{"action":"created","issue":{"url":"https://api.github.com/repos/ansible/ansible/issues/34054","repository_url":"https://api.github.com/repos/ansible/ansible","labels_url":"https://api.github.com/repos/ansible/ansible/issues/34054/labels{/name}","comments_url":"https://api.github.com/repos/ansible/ansible/issues/34054/comments","events_url":"https://api.github.com/repos/ansible/ansible/issues/34054/events","html_url":"https://github.com/ansible/ansible/issues/34054","id":283334405,"number":34054,"title":"module: openssl_certificate unusable on RHEL 7","user":{"login":"jsumners","id":321201,"avatar_url":"https://avatars1.githubusercontent.com/u/321201?v=4","gravatar_id":"","url":"https://api.github.com/users/jsumners","html_url":"https://github.com/jsumners","followers_url":"https://api.github.com/users/jsumners/followers","following_url":"https://api.github.com/users/jsumners/following{/other_user}","gists_url":"https://api.github.com/users/jsumners/gists{/gist_id}","starred_url":"https://api.github.com/users/jsumners/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jsumners/subscriptions","organizations_url":"https://api.github.com/users/jsumners/orgs","repos_url":"https://api.github.com/users/jsumners/repos","events_url":"https://api.github.com/users/jsumners/events{/privacy}","received_events_url":"https://api.github.com/users/jsumners/received_events","type":"User","site_admin":false},"labels":[{"id":562292166,"url":"https://api.github.com/repos/ansible/ansible/labels/affects_2.4","name":"affects_2.4","color":"ededed","default":false},{"id":48276055,"url":"https://api.github.com/repos/ansible/ansible/labels/bug_report","name":"bug_report","color":"fbca04","default":false},{"id":496359346,"url":"https://api.github.com/repos/ansible/ansible/labels/module","name":"module","color":"1d76db","default":false},{"id":636327968,"url":"https://api.github.com/repos/ansible/ansible/labels/support:community","name":"support:community","color":"ededed","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":6,"created_at":"2017-12-19T18:56:46Z","updated_at":"2018-03-01T15:43:58Z","closed_at":null,"author_association":"CONTRIBUTOR","body":"##### ISSUE TYPE\r\n - Bug Report\r\n\r\n##### COMPONENT NAME\r\nopenssl_certificate\r\n\r\n##### ANSIBLE VERSION\r\n```\r\nansible 2.4.3.0\r\n  config file = None\r\n  configured module search path = [u'/Users/jsumners/.ansible/plugins/modules', u'/usr/share/ansible/plugins/modules']\r\n  ansible python module location = /opt/local/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/site-packages/ansible\r\n  executable location = /opt/local/Library/Frameworks/Python.framework/Versions/2.7/bin//ansible\r\n  python version = 2.7.14 (default, Sep 27 2017, 12:15:00) [GCC 4.2.1 Compatible Apple LLVM 9.0.0 (clang-900.0.37)]\r\n```\r\n\r\n##### OS / ENVIRONMENT\r\nRunning: macOS 10.13\r\nTarget: RHEL 7.4\r\n\r\n##### SUMMARY\r\nThis task is impossible on RHEL 7:\r\n\r\n```\r\n - name: check cert expiration\r\n   openssl_certificate:\r\n     path: /path/to/some.crt\r\n     provider: assertonly\r\n     valid_in: 1209600\r\n   register: cert_check\r\n```\r\n\r\nThis is due to `pyOpenSSL` being a package required by default system utilities and is only available at version 0.13.1. Thus, it isn't possible to install a later version of `pyopenssl` to meet the required check without conflicting with a system package. The required check is:\r\n\r\nhttps://github.com/ansible/ansible/blob/ded4e6ac0f350f2c8de9f801fc1905726c736a94/lib/ansible/modules/crypto/openssl_certificate.py#L788-L792\r\n\r\n##### STEPS TO REPRODUCE\r\n<!---\r\nFor bugs, show exactly how to reproduce the problem, using a minimal test-case.\r\nFor new features, show how the feature would be used.\r\n-->\r\n\r\n<!--- Paste example playbooks or commands between quotes below -->\r\n```yaml\r\n\r\n```\r\n\r\n<!--- You can also paste gist.github.com links for larger files -->\r\n\r\n##### EXPECTED RESULTS\r\n<!--- What did you expect to happen when running the steps above? -->\r\n\r\n##### ACTUAL RESULTS\r\n<!--- What actually happened? If possible run with extra verbosity (-vvvv) -->\r\n\r\n<!--- Paste verbatim command output between quotes below -->\r\n```\r\n\r\n```\r\n"},"comment":{"url":"https://api.github.com/repos/ansible/ansible/issues/comments/369633151","html_url":"https://github.com/ansible/ansible/issues/34054#issuecomment-369633151","issue_url":"https://api.github.com/repos/ansible/ansible/issues/34054","id":369633151,"user":{"login":"davidbaril","id":20664095,"avatar_url":"https://avatars0.githubusercontent.com/u/20664095?v=4","gravatar_id":"","url":"https://api.github.com/users/davidbaril","html_url":"https://github.com/davidbaril","followers_url":"https://api.github.com/users/davidbaril/followers","following_url":"https://api.github.com/users/davidbaril/following{/other_user}","gists_url":"https://api.github.com/users/davidbaril/gists{/gist_id}","starred_url":"https://api.github.com/users/davidbaril/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/davidbaril/subscriptions","organizations_url":"https://api.github.com/users/davidbaril/orgs","repos_url":"https://api.github.com/users/davidbaril/repos","events_url":"https://api.github.com/users/davidbaril/events{/privacy}","received_events_url":"https://api.github.com/users/davidbaril/received_events","type":"User","site_admin":false},"created_at":"2018-03-01T15:43:58Z","updated_at":"2018-03-01T15:43:58Z","author_association":"NONE","body":"Possible workaround?\r\n\r\nWhat about using the Ansible pip module to perform a \"pip\" install of the pyOpenSSL python package?  If you run the following Ansible task:\r\n\r\n     - name: install latest pyOpenSSL if needed\r\n       pip:\r\n         name: pyOpenSSL\r\n         state: latest\r\n\r\nand then you check the module version using pip:\r\n\r\npip freeze | grep OpenSSL\r\npyOpenSSL==17.5.0\r\n\r\nIt shows up as version 17.5.0.  The Ansible openssl_certificate module appears to be checking the version of the RPM or yum package version, not the python module version.\r\n\r\nHere is what repoquery shows:\r\nrepoquery --list pyOpenSSL | grep pyOpenSSL\r\n/usr/lib64/python2.7/site-packages/pyOpenSSL-0.13.1-py2.7.egg-info\r\n\r\nCould we change the Ansible openssl_certificate module to check the Python version and not the yum/rpm version of the pyOpenSSL package?  The Ansible \"pip\" module could be used to install a more current version.\r\n\r\n\r\n"}}
{"actor":{"display_login":"davidbaril"}}