRIVATE KEY-----
DBVFTEVDVFJJQ0lURSBERSBGUkFOQ0UxFzAVBgNVBAsMDjAwMDIgNTUyMDgxMzE3
GLlDNMw/uHyME7gHFsqJA7O11VY6O5WQ4IDP3m/s5ZV6s+Nn6Lerz17VZ99
-----END RSA PRIVATE KEY-----
password: changeit
dest: /etc/security/keystore.jks
- name: Create a keystore for the given certificate/private key pair (with files on controller)
community.general.java_keystore:
name: example
certificate: "{{ lookup('file', '/path/to/certificate.crt') }}"
private_key: "{{ lookup('file', '/path/to/private.key') }}"
password: changeit
dest: /etc/security/keystore.jks
- name: Create a keystore for the given certificate/private key pair (with files on target host)
community.general.java_keystore:
name: snakeoil
certificate_path: /etc/ssl/certs/ssl-cert-snakeoil.pem
private_key_path: /etc/ssl/private/ssl-cert-snakeoil.key
password: changeit
dest: /etc/security/keystore.jks
dest:
description:
- Absolute path of the generated keystore.
required: true
type: path
mode:
description:
- Mode the file should be.
required: false
type: raw
name:
description:
- Name of the certificate in the keystore.
- If the provided name does not exist in the keystore, the module will re-create the
keystore. This behavior changed in community.general 3.0.0, before that the module
would fail when the name did not match.
required: true
type: str
force:
default: false
description:
- Keystore is created even if it already exists.
type: bool
group:
description:
- Name of the group that should own jks file.
required: false
type: str
owner:
description:
- Name of the user that should own jks file.
required: false
type: str
serole:
description:
- The role part of the SELinux filesystem object context.
- When set to V(_default), it will use the C(role) portion of the policy if available.
type: str
setype:
description:
- The type part of the SELinux filesystem object context.
- When set to V(_default), it will use the C(type) portion of the policy if available.
type: str
seuser:
description:
- The user part of the SELinux filesystem object context.
- By default it uses the V(system) policy, where applicable.
- When set to V(_default), it will use the C(user) portion of the policy if available.
type: str
selevel:
description:
- The level part of the SELinux filesystem object context.
- This is the MLS/MCS attribute, sometimes known as the C(range).
- When set to V(_default), it will use the C(level) portion of the policy if available.
type: str
password:
description:
- Password that should be used to secure the keystore.
- If the provided password fails to unlock the keystore, the module will re-create
the keystore with the new passphrase. This behavior changed in community.general
3.0.0, before that the module would fail when the password did not match.
required: true
type: str
attributes:
aliases:
- attr
description:
- The attributes the resulting filesystem object should have.
- To get supported flags look at the man page for I(chattr) on the target system.
- This string should contain the attributes in the same order as the one displayed
by I(lsattr).
- The C(=) operator is assumed as default, otherwise C(+) or C(-) operators need to
be included in the string.
type: str
version_added: '2.3'
version_added_collection: ansible.builtin
certificate:
description:
- Content of the certificate used to create the keystore.
- If the fingerprint of the provided certificate does not match the fingerprint of
the certificate bundled in the keystore, the keystore is regenerated with the provided
certificate.
- Exactly one of O(certificate) or O(certificate_path) is required.
type: str
private_key:
description:
- Content of the private key used to create the keystore.
- Exactly one of O(private_key) or O(private_key_path) is required.
type: str
ssl_backend:
choices:
- openssl
- cryptography
default: openssl
description:
- Backend for loading private keys and certificates.
type: str
version_added: 3.1.0
version_added_collection: community.general
keystore_type:
choices:
- jks
- pkcs12
description:
- Type of the Java keystore.
- When this option is omitted and the keystore doesn't already exist, the behavior
follows C(keytool)'s default store type which depends on Java version; V(pkcs12)
since Java 9 and V(jks) prior (may also be V(pkcs12) if new default has been backported
to this version).
- When this option is omitted and the keystore already exists, the current type is
left untouched, unless another option leads to overwrite the keystore (in that case,
this option behaves like for keystore creation).
- When O(keystore_type) is set, the keystore is created with this type if it does
not already exist, or is overwritten to match the given type in case of mismatch.
type: str
version_added: 3.3.0
version_added_collection: community.general
unsafe_writes:
default: false
description:
- Influence when to use atomic operation to prevent data corruption or inconsistent
reads from the target filesystem object.
- By default this module uses atomic operations to prevent data corruption or inconsistent
reads from the target filesystem objects, but sometimes systems are configured or
just broken in ways that prevent this. One example is docker mounted filesystem
objects, which cannot be updated atomically from inside the container and can only
be written in an unsafe manner.
- This option allows Ansible to fall back to unsafe methods of updating filesystem
objects when atomic operations fail (however, it doesn't force Ansible to perform
unsafe writes).
- IMPORTANT! Unsafe writes are subject to race conditions and can lead to data corruption.
type: bool
version_added: '2.2'
version_added_collection: ansible.builtin
certificate_path:
description:
- Location of the certificate used to create the keystore.
- If the fingerprint of the provided certificate does not match the fingerprint of
the certificate bundled in the keystore, the keystore is regenerated with the provided
certificate.
- Exactly one of O(certificate) or O(certificate_path) is required.
type: path
version_added: 3.0.0
version_added_collection: community.general
private_key_path:
description:
- Location of the private key used to create the keystore.
- Exactly one of O(private_key) or O(private_key_path) is required.
type: path
version_added: 3.0.0
version_added_collection: community.general
private_key_passphrase:
description:
- Passphrase used to read the private key, if required.
type: str
version_added: 0.2.0
version_added_collection: community.general
cmd:
description: Executed command to get action done
returned: changed and failure
sample: /usr/bin/openssl x509 -noout -in /tmp/user/1000/tmp8jd_lh23 -fingerprint
-sha256
type: str
err:
description: Output from stderr of keytool/openssl command after error of given
command.
returned: failure
sample: 'Keystore password is too short - must be at least 6 characters '
type: str
msg:
description: Output from stdout of keytool/openssl command after execution of given
command or an error.
returned: changed and failure
sample: Unable to find the current certificate fingerprint in ...
type: str
rc:
description: keytool/openssl command execution return value
returned: changed and failure
sample: '0'
type: int