[ANSIENG-5269] | Replace community.crypto module with openssl

galaxy.yml

@@ -12,7 +12,6 @@ tags:
   - kafka
   - application
 dependencies:
-  community.crypto: "*"
   ansible.posix: "*"
 repository: https://github.com/confluentinc/cp-ansible
 documentation: https://docs.confluent.io/ansible/current/overview.html

roles/ssl/tasks/custom_certs.yml

@@ -12,22 +12,16 @@
     src: "{{ssl_signed_cert_filepath}}"
     dest: "{{ cert_path }}"
 
-- name: Slurp Signed Cert
-  slurp:
-    src: "{{ cert_path }}"
-  register: slurped_signed_cert
-
-- name: Verify Cert Chain
-  community.crypto.certificate_complete_chain:
-    input_chain: "{{ slurped_signed_cert['content'] | b64decode }}"
-    root_certificates:
-      - "{{ ca_cert_path }}"
-  register: custom_cert_chain
-
-- name: Write Cert Chain
-  copy:
-    content: "{{ ''.join(custom_cert_chain.complete_chain) }}"
-    dest: "{{ ssl_file_dir_final }}/{{ service_name }}.chain"
+- name: Concatenate signed cert and CA cert to build chain
+  shell: |
+    cat "{{ cert_path }}" "{{ ca_cert_path }}" > "{{ ssl_file_dir_final }}/{{ service_name }}.chain"
+  args:
+    creates: "{{ ssl_file_dir_final }}/{{ service_name }}.chain"
+
+- name: Verify certificate chain with OpenSSL
+  command: openssl verify -CAfile {{ ca_cert_path }} {{ ssl_file_dir_final }}/{{ service_name }}.chain
+  register: verify_result
+  failed_when: verify_result.rc != 0
 
 - name: Copy Key to Host
   copy:

roles/ssl/tasks/self_signed_certs.yml

@@ -41,22 +41,16 @@
       -extensions v3_req
   no_log: "{{mask_secrets|bool}}"
 
-- name: Slurp Signed Cert
-  slurp:
-    src: "{{ cert_path }}"
-  register: slurped_signed_cert
-
-- name: Verify Cert Chain
-  community.crypto.certificate_complete_chain:
-    input_chain: "{{ slurped_signed_cert['content'] | b64decode }}"
-    root_certificates:
-      - "{{ ca_cert_path }}"
-  register: self_signed_cert_chain
-
-- name: Write Cert Chain
-  copy:
-    content: "{{ ''.join(self_signed_cert_chain.complete_chain) }}"
-    dest: "{{ ssl_file_dir_final }}/{{ service_name }}.chain"
+- name: Concatenate signed cert and CA cert to build chain
+  shell: |
+    cat "{{ cert_path }}" "{{ ca_cert_path }}" > "{{ ssl_file_dir_final }}/{{ service_name }}.chain"
+  args:
+    creates: "{{ ssl_file_dir_final }}/{{ service_name }}.chain"
+
+- name: Verify certificate chain with OpenSSL
+  command: openssl verify -CAfile {{ ca_cert_path }} {{ ssl_file_dir_final }}/{{ service_name }}.chain
+  register: verify_result
+  failed_when: verify_result.rc != 0
 
 - name: Create Keystore and Truststore from Certs
   include_tasks: create_keystores_from_certs.yml