new provider: ownca (#35840)

test/integration/targets/openssl_certificate/tasks/main.yml

@@ -1,120 +1,7 @@
 - block:
-    - name: Generate privatekey
-      openssl_privatekey:
-        path: '{{ output_dir }}/privatekey.pem'
 
-    - name: Generate CSR
-      openssl_csr:
-        path: '{{ output_dir }}/csr.csr'
-        privatekey_path: '{{ output_dir }}/privatekey.pem'
-        subject:
-          commonName: www.example.com
+    - import_tasks: selfsigned.yml
 
-    - name: Generate selfsigned certificate
-      openssl_certificate:
-        path: '{{ output_dir }}/cert.pem'
-        csr_path: '{{ output_dir }}/csr.csr'
-        privatekey_path: '{{ output_dir }}/privatekey.pem'
-        provider: selfsigned
-        selfsigned_digest: sha256
-      register: selfsigned_certificate
-
-    - name: Generate selfsigned certificate
-      openssl_certificate:
-        path: '{{ output_dir }}/cert.pem'
-        csr_path: '{{ output_dir }}/csr.csr'
-        privatekey_path: '{{ output_dir }}/privatekey.pem'
-        provider: selfsigned
-        selfsigned_digest: sha256
-      register: selfsigned_certificate_idempotence
-
-    - name: Generate selfsigned certificate (check mode)
-      openssl_certificate:
-        path: '{{ output_dir }}/cert.pem'
-        csr_path: '{{ output_dir }}/csr.csr'
-        privatekey_path: '{{ output_dir }}/privatekey.pem'
-        provider: selfsigned
-        selfsigned_digest: sha256
-      check_mode: yes
-
-    - name: Check selfsigned certificate
-      openssl_certificate:
-        path: '{{ output_dir }}/cert.pem'
-        privatekey_path: '{{ output_dir }}/privatekey.pem'
-        provider: assertonly
-        has_expired: False
-        version: 3
-        signature_algorithms:
-          - sha256WithRSAEncryption
-          - sha256WithECDSAEncryption
-        subject:
-          commonName: www.example.com
-
-    - name: Generate selfsigned v2 certificate
-      openssl_certificate:
-        path: '{{ output_dir }}/cert_v2.pem'
-        csr_path: '{{ output_dir }}/csr.csr'
-        privatekey_path: '{{ output_dir }}/privatekey.pem'
-        provider: selfsigned
-        selfsigned_digest: sha256
-        selfsigned_version: 2
-
-    - name: Generate privatekey2
-      openssl_privatekey:
-        path: '{{ output_dir }}/privatekey2.pem'
-
-    - name: Generate CSR2
-      openssl_csr:
-        subject:
-          CN: www.example.com
-          C: US
-          ST: California
-          L: Los Angeles
-          O: ACME Inc.
-          OU:
-            - Roadrunner pest control
-            - Pyrotechnics
-        path: '{{ output_dir }}/csr2.csr'
-        privatekey_path: '{{ output_dir }}/privatekey2.pem'
-        keyUsage:
-          - digitalSignature
-        extendedKeyUsage:
-          - ipsecUser
-          - biometricInfo
-
-    - name: Generate selfsigned certificate2
-      openssl_certificate:
-        path: '{{ output_dir }}/cert2.pem'
-        csr_path: '{{ output_dir }}/csr2.csr'
-        privatekey_path: '{{ output_dir }}/privatekey2.pem'
-        provider: selfsigned
-        selfsigned_digest: sha256
-
-    - name: Check selfsigned certificate2
-      openssl_certificate:
-        path: '{{ output_dir }}/cert2.pem'
-        privatekey_path: '{{ output_dir }}/privatekey2.pem'
-        provider: assertonly
-        has_expired: False
-        version: 3
-        signature_algorithms:
-          - sha256WithRSAEncryption
-          - sha256WithECDSAEncryption
-        subject:
-          commonName: www.example.com
-          C: US
-          ST: California
-          L: Los Angeles
-          O: ACME Inc.
-          OU:
-            - Roadrunner pest control
-            - Pyrotechnics
-        keyUsage:
-          - digitalSignature
-        extendedKeyUsage:
-          - ipsecUser
-          - biometricInfo
-
-    - import_tasks: ../tests/validate.yml
+    - import_tasks: ownca.yml
 
   when: pyopenssl_version.stdout is version('0.15', '>=')

test/integration/targets/openssl_certificate/tasks/ownca.yml

@@ -0,0 +1,116 @@
+- name: Generate CA privatekey
+  openssl_privatekey:
+    path: '{{ output_dir }}/ca_privatekey.pem'
+
+- name: Generate CA CSR
+  openssl_csr:
+    path: '{{ output_dir }}/ca_csr.csr'
+    privatekey_path: '{{ output_dir }}/ca_privatekey.pem'
+    subject:
+      commonName: Example CA
+
+- name: Generate selfsigned CA certificate
+  openssl_certificate:
+    path: '{{ output_dir }}/ca_cert.pem'
+    csr_path: '{{ output_dir }}/ca_csr.csr'
+    privatekey_path: '{{ output_dir }}/ca_privatekey.pem'
+    provider: selfsigned
+    selfsigned_digest: sha256
+
+- name: Generate ownca certificate
+  openssl_certificate:
+    path: '{{ output_dir }}/ownca_cert.pem'
+    csr_path: '{{ output_dir }}/csr.csr'
+    privatekey_path: '{{ output_dir }}/privatekey.pem'
+    ownca_path: '{{ output_dir }}/ca_cert.pem'
+    ownca_privatekey_path: '{{ output_dir }}/ca_privatekey.pem'
+    provider: ownca
+    ownca_digest: sha256
+  register: ownca_certificate
+
+- name: Generate ownca certificate
+  openssl_certificate:
+    path: '{{ output_dir }}/ownca_cert.pem'
+    csr_path: '{{ output_dir }}/csr.csr'
+    privatekey_path: '{{ output_dir }}/privatekey.pem'
+    ownca_path: '{{ output_dir }}/ca_cert.pem'
+    ownca_privatekey_path: '{{ output_dir }}/ca_privatekey.pem'
+    provider: ownca
+    ownca_digest: sha256
+  register: ownca_certificate_idempotence
+
+- name: Generate ownca certificate (check mode)
+  openssl_certificate:
+    path: '{{ output_dir }}/ownca_cert.pem'
+    csr_path: '{{ output_dir }}/csr.csr'
+    privatekey_path: '{{ output_dir }}/privatekey.pem'
+    ownca_path: '{{ output_dir }}/ca_cert.pem'
+    ownca_privatekey_path: '{{ output_dir }}/ca_privatekey.pem'
+    provider: ownca
+    ownca_digest: sha256
+  check_mode: yes
+
+- name: Check ownca certificate
+  openssl_certificate:
+    path: '{{ output_dir }}/ownca_cert.pem'
+    privatekey_path: '{{ output_dir }}/privatekey.pem'
+    provider: assertonly
+    has_expired: False
+    version: 3
+    signature_algorithms:
+      - sha256WithRSAEncryption
+      - sha256WithECDSAEncryption
+    subject:
+      commonName: www.example.com
+    issuer:
+      commonName: Example CA
+
+- name: Generate ownca v2 certificate
+  openssl_certificate:
+    path: '{{ output_dir }}/ownca_cert_v2.pem'
+    csr_path: '{{ output_dir }}/csr.csr'
+    privatekey_path: '{{ output_dir }}/privatekey.pem'
+    ownca_path: '{{ output_dir }}/ca_cert.pem'
+    ownca_privatekey_path: '{{ output_dir }}/ca_privatekey.pem'
+    provider: ownca
+    ownca_digest: sha256
+    ownca_version: 2
+
+- name: Generate ownca certificate2
+  openssl_certificate:
+    path: '{{ output_dir }}/ownca_cert2.pem'
+    csr_path: '{{ output_dir }}/csr2.csr'
+    privatekey_path: '{{ output_dir }}/privatekey2.pem'
+    ownca_path: '{{ output_dir }}/ca_cert.pem'
+    ownca_privatekey_path: '{{ output_dir }}/ca_privatekey.pem'
+    provider: ownca
+    ownca_digest: sha256
+
+- name: Check ownca certificate2
+  openssl_certificate:
+    path: '{{ output_dir }}/ownca_cert2.pem'
+    privatekey_path: '{{ output_dir }}/privatekey2.pem'
+    provider: assertonly
+    has_expired: False
+    version: 3
+    signature_algorithms:
+      - sha256WithRSAEncryption
+      - sha256WithECDSAEncryption
+    subject:
+      commonName: www.example.com
+      C: US
+      ST: California
+      L: Los Angeles
+      O: ACME Inc.
+      OU:
+        - Roadrunner pest control
+        - Pyrotechnics
+    keyUsage:
+      - digitalSignature
+    extendedKeyUsage:
+      - ipsecUser
+      - biometricInfo
+    issuer:
+      commonName: Example CA
+
+- import_tasks: ../tests/validate_ownca.yml

test/integration/targets/openssl_certificate/tasks/selfsigned.yml

@@ -0,0 +1,117 @@
+- name: Generate privatekey
+  openssl_privatekey:
+    path: '{{ output_dir }}/privatekey.pem'
+
+- name: Generate CSR
+  openssl_csr:
+    path: '{{ output_dir }}/csr.csr'
+    privatekey_path: '{{ output_dir }}/privatekey.pem'
+    subject:
+      commonName: www.example.com
+
+- name: Generate selfsigned certificate
+  openssl_certificate:
+    path: '{{ output_dir }}/cert.pem'
+    csr_path: '{{ output_dir }}/csr.csr'
+    privatekey_path: '{{ output_dir }}/privatekey.pem'
+    provider: selfsigned
+    selfsigned_digest: sha256
+  register: selfsigned_certificate
+
+- name: Generate selfsigned certificate
+  openssl_certificate:
+    path: '{{ output_dir }}/cert.pem'
+    csr_path: '{{ output_dir }}/csr.csr'
+    privatekey_path: '{{ output_dir }}/privatekey.pem'
+    provider: selfsigned
+    selfsigned_digest: sha256
+  register: selfsigned_certificate_idempotence
+
+- name: Generate selfsigned certificate (check mode)
+  openssl_certificate:
+    path: '{{ output_dir }}/cert.pem'
+    csr_path: '{{ output_dir }}/csr.csr'
+    privatekey_path: '{{ output_dir }}/privatekey.pem'
+    provider: selfsigned
+    selfsigned_digest: sha256
+  check_mode: yes
+
+- name: Check selfsigned certificate
+  openssl_certificate:
+    path: '{{ output_dir }}/cert.pem'
+    privatekey_path: '{{ output_dir }}/privatekey.pem'
+    provider: assertonly
+    has_expired: False
+    version: 3
+    signature_algorithms:
+      - sha256WithRSAEncryption
+      - sha256WithECDSAEncryption
+    subject:
+      commonName: www.example.com
+
+- name: Generate selfsigned v2 certificate
+  openssl_certificate:
+    path: '{{ output_dir }}/cert_v2.pem'
+    csr_path: '{{ output_dir }}/csr.csr'
+    privatekey_path: '{{ output_dir }}/privatekey.pem'
+    provider: selfsigned
+    selfsigned_digest: sha256
+    selfsigned_version: 2
+
+- name: Generate privatekey2
+  openssl_privatekey:
+    path: '{{ output_dir }}/privatekey2.pem'
+
+- name: Generate CSR2
+  openssl_csr:
+    subject:
+      CN: www.example.com
+      C: US
+      ST: California
+      L: Los Angeles
+      O: ACME Inc.
+      OU:
+        - Roadrunner pest control
+        - Pyrotechnics
+    path: '{{ output_dir }}/csr2.csr'
+    privatekey_path: '{{ output_dir }}/privatekey2.pem'
+    keyUsage:
+      - digitalSignature
+    extendedKeyUsage:
+      - ipsecUser
+      - biometricInfo
+
+- name: Generate selfsigned certificate2
+  openssl_certificate:
+    path: '{{ output_dir }}/cert2.pem'
+    csr_path: '{{ output_dir }}/csr2.csr'
+    privatekey_path: '{{ output_dir }}/privatekey2.pem'
+    provider: selfsigned
+    selfsigned_digest: sha256
+
+- name: Check selfsigned certificate2
+  openssl_certificate:
+    path: '{{ output_dir }}/cert2.pem'
+    privatekey_path: '{{ output_dir }}/privatekey2.pem'
+    provider: assertonly
+    has_expired: False
+    version: 3
+    signature_algorithms:
+      - sha256WithRSAEncryption
+      - sha256WithECDSAEncryption
+    subject:
+      commonName: www.example.com
+      C: US
+      ST: California
+      L: Los Angeles
+      O: ACME Inc.
+      OU:
+        - Roadrunner pest control
+        - Pyrotechnics
+    keyUsage:
+      - digitalSignature
+    extendedKeyUsage:
+      - ipsecUser
+      - biometricInfo
+
+- import_tasks: ../tests/validate_selfsigned.yml

test/integration/targets/openssl_certificate/tests/validate_ownca.yml

@@ -0,0 +1,48 @@
+- name: Validate ownca certificate (test - verify CA)
+  shell: 'openssl verify -CAfile {{ output_dir }}/ca_cert.pem {{ output_dir }}/ownca_cert.pem | sed "s/.*: \(.*\)/\1/g"'
+  register: ownca_verify_ca
+
+- name: Validate ownca certificate (test - ownca certificate modulus)
+  shell: 'openssl x509 -noout -modulus -in {{ output_dir }}/ownca_cert.pem'
+  register: ownca_cert_modulus
+
+- name: Validate ownca certificate (test - ownca issuer value)
+  shell: 'openssl x509 -noout  -in {{ output_dir}}/ownca_cert.pem -text | grep "Issuer" | sed "s/.*: \(.*\)/\1/g"'
+  register: ownca_cert_issuer
+
+- name: Validate ownca certificate (test - ownca certficate version == default == 3)
+  shell: 'openssl x509 -noout  -in {{ output_dir}}/ownca_cert.pem -text | grep "Version" | sed "s/.*: \(.*\) .*/\1/g"'
+  register: ownca_cert_version
+
+- name: Validate ownca certificate (assert)
+  assert:
+    that:
+      - ownca_verify_ca.stdout == 'OK'
+      - ownca_cert_modulus.stdout == privatekey_modulus.stdout
+      - ownca_cert_version.stdout == '3'
+      - ownca_cert_issuer.stdout == 'CN=Example CA'
+
+- name: Validate ownca certificate idempotence
+  assert:
+    that:
+      - ownca_certificate.serial_number == ownca_certificate_idempotence.serial_number
+      - ownca_certificate.notBefore == ownca_certificate_idempotence.notBefore
+      - ownca_certificate.notAfter == ownca_certificate_idempotence.notAfter
+
+- name: Validate ownca certificate v2 (test - ownca certificate version == 2)
+  shell: 'openssl x509 -noout  -in {{ output_dir}}/ownca_cert_v2.pem -text | grep "Version" | sed "s/.*: \(.*\) .*/\1/g"'
+  register: ownca_cert_v2_version
+
+- name: Validate ownca certificate version 2 (assert)
+  assert:
+    that:
+      - ownca_cert_v2_version.stdout == '2'
+
+- name: Validate ownca certificate2 (test - ownca certificate modulus)
+  shell: 'openssl x509 -noout -modulus -in {{ output_dir }}/ownca_cert2.pem'
+  register: ownca_cert2_modulus
+
+- name: Validate ownca certificate2 (assert)
+  assert:
+    that:
+      - ownca_cert2_modulus.stdout == privatekey2_modulus.stdout