Skip to content
This repository was archived by the owner on May 30, 2025. It is now read-only.

Commit c2dee68

Browse files
arykalinarykalin
authored
Merge pull request #20 from Venafi/release-fix
Release fix
2 parents 628c79e + e6d2516 commit c2dee68

File tree

7 files changed

+49
-28
lines changed

7 files changed

+49
-28
lines changed

‎library/venafi_certificate.py

Lines changed: 22 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -270,7 +270,8 @@
270270
'''
271271
# Some strings variables
272272
STRING_FAILED_TO_CHECK_CERT_VALIDITY = "Certificate is not yet valid, " \
273-
"has expired, or has CN or SANs that differ from the request"
273+
"has expired, or has CN or SANs " \
274+
"that differ from the request"
274275
STRING_PKEY_NOT_MATCHED = "Private key does not match certificate public key"
275276
STRING_BAD_PKEY = "Private key file does not contain a valid private key"
276277
STRING_CERT_FILE_NOT_EXISTS = "Certificate file does not exist"
@@ -450,26 +451,33 @@ def _check_certificate_validity(self, cert, validate):
450451
% (cn, self.common_name)
451452
)
452453
return False
453-
if cert.not_valid_after - datetime.timedelta(
454-
hours=self.before_expired_hours) < datetime.datetime.now():
454+
# Check if certificate not already expired
455+
if cert.not_valid_after < datetime.datetime.now():
455456
self.changed_message.append(
456-
'Hours before certificate expiration date %s '
457-
'is less than before_expired_hours value %s'
457+
'Certificate expiration date %s '
458+
'is less than current time %s (certificate expired)'
458459
% (cert.not_valid_after, self.before_expired_hours)
459460
)
460-
# Do not return false if we're just validating existing certificate
461-
if validate:
462-
return True
463-
else:
461+
return False
462+
# Check if certificate expiring time is greater than
463+
# before_expired_hours (only for creating new certificate)
464+
if not validate:
465+
if cert.not_valid_after - datetime.timedelta(
466+
hours=self.before_expired_hours) < datetime.datetime.now():
467+
self.changed_message.append(
468+
'Hours before certificate expiration date %s '
469+
'is less than before_expired_hours value %s'
470+
% (cert.not_valid_after, self.before_expired_hours)
471+
)
464472
return False
465473
if cert.not_valid_before - datetime.timedelta(
466474
hours=24) > datetime.datetime.now():
467475
self.changed_message.append(
468476
"Certificate expiration date %s "
469477
"is set to future from server time %s."
470478
% (cert.not_valid_before -
471-
datetime.timedelta(hours=24),
472-
(datetime.datetime.now()))
479+
datetime.timedelta(hours=24),
480+
(datetime.datetime.now()))
473481
)
474482
return False
475483
ips = []
@@ -482,7 +490,7 @@ def _check_certificate_validity(self, cert, validate):
482490
elif isinstance(e, x509.general_name.IPAddress):
483491
ips.append(e.value.exploded)
484492
if self.ip_addresses and sorted(self.ip_addresses) != sorted(ips):
485-
self.changed_message.append("IP addresses in request: %s and in "
493+
self.changed_message.append("IP address in request: %s and in"
486494
"certificate: %s are different"
487495
% (sorted(self.ip_addresses), ips))
488496
self.changed_message.append("CN is %s" % cn)
@@ -533,7 +541,7 @@ def _check_files_permissions(self):
533541
def _check_file_permissions(self, path, update=False):
534542
return True # todo: write
535543

536-
def check(self,validate):
544+
def check(self, validate):
537545
"""Return true if running will change anything"""
538546
result = {
539547
'cert_file_exists': True,
@@ -544,7 +552,7 @@ def check(self,validate):
544552
'cert_file_exists': False,
545553
'changed': True,
546554
'changed_msg':
547-
self.changed_message.append(STRING_CERT_FILE_NOT_EXISTS),
555+
self.changed_message.append(STRING_CERT_FILE_NOT_EXISTS),
548556
}
549557
else:
550558
try:

‎molecule/default/playbook.yml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@
1515
certificate_cert_dir: "/tmp/ansible/etc/ssl/{{ certificate_common_name }}"
1616
certificate_cert_path: "{{ certificate_cert_dir }}/{{ certificate_common_name }}.pem"
1717
certificate_chain_path: "{{ certificate_cert_dir }}/{{ certificate_common_name }}.chain.pem"
18+
certificate_privatekey_size: "4096"
1819
certificate_privatekey_path: "{{ certificate_cert_dir }}/{{ certificate_common_name }}.key"
1920
certificate_csr_path: "{{ certificate_cert_dir }}/{{ certificate_common_name }}.csr"
2021

‎tasks/local-certificate.yml

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,8 +22,9 @@
2222
cert_path: "{{ certificate_cert_path }}"
2323
chain_path: "{{ certificate_chain_path if certificate_chain_path is defined else None }}"
2424
privatekey_path: "{{ certificate_privatekey_path if certificate_privatekey_path is defined else None }}"
25+
privatekey_size: "{{ certificate_privatekey_size if certificate_privatekey_size is defined else None }}"
2526
common_name: "{{ certificate_common_name }}"
26-
alt_name: "{{ certificate_alt_name if certificate_alt_name is defined else None }}"
27+
alt_name: "{{ certificate_alt_name | default([]) }}"
2728
before_expired_hours: "{{ certificate_before_expired_hours if certificate_before_expired_hours is defined else 72 }}"
2829
force: "{{ certificate_force if certificate_force is defined else false }}"
2930
register: certout

‎tasks/remote-certificate.yml

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,8 +12,9 @@
1212
cert_path: "{{ certificate_cert_path }}"
1313
chain_path: "{{ certificate_chain_path if certificate_chain_path is defined else None }}"
1414
privatekey_path: "{{ certificate_privatekey_path if certificate_privatekey_path is defined else None }}"
15+
privatekey_size: "{{ certificate_privatekey_size if certificate_privatekey_size is defined else None }}"
1516
common_name: "{{ certificate_common_name }}"
16-
alt_name: "{{ certificate_alt_name if certificate_alt_name is defined else None }}"
17+
alt_name: "{{ certificate_alt_name | default([]) }}"
1718
before_expired_hours: "{{ certificate_before_expired_hours if certificate_before_expired_hours is defined else None }}"
1819
force: "{{ certificate_force if certificate_force is defined else false }}"
1920
register: certout

‎tests/jeremy-playbook.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,15 +6,15 @@
66
certificate_common_name: "ansible-test.se.venafi.com"
77
certificate_cert_dir: "/tmp/etc/ssl/{{ certificate_common_name }}"
88

9-
certificate_alt_name: "IP:192.168.1.1,DNS:san-example.se.com"
9+
certificate_alt_name: "IP:192.168.0.15,DNS:ansible-test-ext.se.venafi.com"
1010
#certificate_alt_name: "IP:192.168.1.1,DNS:www.venafi.example.com,DNS:m.venafi.example.com,email:e@venafi.com,email:e2@venafi.com,IP Address:192.168.2.2"
1111

1212
certificate_privatekey_type: "RSA"
1313
certificate_privatekey_size: "2048"
1414
#certificate_privatekey_curve: "P251"
1515
#certificate_privatekey_passphrase: "password"
1616
#certificate_chain_option: "last"
17-
certificate_before_expired_hours: 72
17+
certificate_before_expired_hours: 2000
1818

1919
#certificate_cert_dir: "/etc/ssl/{{ certificate_common_name }}"
2020
certificate_cert_path: "{{ certificate_cert_dir }}/{{ certificate_common_name }}.pem"

‎tests/test_venafi_certificate.py

Lines changed: 19 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77
CURRENT_DIR = os.path.dirname(os.path.abspath(__file__))
88

99

10-
testAsset = namedtuple("testAssert", "is_valid cert chain private_key password common_name alt_name")
10+
testAsset = namedtuple("testAssert", "is_valid cert chain private_key password common_name alt_name id")
1111

1212
CERT_PATH = "/tmp/cert.pem"
1313
CHAIN_PATH = "/tmp/chain.pem"
@@ -41,6 +41,7 @@ def fail_json(self, **kwargs):
4141
class TestVcertificate(unittest.TestCase):
4242
def test_validate(self):
4343
for asset in TEST_ASSETS:
44+
print("testing asset id %s" % asset.id)
4445
create_testfiles(asset)
4546
module = FakeModule(asset)
4647
vcert = VCertificate(module)
@@ -62,26 +63,34 @@ def create_testfiles(asset):
6263

6364
TEST_ASSETS = [
6465
#simple valid
65-
testAsset(is_valid=True, cert="valid_rsa2048_cert.pem", chain="valid_rsa2048_chain.pem", private_key="valid_rsa2048_key.pem", password=None, common_name="test111.venafi.example.com", alt_name=None),
66+
testAsset(is_valid=True, cert="valid_rsa2048_cert.pem", chain="valid_rsa2048_chain.pem",
67+
private_key="valid_rsa2048_key.pem", password=None, common_name="test111.venafi.example.com",
68+
alt_name=None,id=1),
6669
#another cn
67-
testAsset(is_valid=False, cert="valid_rsa2048_cert.pem", chain="valid_rsa2048_chain.pem", private_key="valid_rsa2048_key.pem", password=None, common_name="test1111.venafi.example.com", alt_name=None),
70+
testAsset(is_valid=False, cert="valid_rsa2048_cert.pem", chain="valid_rsa2048_chain.pem",
71+
private_key="valid_rsa2048_key.pem", password=None, common_name="test1111.venafi.example.com", alt_name=None,id=2),
6872
#corrupted file
69-
testAsset(is_valid=False, cert="invalid_cert.pem", chain="valid_rsa2048_chain.pem", private_key="valid_rsa2048_key.pem", password=None, common_name="test111.venafi.example.com", alt_name=None),
73+
testAsset(is_valid=False, cert="invalid_cert.pem", chain="valid_rsa2048_chain.pem",
74+
private_key="valid_rsa2048_key.pem", password=None, common_name="test111.venafi.example.com", alt_name=None,id=3),
7075
#unmactched cn
71-
testAsset(is_valid=False, cert="invalid_cn_rsa2048_cert.pem", chain="valid_rsa2048_chain.pem", private_key="valid_rsa2048_key.pem", password=None, common_name="test111.venafi.example.com", alt_name=None),
76+
testAsset(is_valid=False, cert="invalid_cn_rsa2048_cert.pem", chain="valid_rsa2048_chain.pem",
77+
private_key="valid_rsa2048_key.pem", password=None, common_name="test111.venafi.example.com", alt_name=None,id=4),
7278
# unmatched key type
73-
testAsset(is_valid=False, cert="valid_rsa2048_cert.pem", chain="valid_rsa2048_chain.pem", private_key="valid_ec_key.pem", password=None, common_name="test1111.venafi.example.com", alt_name=None),
74-
79+
testAsset(is_valid=False, cert="valid_rsa2048_cert.pem", chain="valid_rsa2048_chain.pem",
80+
private_key="valid_ec_key.pem", password=None, common_name="test1111.venafi.example.com", alt_name=None,id=5),
7581
#valid with dns
7682
testAsset(is_valid=True, cert="valid_alt_rsa2048_cert.pem", chain="valid_rsa2048_chain.pem",
7783
private_key="valid_rsa2048_key.pem", password=None, common_name="test123.venafi.example.com",
78-
alt_name="IP:192.168.1.1,DNS:www.venafi.example.com,DNS:m.venafi.example.com,email:e@venafi.com,email:e2@venafi.com,IP Address:192.168.2.2"),
84+
alt_name="IP:192.168.1.1,DNS:www.venafi.example.com,DNS:m.venafi.example.com,email:e@venafi.com,"
85+
"email:e2@venafi.com,IP Address:192.168.2.2",id=6),
7986
#invalid with dns
8087
testAsset(is_valid=False, cert="valid_alt_rsa2048_cert.pem", chain="valid_rsa2048_chain.pem",
8188
private_key="valid_rsa2048_key.pem", password=None, common_name="test123.venafi.example.com",
82-
alt_name="IP:192.168.1.1,DNS:www.venafi.example.com,DNS:m.venafi.example.com,email:e@venafi.com,email:e2@venafi.com"),
89+
alt_name="IP:192.168.1.1,DNS:www.venafi.example.com,DNS:m.venafi.example.com,email:e@venafi.com,"
90+
"email:e2@venafi.com",id=7),
8391
#expired
8492
testAsset(is_valid=False, cert="invalid_date_rsa2048_cert.pem", chain="valid_rsa2048_chain.pem",
85-
private_key="valid_rsa2048_key.pem", password=None, common_name="test123.venafi.example.com", alt_name=None)
93+
private_key="valid_rsa2048_key.pem", password=None, common_name="test123.venafi.example.com",
94+
alt_name=None,id=8)
8695
]
8796

‎tests/venafi-playbook-example.yml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -74,6 +74,7 @@
7474
cert_path: "{{ certificate_cert_path }}"
7575
chain_path: "{{ certificate_chain_path if certificate_chain_path is defined else None }}"
7676
privatekey_path: "{{ certificate_privatekey_path if certificate_privatekey_path is defined else None }}"
77+
privatekey_size: "{{ certificate_privatekey_size if certificate_privatekey_size is defined else None }}"
7778
common_name: "{{ certificate_common_name }}"
7879
register: certout
7980
- name: "Certificate is in following state:"

0 commit comments

Comments
 (0)