Community.Crypto Release Notes

v2.21.1

Release Summary

Maintenance release.

Bugfixes

v2.21.0

Release Summary

Feature release.

Minor Changes

v2.20.0

Release Summary

Feature and bugfix release.

The deprecations in this release are only relevant for collections that use shared code or docs fragments from this collection.

Minor Changes

Deprecated Features

Bugfixes

  • x509_crl, x509_certificate, x509_certificate_info - when parsing absolute timestamps which omitted the second count, the first digit of the minutes was used as a one-digit minutes count, and the second digit of the minutes as a one-digit second count (https://github.com/ansible-collections/community.crypto/pull/745).

New Modules

  • community.crypto.acme_ari_info - Retrieves ACME Renewal Information (ARI) for a certificate.

  • community.crypto.acme_certificate_deactivate_authz - Deactivate all authz for an ACME v2 order.

  • community.crypto.acme_certificate_renewal_info - Determine whether a certificate should be renewed or not.

v2.19.1

Release Summary

Bugfix release.

Bugfixes

v2.19.0

Release Summary

Bugfix and feature release.

Minor Changes

Deprecated Features

Bugfixes

New Modules

  • community.crypto.x509_certificate_convert - Convert X.509 certificates

v2.18.0

Release Summary

Bugfix and feature release.

Minor Changes

Deprecated Features

Bugfixes

New Plugins

Filter

  • community.crypto.parse_serial - Convert a serial number as a colon-separated list of hex numbers to an integer

  • community.crypto.to_serial - Convert an integer to a colon-separated list of hex numbers

v2.17.1

Release Summary

Bugfix release for compatibility with cryptography 42.0.0.

Bugfixes

v2.17.0

Release Summary

Feature release.

Minor Changes

v2.16.2

Release Summary

Bugfix release.

Bugfixes

v2.16.1

Release Summary

Bugfix release.

Bugfixes

v2.16.0

Release Summary

Bugfix release.

Minor Changes

Bugfixes

v2.15.1

Release Summary

Bugfix release.

Bugfixes

v2.15.0

Release Summary

Bugfix and feature release.

Minor Changes

Deprecated Features

Bugfixes

New Plugins

Filter

  • community.crypto.gpg_fingerprint - Retrieve a GPG fingerprint from a GPG public or private key

Lookup

  • community.crypto.gpg_fingerprint - Retrieve a GPG fingerprint from a GPG public or private key file

v2.14.1

Release Summary

Bugfix and maintenance release with updated documentation.

From this version on, community.crypto is using the new Ansible semantic markup in its documentation. If you look at documentation with the ansible-doc CLI tool from ansible-core before 2.15, please note that it does not render the markup correctly. You should be still able to read it in most cases, but you need ansible-core 2.15 or later to see it as it is intended. Alternatively you can look at the devel docsite for the rendered HTML version of the documentation of the latest release.

Bugfixes

Known Issues

v2.14.0

Release Summary

Feature release.

Minor Changes

v2.13.1

Release Summary

Bugfix release.

Bugfixes

v2.13.0

Release Summary

Bugfix and maintenance release.

Minor Changes

Deprecated Features

Bugfixes

v2.12.0

Release Summary

Feature release.

Minor Changes

v2.11.1

Release Summary

Maintenance release with improved documentation.

v2.11.0

Release Summary

Feature and bugfix release.

Minor Changes

Bugfixes

v2.10.0

Release Summary

Bugfix and feature release.

Bugfixes

New Plugins

Filter

  • community.crypto.openssl_csr_info - Retrieve information from OpenSSL Certificate Signing Requests (CSR)

  • community.crypto.openssl_privatekey_info - Retrieve information from OpenSSL private keys

  • community.crypto.openssl_publickey_info - Retrieve information from OpenSSL public keys in PEM format

  • community.crypto.split_pem - Split PEM file contents into multiple objects

  • community.crypto.x509_certificate_info - Retrieve information from X.509 certificates in PEM format

  • community.crypto.x509_crl_info - Retrieve information from X.509 CRLs in PEM format

v2.9.0

Release Summary

Regular feature release.

Minor Changes

v2.8.1

Release Summary

Maintenance release with improved documentation.

v2.8.0

Release Summary

Feature release.

Minor Changes

v2.7.1

Release Summary

Maintenance release.

Bugfixes

v2.7.0

Release Summary

Feature release.

Minor Changes

Bugfixes

v2.6.0

Release Summary

Feature release.

Minor Changes

v2.5.0

Release Summary

Maintenance release with improved licensing declaration and documentation fixes.

Minor Changes

v2.4.0

Release Summary

Deprecation and bugfix release. No new features this time.

Deprecated Features

  • Support for Ansible 2.9 and ansible-base 2.10 is deprecated, and will be removed in the next major release (community.crypto 3.0.0). Some modules might still work with these versions afterwards, but we will no longer keep compatibility code that was needed to support them (https://github.com/ansible-collections/community.crypto/pull/460).

Bugfixes

v2.3.4

Release Summary

Re-release of what was intended to be 2.3.3.

A mistake during the release process caused the 2.3.3 tag to end up on the commit for 1.9.17, which caused the release pipeline to re-publish 1.9.17 as 2.3.3.

This release is identical to what should have been 2.3.3, except that the version number has been bumped to 2.3.4 and this changelog entry for 2.3.4 has been added.

v2.3.3

Release Summary

Bugfix release.

Bugfixes

v2.3.2

Release Summary

Maintenance and bugfix release.

Bugfixes

v2.3.1

Release Summary

Maintenance release.

Bugfixes

  • Include PSF-license.txt file for plugins/module_utils/_version.py.

v2.3.0

Release Summary

Feature and bugfix release.

Minor Changes

Bugfixes

v2.2.4

Release Summary

Regular maintenance release.

Bugfixes

v2.2.3

Release Summary

Regular bugfix release.

Bugfixes

v2.2.2

Release Summary

Regular bugfix release.

In this release, we extended the test matrix to include Alpine 3, ArchLinux, Debian Bullseye, and CentOS Stream 8. CentOS 8 was removed from the test matrix.

Bugfixes

v2.2.1

Release Summary

Bugfix release.

Bugfixes

v2.2.0

Release Summary

Regular bugfix and feature release.

Minor Changes

Bugfixes

v2.1.0

Release Summary

Feature and bugfix release.

Minor Changes

Bugfixes

New Modules

  • community.crypto.crypto_info - Retrieve cryptographic capabilities

  • community.crypto.openssl_privatekey_convert - Convert OpenSSL private keys

v2.0.2

Release Summary

Documentation fix release. No actual code changes.

v2.0.1

Release Summary

Bugfix release with extra forward compatibility for newer versions of cryptography.

Minor Changes

Bugfixes

v2.0.0

Release Summary

A new major release of the community.crypto collection. The main changes are removal of the PyOpenSSL backends for almost all modules (openssl_pkcs12 being the only exception), and removal of the assertonly provider in the x509_certificate provider. There are also some other breaking changes which should improve the user interface/experience of this collection long-term.

Minor Changes

Breaking Changes / Porting Guide

Deprecated Features

Removed Features (previously deprecated)

Bugfixes

v1.9.4

Release Summary

Regular bugfix release.

Bugfixes

v1.9.3

Release Summary

Regular bugfix release.

Bugfixes

v1.9.2

Release Summary

Bugfix release to fix the changelog. No other change compared to 1.9.0.

v1.9.1

Release Summary

Accidental 1.9.1 release. Identical to 1.9.0.

v1.9.0

Release Summary

Regular feature release.

Minor Changes

Bugfixes

v1.8.0

Release Summary

Regular bugfix and feature release.

Minor Changes

Bugfixes

v1.7.1

Release Summary

Bugfix release.

Bugfixes

v1.7.0

Release Summary

Regular feature and bugfix release.

Minor Changes

Bugfixes

New Modules

  • community.crypto.openssl_publickey_info - Provide information for OpenSSL public keys

v1.6.2

Release Summary

Bugfix release. Fixes compatibility issue of ACME modules with step-ca.

Bugfixes

v1.6.1

Release Summary

Bugfix release.

Bugfixes

v1.6.0

Release Summary

Fixes compatibility issues with the latest ansible-core 2.11 beta, and contains a lot of internal refactoring for the ACME modules and support for private key passphrases for them.

Minor Changes

Deprecated Features

  • acme module_utils - the acme module_utils (ansible_collections.community.crypto.plugins.module_utils.acme) is deprecated and will be removed in community.crypto 2.0.0. Use the new Python modules in the acme package instead (ansible_collections.community.crypto.plugins.module_utils.acme.xxx) (https://github.com/ansible-collections/community.crypto/pull/184).

Bugfixes

v1.5.0

Release Summary

Regular feature and bugfix release. Deprecates a return value.

Minor Changes

Deprecated Features

Bugfixes

v1.4.0

Release Summary

Release with several new features and bugfixes.

Minor Changes

Bugfixes

v1.3.0

Release Summary

Contains new modules openssl_privatekey_pipe, openssl_csr_pipe and x509_certificate_pipe which allow to create or update private keys, CSRs and X.509 certificates without having to write them to disk.

Minor Changes

Bugfixes

New Modules

  • community.crypto.openssl_csr_pipe - Generate OpenSSL Certificate Signing Request (CSR)

  • community.crypto.openssl_privatekey_pipe - Generate OpenSSL private keys without disk access

  • community.crypto.x509_certificate_pipe - Generate and/or check OpenSSL certificates

v1.2.0

Release Summary

Please note that this release fixes a security issue (CVE-2020-25646).

Minor Changes

Security Fixes

Bugfixes

v1.1.1

Release Summary

Bugfixes for Ansible 2.10.0.

Bugfixes

v1.1.0

Release Summary

Release for Ansible 2.10.0.

Minor Changes

Bugfixes

New Modules

  • community.crypto.openssl_signature - Sign data with openssl

  • community.crypto.openssl_signature_info - Verify signatures with openssl

v1.0.0

Release Summary

This is the first proper release of the community.crypto collection. This changelog contains all changes to the modules in this collection that were added after the release of Ansible 2.9.0.

Minor Changes

  • luks_device - accept passphrase, new_passphrase and remove_passphrase.

  • luks_device - add keysize parameter to set key size at LUKS container creation

  • luks_device - added support to use UUIDs, and labels with LUKS2 containers

  • luks_device - added the type option that allows user explicit define the LUKS container format version

  • openssh_keypair - instead of regenerating some broken or password protected keys, fail the module. Keys can still be regenerated by calling the module with force=yes.

  • openssh_keypair - the regenerate option allows to configure the module’s behavior when it should or needs to regenerate private keys.

  • openssl_* modules - the cryptography backend now properly supports dirName, otherName and RID (Registered ID) names.

  • openssl_certificate - Add option for changing which ACME directory to use with acme-tiny. Set the default ACME directory to Let’s Encrypt instead of using acme-tiny’s default. (acme-tiny also uses Let’s Encrypt at the time being, so no action should be necessary.)

  • openssl_certificate - Change the required version of acme-tiny to >= 4.0.0

  • openssl_certificate - allow to provide content of some input files via the csr_content, privatekey_content, ownca_privatekey_content and ownca_content options.

  • openssl_certificate - allow to return the existing/generated certificate directly as certificate by setting return_content to yes.

  • openssl_certificate_info - allow to provide certificate content via content option (https://github.com/ansible/ansible/issues/64776).

  • openssl_csr - Add support for specifying the SAN otherName value in the OpenSSL ASN.1 UTF8 string format, otherName:<OID>;UTF8:string value.

  • openssl_csr - allow to provide private key content via private_key_content option.

  • openssl_csr - allow to return the existing/generated CSR directly as csr by setting return_content to yes.

  • openssl_csr_info - allow to provide CSR content via content option.

  • openssl_dhparam - allow to return the existing/generated DH params directly as dhparams by setting return_content to yes.

  • openssl_dhparam - now supports a cryptography-based backend. Auto-detection can be overwritten with the select_crypto_backend option.

  • openssl_pkcs12 - allow to return the existing/generated PKCS#12 directly as pkcs12 by setting return_content to yes.

  • openssl_privatekey - add format and format_mismatch options.

  • openssl_privatekey - allow to return the existing/generated private key directly as privatekey by setting return_content to yes.

  • openssl_privatekey - the regenerate option allows to configure the module’s behavior when it should or needs to regenerate private keys.

  • openssl_privatekey_info - allow to provide private key content via content option.

  • openssl_publickey - allow to provide private key content via private_key_content option.

  • openssl_publickey - allow to return the existing/generated public key directly as publickey by setting return_content to yes.

Deprecated Features

  • openssl_csr - all values for the version option except 1 are deprecated. The value 1 denotes the current only standardized CSR version.

Removed Features (previously deprecated)

  • The letsencrypt module has been removed. Use acme_certificate instead.

Bugfixes

  • ACME modules: fix bug in ACME v1 account update code

  • ACME modules: make sure some connection errors are handled properly

  • ACME modules: support Buypass’ ACME v1 endpoint

  • acme_certificate - fix crash when module is used with Python 2.x.

  • acme_certificate - fix misbehavior when ACME v1 is used with modify_account set to false.

  • ecs_certificate - Always specify header connection: keep-alive for ECS API connections.

  • ecs_certificate - Fix formatting of contents of full_chain_path.

  • get_certificate - Fix cryptography backend when pyopenssl is unavailable (https://github.com/ansible/ansible/issues/67900)

  • openssh_keypair - add logic to avoid breaking password protected keys.

  • openssh_keypair - fixes idempotence issue with public key (https://github.com/ansible/ansible/issues/64969).

  • openssh_keypair - public key’s file attributes (permissions, owner, group, etc.) are now set to the same values as the private key.

  • openssl_* modules - prevent crash on fingerprint determination in FIPS mode (https://github.com/ansible/ansible/issues/67213).

  • openssl_certificate - When provider is entrust, use a connection: keep-alive header for ECS API connections.

  • openssl_certificate - provider option was documented as required, but it was not checked whether it was provided. It is now only required when state is present.

  • openssl_certificate - fix assertonly provider certificate verification, causing ‘private key mismatch’ and ‘subject mismatch’ errors.

  • openssl_certificate and openssl_csr - fix Ed25519 and Ed448 private key support for cryptography backend. This probably needs at least cryptography 2.8, since older versions have problems with signing certificates or CSRs with such keys. (https://github.com/ansible/ansible/issues/59039, PR https://github.com/ansible/ansible/pull/63984)

  • openssl_csr - a warning is issued if an unsupported value for version is used for the cryptography backend.

  • openssl_csr - the module will now enforce that privatekey_path is specified when state=present.

  • openssl_publickey - fix a module crash caused when pyOpenSSL is not installed (https://github.com/ansible/ansible/issues/67035).

New Modules

  • community.crypto.ecs_domain - Request validation of a domain with the Entrust Certificate Services (ECS) API

  • community.crypto.x509_crl - Generate Certificate Revocation Lists (CRLs)

  • community.crypto.x509_crl_info - Retrieve information on Certificate Revocation Lists (CRLs)