2018-12-23 10:23:31 +01:00
|
|
|
---
|
2019-03-22 14:21:23 +01:00
|
|
|
- name: (Selfsigned validation, {{select_crypto_backend}}) Validate certificate (test - privatekey modulus)
|
2017-12-12 13:35:22 +01:00
|
|
|
shell: 'openssl rsa -noout -modulus -in {{ output_dir }}/privatekey.pem'
|
2017-09-13 23:39:32 +02:00
|
|
|
register: privatekey_modulus
|
|
|
|
|
2019-03-22 14:21:23 +01:00
|
|
|
- name: (Selfsigned validation, {{select_crypto_backend}}) Validate certificate (test - certificate modulus)
|
2017-12-12 13:35:22 +01:00
|
|
|
shell: 'openssl x509 -noout -modulus -in {{ output_dir }}/cert.pem'
|
2017-09-13 23:39:32 +02:00
|
|
|
register: cert_modulus
|
|
|
|
|
2019-03-22 14:21:23 +01:00
|
|
|
- name: (Selfsigned validation, {{select_crypto_backend}}) Validate certificate (test - issuer value)
|
2018-04-04 23:34:31 +02:00
|
|
|
shell: 'openssl x509 -noout -in {{ output_dir}}/cert.pem -text | grep "Issuer" | sed "s/.*: \(.*\)/\1/g; s/ //g;"'
|
2018-01-18 14:35:05 +01:00
|
|
|
register: cert_issuer
|
|
|
|
|
|
|
|
|
2019-03-22 14:21:23 +01:00
|
|
|
- name: (Selfsigned validation, {{select_crypto_backend}}) Validate certificate (test - certficate version == default == 3)
|
2017-09-14 15:21:32 +02:00
|
|
|
shell: 'openssl x509 -noout -in {{ output_dir}}/cert.pem -text | grep "Version" | sed "s/.*: \(.*\) .*/\1/g"'
|
|
|
|
register: cert_version
|
|
|
|
|
2019-03-22 14:21:23 +01:00
|
|
|
- name: (Selfsigned validation, {{select_crypto_backend}}) Validate certificate (assert)
|
2017-09-13 23:39:32 +02:00
|
|
|
assert:
|
|
|
|
that:
|
|
|
|
- cert_modulus.stdout == privatekey_modulus.stdout
|
2017-09-14 15:21:32 +02:00
|
|
|
- cert_version.stdout == '3'
|
2018-01-18 14:35:05 +01:00
|
|
|
- cert_issuer.stdout == 'CN=www.example.com'
|
2017-09-14 15:21:32 +02:00
|
|
|
|
2019-03-22 14:21:23 +01:00
|
|
|
- name: (Selfsigned validation, {{select_crypto_backend}}) Validate certificate idempotence
|
2017-12-18 10:04:34 +01:00
|
|
|
assert:
|
|
|
|
that:
|
|
|
|
- selfsigned_certificate.serial_number == selfsigned_certificate_idempotence.serial_number
|
|
|
|
- selfsigned_certificate.notBefore == selfsigned_certificate_idempotence.notBefore
|
|
|
|
- selfsigned_certificate.notAfter == selfsigned_certificate_idempotence.notAfter
|
|
|
|
|
2019-08-18 20:48:34 +02:00
|
|
|
- name: Make sure that changes in CSR are detected even if private key is specified
|
|
|
|
assert:
|
|
|
|
that:
|
|
|
|
- selfsigned_certificate_csr_minimal_change is changed
|
|
|
|
|
2019-03-22 14:21:23 +01:00
|
|
|
- block:
|
|
|
|
- name: (Selfsigned validation, {{select_crypto_backend}}) Validate certificate v2 (test - certificate version == 2)
|
|
|
|
shell: 'openssl x509 -noout -in {{ output_dir}}/cert_v2.pem -text | grep "Version" | sed "s/.*: \(.*\) .*/\1/g"'
|
|
|
|
register: cert_v2_version
|
|
|
|
|
|
|
|
- name: (Selfsigned validation, {{select_crypto_backend}}) Validate certificate version 2 (assert)
|
|
|
|
assert:
|
|
|
|
that:
|
|
|
|
- cert_v2_version.stdout == '2'
|
|
|
|
when: select_crypto_backend != 'cryptography'
|
|
|
|
|
|
|
|
- block:
|
|
|
|
- name: (Selfsigned validateion, {{ select_crypto_backend }} Validate certificate v2 is failed
|
|
|
|
assert:
|
|
|
|
that:
|
|
|
|
- selfsigned_v2_cert is failed
|
|
|
|
- "'The cryptography backend does not support v2 certificates' in selfsigned_v2_cert.msg"
|
|
|
|
when: select_crypto_backend == 'cryptography'
|
|
|
|
|
|
|
|
- name: (Selfsigned validation, {{select_crypto_backend}}) Validate certificate2 (test - privatekey modulus)
|
2017-12-12 13:35:22 +01:00
|
|
|
shell: 'openssl rsa -noout -modulus -in {{ output_dir }}/privatekey2.pem'
|
2017-09-13 23:39:32 +02:00
|
|
|
register: privatekey2_modulus
|
|
|
|
|
2019-03-22 14:21:23 +01:00
|
|
|
- name: (Selfsigned validation, {{select_crypto_backend}}) Validate certificate2 (test - certificate modulus)
|
2017-12-12 13:35:22 +01:00
|
|
|
shell: 'openssl x509 -noout -modulus -in {{ output_dir }}/cert2.pem'
|
2017-09-13 23:39:32 +02:00
|
|
|
register: cert2_modulus
|
|
|
|
|
2019-03-22 14:21:23 +01:00
|
|
|
- name: (Selfsigned validation, {{select_crypto_backend}}) Validate certificate2 (assert)
|
2017-09-13 23:39:32 +02:00
|
|
|
assert:
|
|
|
|
that:
|
|
|
|
- cert2_modulus.stdout == privatekey2_modulus.stdout
|
2018-10-26 05:41:00 +02:00
|
|
|
|
2019-03-22 14:21:23 +01:00
|
|
|
- name: (Selfsigned validation, {{select_crypto_backend}}) Validate certificate3 (test - notBefore)
|
2018-10-26 05:41:00 +02:00
|
|
|
shell: 'openssl x509 -noout -in {{ output_dir }}/cert3.pem -text | grep "Not Before" | sed "s/.*: \(.*\) .*/\1/g"'
|
|
|
|
register: cert3_notBefore
|
|
|
|
|
2019-03-22 14:21:23 +01:00
|
|
|
- name: (Selfsigned validation, {{select_crypto_backend}}) Validate certificate3 (test - notAfter)
|
2018-10-26 05:41:00 +02:00
|
|
|
shell: 'openssl x509 -noout -in {{ output_dir }}/cert3.pem -text | grep "Not After" | sed "s/.*: \(.*\) .*/\1/g"'
|
|
|
|
register: cert3_notAfter
|
|
|
|
|
2019-03-22 14:21:23 +01:00
|
|
|
- name: (Selfsigned validation, {{select_crypto_backend}}) Validate certificate3 (assert - notBefore)
|
2018-10-26 05:41:00 +02:00
|
|
|
assert:
|
|
|
|
that:
|
|
|
|
- cert3_notBefore.stdout == 'Oct 23 13:37:42 2018'
|
|
|
|
|
2019-03-22 14:21:23 +01:00
|
|
|
- name: (Selfsigned validation, {{select_crypto_backend}}) Validate certificate3 (assert - notAfter)
|
2018-10-26 05:41:00 +02:00
|
|
|
assert:
|
|
|
|
that:
|
|
|
|
- cert3_notAfter.stdout == 'Oct 23 13:37:42 2019'
|
2018-12-23 10:23:31 +01:00
|
|
|
|
2019-03-22 14:21:23 +01:00
|
|
|
- name: (Selfsigned validation, {{select_crypto_backend}}) Validate ECC certificate (test - privatekey's pubkey)
|
2018-12-23 10:23:31 +01:00
|
|
|
shell: 'openssl ec -pubout -in {{ output_dir }}/privatekey_ecc.pem'
|
|
|
|
register: privatekey_ecc_pubkey
|
|
|
|
|
2019-03-22 14:21:23 +01:00
|
|
|
- name: (Selfsigned validation, {{select_crypto_backend}}) Validate ECC certificate (test - certificate pubkey)
|
2018-12-23 10:23:31 +01:00
|
|
|
shell: 'openssl x509 -noout -pubkey -in {{ output_dir }}/cert_ecc.pem'
|
|
|
|
register: cert_ecc_pubkey
|
|
|
|
|
2019-03-22 14:21:23 +01:00
|
|
|
- name: (Selfsigned validation, {{select_crypto_backend}}) Validate ECC certificate (assert)
|
2018-12-23 10:23:31 +01:00
|
|
|
assert:
|
|
|
|
that:
|
|
|
|
- cert_ecc_pubkey.stdout == privatekey_ecc_pubkey.stdout
|
2019-03-08 17:21:18 +01:00
|
|
|
|
2019-03-22 14:21:23 +01:00
|
|
|
- name: (Selfsigned validation, {{select_crypto_backend}})
|
2019-03-08 17:21:18 +01:00
|
|
|
assert:
|
|
|
|
that:
|
|
|
|
- passphrase_error_1 is failed
|
|
|
|
- "'assphrase' in passphrase_error_1.msg or 'assword' in passphrase_error_1.msg"
|
|
|
|
- passphrase_error_2 is failed
|
2019-03-30 14:28:10 +01:00
|
|
|
- "'assphrase' in passphrase_error_2.msg or 'assword' in passphrase_error_2.msg or 'serializ' in passphrase_error_2.msg"
|
2019-03-08 17:21:18 +01:00
|
|
|
- passphrase_error_3 is failed
|
2019-03-30 14:28:10 +01:00
|
|
|
- "'assphrase' in passphrase_error_3.msg or 'assword' in passphrase_error_3.msg or 'serializ' in passphrase_error_3.msg"
|
|
|
|
|
|
|
|
- name: Verify that broken certificate will be regenerated
|
|
|
|
assert:
|
|
|
|
that:
|
|
|
|
- selfsigned_broken is changed
|
2019-03-30 15:38:43 +01:00
|
|
|
|
|
|
|
- name: Check backup
|
|
|
|
assert:
|
|
|
|
that:
|
|
|
|
- selfsigned_backup_1 is changed
|
|
|
|
- selfsigned_backup_1.backup_file is undefined
|
|
|
|
- selfsigned_backup_2 is not changed
|
|
|
|
- selfsigned_backup_2.backup_file is undefined
|
|
|
|
- selfsigned_backup_3 is changed
|
|
|
|
- selfsigned_backup_3.backup_file is string
|
|
|
|
- selfsigned_backup_4 is changed
|
|
|
|
- selfsigned_backup_4.backup_file is string
|
|
|
|
- selfsigned_backup_5 is not changed
|
|
|
|
- selfsigned_backup_5.backup_file is undefined
|
2019-08-23 14:01:42 +02:00
|
|
|
|
|
|
|
- name: Check create subject key identifier
|
|
|
|
assert:
|
|
|
|
that:
|
|
|
|
- selfsigned_subject_key_identifier_1 is changed
|
|
|
|
- selfsigned_subject_key_identifier_2 is not changed
|
|
|
|
- selfsigned_subject_key_identifier_3 is changed
|
|
|
|
- selfsigned_subject_key_identifier_4 is not changed
|
|
|
|
- selfsigned_subject_key_identifier_5 is changed
|
|
|
|
when: select_crypto_backend != 'pyopenssl'
|