AnsibleByExample

community.crypto 3.4.0 Released - New PKCS#12 Modules and select_crypto_backend Deprecations

Beginner
2024-01-013By Luca Berton

Lesson 1 of 15 in Foundations

Ansible Foundations to Production — full curriculum
  1. 1. Introduction to Ansible and Automation
  2. 2. Installing and Configuring Ansible
  3. 3. Running Ad-Hoc Commands
  4. 4. Writing Your First Playbook
  5. 5. Understanding and Using Modules
  6. 6. Variables and Facts
  7. 7. Conditionals and Loops
  8. 8. Handlers and Idempotency
  9. 9. Structuring Projects with Roles
  10. 10. Inventory Management
  11. 11. Using Ansible Vault for Secrets
  12. 12. Debugging and Troubleshooting
  13. 13. Real-World Automation Examples
  14. 14. Final Project: Deploy a Web Server
  15. 15. Bonus - What's Next with Ansible?
View path overview →

community.crypto 3.4.0 Released - New PKCS#12 Modules and select_crypto_backend Deprecations

Introduction

community.crypto is the Ansible collection that provides modules and plugins for managing X.509 certificates, private/public keys, certificate signing requests, PKCS#12 archives, and other cryptographic material via OpenSSL, cryptography, or acme backends. Version 3.4.0 has just been published on Ansible Galaxy and is the first version tracked on this blog, so this post covers exactly what changed in this release according to the collection's own changelog.

Whats New

Release Summary

According to the changelog, 3.4.0 is a feature release whose main additions are two new PKCS#12-related modules, accompanied by a broad deprecation of the select_crypto_backend option across most crypto modules in the collection.

New Modules

  • community.crypto.openssl_pkcs12_extract - extracts certificate and private key from a PKCS#12 archive.
  • community.crypto.openssl_pkcs12_info - returns certificates and, optionally, the private key contained in a PKCS#12 file.

These two modules complement the existing openssl_pkcs12 module, which handles creation of PKCS#12 archives, by giving users a way to inspect and extract data from existing .p12/.pfx files without shelling out to openssl manually.

Deprecated Features

The select_crypto_backend option is now deprecated in the following modules and will be removed in community.crypto 4.0.0 (tracked in PR #1072):

  • get_certificate
  • openssl_csr
  • openssl_csr_info
  • openssl_csr_pipe
  • openssl_pkcs12
  • openssl_privatekey
  • openssl_privatekey_info
  • openssl_privatekey_pipe
  • openssl_publickey
  • openssl_publickey_info
  • openssl_signature
  • openssl_signature_info
  • x509_certificate
  • x509_certificate_info
  • x509_certificate_pipe

In practice this means the cryptography backend is becoming the only supported backend going forward, and the legacy pyopenssl backend selection is on its way out. Playbooks that explicitly set select_crypto_backend on any of the modules above will start emitting deprecation warnings and should be updated before community.crypto 4.0.0 ships.

Affected Components

ComponentChange
openssl_pkcs12_extractNew module
openssl_pkcs12_infoNew module
15 crypto modules (see list above)select_crypto_backend deprecated, removal planned for 4.0.0

How to Install and Verify

# Install (or upgrade to) community.crypto 3.4.0
ansible-galaxy collection install community.crypto:==3.4.0

# Check the installed version
ansible-galaxy collection list community.crypto

# Inspect documentation for the new modules
ansible-doc community.crypto.openssl_pkcs12_extract
ansible-doc community.crypto.openssl_pkcs12_info

# Search playbooks for the option being deprecated
grep -rn "select_crypto_backend" .

Conclusion

Anyone managing PKCS#12 archives with Ansible should look at openssl_pkcs12_extract and openssl_pkcs12_info in 3.4.0, since they remove the need for ad-hoc openssl shell commands to inspect .p12 files. At the same time, teams still pinning select_crypto_backend to pyopenssl in any of the 15 affected modules should plan a migration to the cryptography backend before community.crypto 4.0.0 removes the option entirely.

All Tutorials