openssl_csr - Generate OpenSSL Certificate Signing Request (CSR)  New in version 2.4.   
Synopsis Requirements   Parameters Notes Examples Return Values 
Status Author    Synopsis  This module allows one to (re)generate OpenSSL certificate signing requests. It uses the pyOpenSSL python library to interact with openssl. This module supports the subjectAltName, keyUsage, extendedKeyUsage, basicConstraints and OCSP Must Staple extensions.  Requirements The below requirements are needed on the host that executes this module.  python-pyOpenSSL >= 0.15  Parameters   Parameter Choices/Defaults Comments    attributes (added in 2.3)   Default:None   Attributes the file or directory should have. To get supported flags look at the man page for chattr on the target system. This string should contain the attributes in the same order as the one displayed by lsattr. 
aliases: attr     basic_constraints (added in 2.5)     Indicates basic constraints, such as if the certificate is a CA. 
aliases: basicConstraints     basic_constraints_critical (added in 2.5)     Should the basicConstraints extension be considered as critical 
aliases: basicConstraints_critical     common_name     commonName field of the certificate signing request subject 
aliases: CN, commonName     country_name     countryName field of the certificate signing request subject 
aliases: C, countryName     digest   Default:sha256   Digest used when signing the certificate signing request with the private key     email_address     emailAddress field of the certificate signing request subject 
aliases: E, emailAddress     extended_key_usage     Additional restrictions (e.g. client authentication, server authentication) on the allowed purposes for which the public key may be used. This can either be a 'comma separated string' or a YAML list. 
aliases: extKeyUsage, extendedKeyUsage     extended_key_usage_critical     Should the extkeyUsage extension be considered as critical 
aliases: extKeyUsage_critical, extendedKeyUsage_critical     force   
Choices: yes 
no ←  Default:no   Should the certificate signing request be forced regenerated by this ansible module     group   Default:None   Name of the group that should own the file/directory, as would be fed to chown.     key_usage     This defines the purpose (e.g. encipherment, signature, certificate signing) of the key contained in the certificate. This can either be a 'comma separated string' or a YAML list. 
aliases: keyUsage     key_usage_critical     Should the keyUsage extension be considered as critical 
aliases: keyUsage_critical     locality_name     localityName field of the certificate signing request subject 
aliases: L, localityName     mode   Default:None   Mode the file or directory should be. For those used to /usr/bin/chmod remember that modes are actually octal numbers (like 0644 or 01777). Leaving off the leading zero will likely have unexpected results. As of version 1.8, the mode may be specified as a symbolic mode (for example, u+rwx or u=rw,g=r,o=r).     ocsp_must_staple (added in 2.5)     Indicates that the certificate should contain the OCSP Must Staple extension (https://tools.ietf.org/html/rfc7633). 
aliases: ocspMustStaple     ocsp_must_staple_critical (added in 2.5)     Should the OCSP Must Staple extension be considered as critical Warning: according to the RFC, this extension should not be marked as critical, as old clients not knowing about OCSP Must Staple are required to reject such certificates (see https://tools.ietf.org/html/rfc7633#section-4). 
aliases: ocspMustStaple_critical     organization_name     organizationName field of the certificate signing request subject 
aliases: O, organizationName     organizational_unit_name     organizationalUnitName field of the certificate signing request subject 
aliases: OU, organizationalUnitName     owner   Default:None   Name of the user that should own the file/directory, as would be fed to chown.     path required     Name of the file into which the generated OpenSSL certificate signing request will be written     privatekey_passphrase     The passphrase for the privatekey.     privatekey_path required     Path to the privatekey to use when signing the certificate signing request     selevel   Default:s0   Level part of the SELinux file context. This is the MLS/MCS attribute, sometimes known as the range. _default feature works as for seuser.     serole   Default:None   Role part of SELinux file context, _default feature works as for seuser.     setype   Default:None   Type part of SELinux file context, _default feature works as for seuser.     seuser   Default:None   User part of SELinux file context. Will default to system policy, if applicable. If set to _default, it will use the user portion of the policy if available.     state   
Choices: 
present ← absent    Whether the certificate signing request should exist or not, taking action if the state is different from what is stated.     state_or_province_name     stateOrProvinceName field of the certificate signing request subject 
aliases: ST, stateOrProvinceName     subject (added in 2.5)     Key/value pairs that will be present in the subject name field of the certificate signing request. If you need to specify more than one value with the same key, use a list as value.     subject_alt_name     SAN extension to attach to the certificate signing request This can either be a 'comma separated string' or a YAML list. Values should be prefixed by their options. (i.e., email, URI, DNS, RID, IP, dirName, otherName and the ones specific to your CA) More at https://tools.ietf.org/html/rfc5280#section-(573)280-6518
 
aliases: subjectAltName     subject_alt_name_critical     Should the subjectAltName extension be considered as critical 
aliases: subjectAltName_critical     unsafe_writes (added in 2.2)   
Choices: 
no ← yes    Normally this module uses atomic operations to prevent data corruption or inconsistent reads from the target files, sometimes systems are configured or just broken in ways that prevent this. One example are docker mounted files, they cannot be updated atomically and can only be done in an unsafe manner. This boolean option allows ansible to fall back to unsafe methods of updating files for those cases in which you do not have any other choice. Be aware that this is subject to race conditions and can lead to data corruption.     version   Default:1   Version of the certificate signing request     Notes  Note  If the certificate signing request already exists it will be checked whether subjectAltName, keyUsage, extendedKeyUsage and basicConstraints only contain the requested values, whether OCSP Must Staple is as requested, and if the request was signed by the given private key.   Examples # Generate an OpenSSL Certificate Signing Request
- openssl_csr:
    path: /etc/ssl/csr/www.ansible.com.csr
    privatekey_path: /etc/ssl/private/ansible.com.pem
    common_name: www.ansible.com

# Generate an OpenSSL Certificate Signing Request with a
# passphrase protected private key
- openssl_csr:
    path: /etc/ssl/csr/www.ansible.com.csr
    privatekey_path: /etc/ssl/private/ansible.com.pem
    privatekey_passphrase: ansible
    common_name: www.ansible.com

# Generate an OpenSSL Certificate Signing Request with Subject information
- openssl_csr:
    path: /etc/ssl/csr/www.ansible.com.csr
    privatekey_path: /etc/ssl/private/ansible.com.pem
    country_name: FR
    organization_name: Ansible
    email_address: omoore@example.com
    common_name: www.ansible.com

# Generate an OpenSSL Certificate Signing Request with subjectAltName extension
- openssl_csr:
    path: /etc/ssl/csr/www.ansible.com.csr
    privatekey_path: /etc/ssl/private/ansible.com.pem
    subject_alt_name: 'DNS:www.ansible.com,DNS:m.ansible.com'

# Force re-generate an OpenSSL Certificate Signing Request
- openssl_csr:
    path: /etc/ssl/csr/www.ansible.com.csr
    privatekey_path: /etc/ssl/private/ansible.com.pem
    force: True
    common_name: www.ansible.com

# Generate an OpenSSL Certificate Signing Request with special key usages
- openssl_csr:
    path: /etc/ssl/csr/www.ansible.com.csr
    privatekey_path: /etc/ssl/private/ansible.com.pem
    common_name: www.ansible.com
    key_usage:
      - digitalSignature
      - keyAgreement
    extended_key_usage:
      - clientAuth

# Generate an OpenSSL Certificate Signing Request with OCSP Must Staple
- openssl_csr:
    path: /etc/ssl/csr/www.ansible.com.csr
    privatekey_path: /etc/ssl/private/ansible.com.pem
    common_name: www.ansible.com
    ocsp_must_staple: true
 Return Values Common return values are documented here, the following are the fields unique to this module:   Key Returned Description    basicConstraints list  changed or success  Indicates if the certificate belongs to a CA  Sample: ['CA:TRUE', 'pathLenConstraint:0']     extendedKeyUsage list  changed or success  Additional restriction on the public key purposes  Sample: ['clientAuth']     filename string  changed or success  Path to the generated Certificate Signing Request  Sample: /etc/ssl/csr/www.ansible.com.csr     keyUsage list  changed or success  Purpose for which the public key may be used  Sample: ['digitalSignature', 'keyAgreement']     ocsp_must_staple bool  changed or success  Indicates whether the certificate has the OCSP Must Staple feature enabled      privatekey string  changed or success  Path to the TLS/SSL private key the CSR was generated for  Sample: /etc/ssl/private/ansible.com.pem     subject list  changed or success  A list of the subject tuples attached to the CSR  Sample: [('CN', 'www.ansible.com'), ('O', 'Ansible')]     subjectAltName list  changed or success  The alternative names this CSR is valid for  Sample: ['DNS:www.ansible.com', 'DNS:m.ansible.com']     Status This module is flagged as preview which means that it is not guaranteed to have a backwards compatible interface. Author  Yanis Guenane (@Spredzy)   Hint If you notice any issues in this documentation you can edit this document to improve it. 

    © 2012–2018 Michael DeHaan
{'path': 'public/docs/ansible~2.5/modules/openssl_csr_module.html', 'source': 'DevDocs.IO'}