thalesgroup.ciphertrust.cm_certificate_authority module – Create and manage CipherTrust Manager Local CA

Note

This module is part of the thalesgroup.ciphertrust collection (version 1.0.2).

It is not included in ansible-core. To check whether it is installed, run ansible-galaxy collection list.

To install it, use: ansible-galaxy collection install thalesgroup.ciphertrust.

To use it in a playbook, specify: thalesgroup.ciphertrust.cm_certificate_authority.

New in thalesgroup.ciphertrust 1.0.0

Synopsis

  • Create and edit local Certificate Authority on CipherTrust Manager

Parameters

Parameter

Comments

algorithm

string

RSA or ECDSA (default) algorithms are supported.

Signature algorithm is selected based on the algorithm and size.

Choices:

  • "RSA"

  • "ECDSA"

allow_client_authentication

boolean

If set to true, the certificates signed by the specified CA can be used for client authentication.

Choices:

  • false

  • true

allow_user_authentication

boolean

If set to true, the certificates signed by the specified CA can be used for user authentication.

Choices:

  • false

  • true

cert_id

string

Certificate ID

cn

string

Common Name

csr

string

CSR in PEM format

csrParams

dictionary

Parameters to be used during creating CSR like the subject, x509 extensions and signature algorithm used.

cn

string

Common Name

dnsNames

list / elements=string

Subject Alternative Names (SAN) values

emailAddresses

list / elements=string

E-mail addresses

extendedKeyUsage

list / elements=string

List of names of the permitted extended key usages added as CSR extensions

Valid values can be one or more of any

serverAuth

clientAuth

codeSigning

emailProtection

ipsecEndSystem

ipsecTunnel

ipsecUser

timeStamping

ocspSigning

microsoftServerGatedCrypto

netscapeServerGatedCrypto

microsoftCommercialCodeSigning

microsoftKernelCodeSigning

These keyUsage are allowed for CSR creation

ipAddresses

list / elements=string

IP addresses

isCA

boolean

If set, the value of the basic constraints extension value for CA is set to that boolean value and unset otherwise.

Choices:

  • false

  • true

keyUsage

list / elements=string

List of names of the permitted key usages added as CSR extensions.

Valid values can be one or more of

digitalSignature

contentCommitment

keyEncipherment

dataEncipherment

keyAgreement

keyCertSign

crlSign

encipherOnly

decipherOnly

These keyUsage are allowed for CSR creation.

maxPathLen

integer

This parameter is valid only when is CA parameter is set to true

Specifies the maximum number of CAs that can appear below this one in a chain

If maxPathLen is -1, pathlen is unset.

names

list / elements=dictionary

Name fields are “O=organization, OU=organizational unit, L=location, ST=state/province, C=country”.

Fields can be duplicated if present in different objects.

C

string

Country, for example “US”

L

string

Location, for example “Belcamp”

O

string

Organization, for example “Thales Group”

OU

string

Organizational Unit, for example “RnD”

ST

string

State/province, for example “MD”

signatureAlgorithm

string

Signature algorithm used for creating the CSR.

Choices:

  • "sha512WithRSA"

  • "sha384WithRSA"

  • "sha256WithRSA"

  • "sha1WithRSA"

  • "ecdsaWithSHA512"

  • "ecdsaWithSHA384"

  • "ecdsaWithSHA256"

  • "ecdsaWithSHA1"

subjectKeyIdentifierHash

boolean

If set to true, the Subject Key Identifier extension is set to the hash specified by RFC5280, else unset

Choices:

  • false

  • true

dnsNames

list / elements=string

Subject Alternative Names (SAN) values

duration

integer

Duration in days of certificate. Either duration or notAfter date must be specified.

emailAddresses

list / elements=string

E-mail addresses

encryptionAlgo

string

Private key encryption algorithm.

Choices:

  • "AES256"

  • "AES192"

  • "AES128"

  • "TDES"

id

string

ID

ipAddresses

list / elements=string

IP addresses

keyGenParams

dictionary

Parameters to be used for creating an asymmetric key to be used for CSR creation.

algorithm

string

Algorithm of key to be generated for CSR creation.

Permitted values are ‘RSA’ or ‘EC’ and defaults to ‘RSA’

Choices:

  • "RSA" ← (default)

  • "EC"

curveid

string

Cryptographic curve id for elliptic key

Choices:

  • "secp224r1"

  • "secp384r1"

  • "secp521r1"

  • "prime256v1"

keyName

string

Name of key to be generated for CSR creation

size

string

Size of key to be generated for CSR creation

Refer create key API for sizes for EC and RSA keys and their default values.

keyID

string

Type of the identifier, keyID, for the private key to be used for creating CSR.

keyIDType

string

Parameters to be used for creating an asymmetric key to be used for CSR creation.

keyVersion

integer

Version of the private key, keyID, to be used for creating CSR.

localNode

dictionary / required

this holds the connection parameters required to communicate with an instance of CipherTrust Manager (CM)

holds IP/FQDN of the server, username, password, and port

auth_domain_path

string / required

user’s domain path

password

string / required

admin password of CM

server_ip

string / required

CM Server IP or FQDN

server_port

integer / required

Port on which CM server is listening

server_private_ip

string / required

internal or private IP of the CM Server, if different from the server_ip

user

string / required

admin username of CM

verify

boolean / required

if SSL verification is required

Choices:

  • false

  • true

name

string

A unique name of CA, if not provided, will be set to localca-<id>.

names

list / elements=dictionary

Name fields are “O=organization, OU=organizational unit, L=location, ST=state/province, C=country”.

Fields can be duplicated if present in different objects.

C

string

Country, for example “US”

L

string

Location, for example “Belcamp”

O

string

Organization, for example “Thales Group”

OU

string

Organizational Unit, for example “RnD”

ST

string

State/province, for example “MD”

notAfter

string

End date of certificate

Either notAfter or duration must be specified

notAfter overrides duration if both are given.

notBefore

string

Start date of certificate

op_type

string / required

Operation to be performed

Choices:

  • "create"

  • "patch"

  • "issue-cert"

  • "self-sign"

  • "revoke-cert"

  • "resume-cert"

  • "create-csr"

  • "create-csr-key"

password

string

Password to PEM-encrypt the private key. If not specified, the private key is not encrypted in return.

privateKeyBytes

string

Private Key bytes of the key which is to be used while creating CSR(Algorithm and size should be according to this key).

If not given will generate key internally as per algorithm and size.

purpose

string

server, client or ca

Choices:

  • "server"

  • "client"

  • "ca"

reason

string

Specify one of the reason.

Choices:

  • "unspecified"

  • "keyCompromise"

  • "cACompromise"

  • "affiliationChanged"

  • "superseded"

  • "cessationOfOperation"

  • "certificateHold"

  • "removeFromCRL"

  • "privilegeWithdrawn"

  • "aACompromise"

size

integer

Key size

Examples

- name: "Create CM Local CA"
  thalesgroup.ciphertrust.cm_certificate_authority:
    localNode:
      server_ip: "IP/FQDN of CipherTrust Manager"
      server_private_ip: "Private IP in case that is different from above"
      server_port: 5432
      user: "CipherTrust Manager Username"
      password: "CipherTrust Manager Password"
      verify: false
      auth_domain_path:
    op_type: create
    cn: local_ca_ansible
    name: AnsibleLocalCA
    algorithm: RSA
    size: 4096
    names:
      - C: CA
        ST: ontario
        L: ottawa
        O: ciphertrust
        OU: test
  register: ca

- name: Self sign the CA
  thalesgroup.ciphertrust.cm_certificate_authority:
    localNode:
      server_ip: "IP/FQDN of CipherTrust Manager"
      server_private_ip: "Private IP in case that is different from above"
      server_port: 5432
      user: "CipherTrust Manager Username"
      password: "CipherTrust Manager Password"
      verify: false
      auth_domain_path:
    op_type: self-sign
    id: "ca_id"
    duration: 365

- name: Create CSR
  thalesgroup.ciphertrust.cm_certificate_authority:
    localNode:
      server_ip: "IP/FQDN of CipherTrust Manager"
      server_private_ip: "Private IP in case that is different from above"
      server_port: 5432
      user: "CipherTrust Manager Username"
      password: "CipherTrust Manager Password"
      verify: false
      auth_domain_path:
    op_type: create-csr-key
    cn: csr
    name: AnsibleCSR
    algorithm: RSA
    size: 2048
    ipAddresses:
      - 10.1.1.10
    names:
      - C: CA
        ST: ontario
        L: ottawa
        O: ciphertrust
        OU: test
    encryptionAlgo: AES256
  register: csr

- name: Issue Certificate
  thalesgroup.ciphertrust.cm_certificate_authority:
    localNode:
      server_ip: "IP/FQDN of CipherTrust Manager"
      server_private_ip: "Private IP in case that is different from above"
      server_port: 5432
      user: "CipherTrust Manager Username"
      password: "CipherTrust Manager Password"
      verify: false
      auth_domain_path:
    op_type: issue-cert
    id: "ca_id"
    csr: "csr"
    purpose: server
    duration: 365
    name: AnsibleServerCert
  register: cert

Authors

  • Anurag Jain (@anugram)