Anons79 Mini Shell

Directory : /lib/python2.7/site-packages/ansible/modules/crypto/entrust/
Upload File :
Current File : //lib/python2.7/site-packages/ansible/modules/crypto/entrust/ecs_certificate.pyc

�
�Udac@`s�ddlmZmZmZeZidd6dgd6dd6ZdZd	Zd
Z	ddl
mZmZm
Z
mZddlZddlZddlZddlZddlZddlZdd
lmZddlmZddlmZmZddlmZmZe Z!yddl"Z"ee"j#�Z$Wn#e%k
rRej&�Z!e'Z(nXe)Z(dZ*d�Z+d�Z,d�Z-de.fd��YZ/d�Z0d�Z1d�Z2e3dkr�e2�ndS(i(tabsolute_importtdivisiontprint_functions1.1tmetadata_versiontpreviewtstatust	communitytsupported_bys+M
---
module: ecs_certificate
author:
    - Chris Trufan (@ctrufan)
version_added: '2.9'
short_description: Request SSL/TLS certificates with the Entrust Certificate Services (ECS) API
description:
    - Create, reissue, and renew certificates with the Entrust Certificate Services (ECS) API.
    - Requires credentials for the L(Entrust Certificate Services,https://www.entrustdatacard.com/products/categories/ssl-certificates) (ECS) API.
    - In order to request a certificate, the domain and organization used in the certificate signing request must be already
      validated in the ECS system. It is I(not) the responsibility of this module to perform those steps.
notes:
    - C(path) must be specified as the output location of the certificate.
requirements:
    - cryptography >= 1.6
options:
    backup:
        description:
            - Whether a backup should be made for the certificate in I(path).
        type: bool
        default: false
    force:
        description:
            - If force is used, a certificate is requested regardless of whether I(path) points to an existing valid certificate.
            - If C(request_type=renew), a forced renew will fail if the certificate being renewed has been issued within the past 30 days, regardless of the
              value of I(remaining_days) or the return value of I(cert_days) - the ECS API does not support the "renew" operation for certificates that are not
              at least 30 days old.
        type: bool
        default: false
    path:
        description:
            - The destination path for the generated certificate as a PEM encoded cert.
            - If the certificate at this location is not an Entrust issued certificate, a new certificate will always be requested even if the current
              certificate is technically valid.
            - If there is already an Entrust certificate at this location, whether it is replaced is depends on the I(remaining_days) calculation.
            - If an existing certificate is being replaced (see I(remaining_days), I(force), and I(tracking_id)), whether a new certificate is requested
              or the existing certificate is renewed or reissued is based on I(request_type).
        type: path
        required: true
    full_chain_path:
        description:
            - The destination path for the full certificate chain of the certificate, intermediates, and roots.
        type: path
    csr:
        description:
            - Base-64 encoded Certificate Signing Request (CSR). I(csr) is accepted with or without PEM formatting around the Base-64 string.
            - If no I(csr) is provided when C(request_type=reissue) or C(request_type=renew), the certificate will be generated with the same public key as
              the certificate being renewed or reissued.
            - If I(subject_alt_name) is specified, it will override the subject alternate names in the CSR.
            - If I(eku) is specified, it will override the extended key usage in the CSR.
            - If I(ou) is specified, it will override the organizational units "ou=" present in the subject distinguished name of the CSR, if any.
            - The organization "O=" field from the CSR will not be used. It will be replaced in the issued certificate by I(org) if present, and if not present,
              the organization tied to I(client_id).
        type: str
    tracking_id:
        description:
            - The tracking ID of the certificate to reissue or renew.
            - I(tracking_id) is invalid if C(request_type=new) or C(request_type=validate_only).
            - If there is a certificate present in I(path) and it is an ECS certificate, I(tracking_id) will be ignored.
            - If there is no certificate present in I(path) or there is but it is from another provider, the certificate represented by I(tracking_id) will
              be renewed or reissued and saved to I(path).
            - If there is no certificate present in I(path) and the I(force) and I(remaining_days) parameters do not indicate a new certificate is needed,
              the certificate referenced by I(tracking_id) certificate will be saved to I(path).
            - This can be used when a known certificate is not currently present on a server, but you want to renew or reissue it to be managed by an ansible
              playbook. For example, if you specify C(request_type=renew), I(tracking_id) of an issued certificate, and I(path) to a file that does not exist,
              the first run of a task will download the certificate specified by I(tracking_id) (assuming it is still valid). Future runs of the task will
              (if applicable - see I(force) and I(remaining_days)) renew the certificate now present in I(path).
        type: int
    remaining_days:
        description:
            - The number of days the certificate must have left being valid. If C(cert_days < remaining_days) then a new certificate will be
              obtained using I(request_type).
            - If C(request_type=renew), a renewal will fail if the certificate being renewed has been issued within the past 30 days, so do not set a
              I(remaining_days) value that is within 30 days of the full lifetime of the certificate being acted upon. (e.g. if you are requesting Certificates
              with a 90 day lifetime, do not set remaining_days to a value C(60) or higher).
            - The I(force) option may be used to ensure that a new certificate is always obtained.
        type: int
        default: 30
    request_type:
        description:
            - The operation performed if I(tracking_id) references a valid certificate to reissue, or there is already a certificate present in I(path) but
              either I(force) is specified or C(cert_days < remaining_days).
            - Specifying C(request_type=validate_only) means the request will be validated against the ECS API, but no certificate will be issued.
            - Specifying C(request_type=new) means a certificate request will always be submitted and a new certificate issued.
            - Specifying C(request_type=renew) means that an existing certificate (specified by I(tracking_id) if present, otherwise I(path)) will be renewed.
              If there is no certificate to renew, a new certificate is requested.
            - Specifying C(request_type=reissue) means that an existing certificate (specified by I(tracking_id) if present, otherwise I(path)) will be
              reissued.
              If there is no certificate to reissue, a new certificate is requested.
            - If a certificate was issued within the past 30 days, the 'renew' operation is not a valid operation and will fail.
            - Note that C(reissue) is an operation that will result in the revocation of the certificate that is reissued, be cautious with it's use.
            - I(check_mode) is only supported if C(request_type=new)
            - For example, setting C(request_type=renew) and C(remaining_days=30) and pointing to the same certificate on multiple playbook runs means that on
              the first run new certificate will be requested. It will then be left along on future runs until it is within 30 days of expiry, then the
              ECS "renew" operation will be performed.
        type: str
        choices: [ 'new', 'renew', 'reissue', 'validate_only']
        default: new
    cert_type:
        description:
            - Specify the type of certificate requested.
            - If a certificate is being reissued or renewed, this parameter is ignored, and the C(cert_type) of the initial certificate is used.
        type: str
        choices: [ 'STANDARD_SSL', 'ADVANTAGE_SSL', 'UC_SSL', 'EV_SSL', 'WILDCARD_SSL', 'PRIVATE_SSL', 'PD_SSL', 'CODE_SIGNING', 'EV_CODE_SIGNING',
                   'CDS_INDIVIDUAL', 'CDS_GROUP', 'CDS_ENT_LITE', 'CDS_ENT_PRO', 'SMIME_ENT' ]
    subject_alt_name:
        description:
            - The subject alternative name identifiers, as an array of values (applies to I(cert_type) with a value of C(STANDARD_SSL), C(ADVANTAGE_SSL),
              C(UC_SSL), C(EV_SSL), C(WILDCARD_SSL), C(PRIVATE_SSL), and C(PD_SSL)).
            - If you are requesting a new SSL certificate, and you pass a I(subject_alt_name) parameter, any SAN names in the CSR are ignored.
              If no subjectAltName parameter is passed, the SAN names in the CSR are used.
            - See I(request_type) to understand more about SANs during reissues and renewals.
            - In the case of certificates of type C(STANDARD_SSL) certificates, if the CN of the certificate is <domain>.<tld> only the www.<domain>.<tld> value
              is accepted. If the CN of the certificate is www.<domain>.<tld> only the <domain>.<tld> value is accepted.
        type: list
        elements: str
    eku:
        description:
            - If specified, overrides the key usage in the I(csr).
        type: str
        choices: [ SERVER_AUTH, CLIENT_AUTH, SERVER_AND_CLIENT_AUTH ]
    ct_log:
        description:
            - In compliance with browser requirements, this certificate may be posted to the Certificate Transparency (CT) logs. This is a best practice
              technique that helps domain owners monitor certificates issued to their domains. Note that not all certificates are eligible for CT logging.
            - If I(ct_log) is not specified, the certificate uses the account default.
            - If I(ct_log) is specified and the account settings allow it, I(ct_log) overrides the account default.
            - If I(ct_log) is set to C(false), but the account settings are set to "always log", the certificate generation will fail.
        type: bool
    client_id:
        description:
            - The client ID to submit the Certificate Signing Request under.
            - If no client ID is specified, the certificate will be submitted under the primary client with ID of 1.
            - When using a client other than the primary client, the I(org) parameter cannot be specified.
            - The issued certificate will have an organization value in the subject distinguished name represented by the client.
        type: int
        default: 1
    org:
        description:
            - Organization "O=" to include in the certificate.
            - If I(org) is not specified, the organization from the client represented by I(client_id) is used.
            - Unless the I(cert_type) is C(PD_SSL), this field may not be specified if the value of I(client_id) is not "1" (the primary client).
              non-primary clients, certificates may only be issued with the organization of that client.
        type: str
    ou:
        description:
            - Organizational unit "OU=" to include in the certificate.
            - I(ou) behavior is dependent on whether organizational units are enabled for your account. If organizational unit support is disabled for your
              account, organizational units from the I(csr) and the I(ou) parameter are ignored.
            - If both I(csr) and I(ou) are specified, the value in I(ou) will override the OU fields present in the subject distinguished name in the I(csr)
            - If neither I(csr) nor I(ou) are specified for a renew or reissue operation, the OU fields in the initial certificate are reused.
            - An invalid OU from I(csr) is ignored, but any invalid organizational units in I(ou) will result in an error indicating "Unapproved OU". The I(ou)
              parameter can be used to force failure if an unapproved organizational unit is provided.
            - A maximum of one OU may be specified for current products. Multiple OUs are reserved for future products.
        type: list
        elements: str
    end_user_key_storage_agreement:
        description:
            - The end user of the Code Signing certificate must generate and store the private key for this request on cryptographically secure
              hardware to be compliant with the Entrust CSP and Subscription agreement. If requesting a certificate of type C(CODE_SIGNING) or
              C(EV_CODE_SIGNING), you must set I(end_user_key_storage_agreement) to true if and only if you acknowledge that you will inform the user of this
              requirement.
            - Applicable only to I(cert_type) of values C(CODE_SIGNING) and C(EV_CODE_SIGNING).
        type: bool
    tracking_info:
        description: Free form tracking information to attach to the record for the certificate.
        type: str
    requester_name:
        description: The requester name to associate with certificate tracking information.
        type: str
        required: true
    requester_email:
        description: The requester email to associate with certificate tracking information and receive delivery and expiry notices for the certificate.
        type: str
        required: true
    requester_phone:
        description: The requester phone number to associate with certificate tracking information.
        type: str
        required: true
    additional_emails:
        description: A list of additional email addresses to receive the delivery notice and expiry notification for the certificate.
        type: list
        elements: str
    custom_fields:
        description:
            - Mapping of custom fields to associate with the certificate request and certificate.
            - Only supported if custom fields are enabled for your account.
            - Each custom field specified must be a custom field you have defined for your account.
        type: dict
        suboptions:
            text1:
                description: Custom text field (maximum 500 characters)
                type: str
            text2:
                description: Custom text field (maximum 500 characters)
                type: str
            text3:
                description: Custom text field (maximum 500 characters)
                type: str
            text4:
                description: Custom text field (maximum 500 characters)
                type: str
            text5:
                description: Custom text field (maximum 500 characters)
                type: str
            text6:
                description: Custom text field (maximum 500 characters)
                type: str
            text7:
                description: Custom text field (maximum 500 characters)
                type: str
            text8:
                description: Custom text field (maximum 500 characters)
                type: str
            text9:
                description: Custom text field (maximum 500 characters)
                type: str
            text10:
                description: Custom text field (maximum 500 characters)
                type: str
            text11:
                description: Custom text field (maximum 500 characters)
                type: str
            text12:
                description: Custom text field (maximum 500 characters)
                type: str
            text13:
                description: Custom text field (maximum 500 characters)
                type: str
            text14:
                description: Custom text field (maximum 500 characters)
                type: str
            text15:
                description: Custom text field (maximum 500 characters)
                type: str
            number1:
                description: Custom number field.
                type: float
            number2:
                description: Custom number field.
                type: float
            number3:
                description: Custom number field.
                type: float
            number4:
                description: Custom number field.
                type: float
            number5:
                description: Custom number field.
                type: float
            date1:
                description: Custom date field.
                type: str
            date2:
                description: Custom date field.
                type: str
            date3:
                description: Custom date field.
                type: str
            date4:
                description: Custom date field.
                type: str
            date5:
                description: Custom date field.
                type: str
            email1:
                description: Custom email field.
                type: str
            email2:
                description: Custom email field.
                type: str
            email3:
                description: Custom email field.
                type: str
            email4:
                description: Custom email field.
                type: str
            email5:
                description: Custom email field.
                type: str
            dropdown1:
                description: Custom dropdown field.
                type: str
            dropdown2:
                description: Custom dropdown field.
                type: str
            dropdown3:
                description: Custom dropdown field.
                type: str
            dropdown4:
                description: Custom dropdown field.
                type: str
            dropdown5:
                description: Custom dropdown field.
                type: str
    cert_expiry:
        description:
            - The date the certificate should be set to expire, in RFC3339 compliant date or date-time format. For example,
              C(2020-02-23), C(2020-02-23T15:00:00.05Z).
            - I(cert_expiry) is only supported for requests of C(request_type=new) or C(request_type=renew). If C(request_type=reissue),
              I(cert_expiry) will be used for the first certificate issuance, but subsequent issuances will have the same expiry as the initial
              certificate.
            - A reissued certificate will always have the same expiry as the original certificate.
            - Note that only the date (day, month, year) is supported for specifying the expiry date. If you choose to specify an expiry time with the expiry
              date, the time will be adjusted to Eastern Standard Time (EST). This could have the unintended effect of moving your expiry date to the previous
              day.
            - Applies only to accounts with a pooling inventory model.
            - Only one of I(cert_expiry) or I(cert_lifetime) may be specified.
        type: str
    cert_lifetime:
        description:
            - The lifetime of the certificate.
            - Applies to all certificates for accounts with a non-pooling inventory model.
            - I(cert_lifetime) is only supported for requests of C(request_type=new) or C(request_type=renew). If C(request_type=reissue), I(cert_lifetime) will
              be used for the first certificate issuance, but subsequent issuances will have the same expiry as the initial certificate.
            - Applies to certificates of I(cert_type)=C(CDS_INDIVIDUAL, CDS_GROUP, CDS_ENT_LITE, CDS_ENT_PRO, SMIME_ENT) for accounts with a pooling inventory
              model.
            - C(P1Y) is a certificate with a 1 year lifetime.
            - C(P2Y) is a certificate with a 2 year lifetime.
            - C(P3Y) is a certificate with a 3 year lifetime.
            - Only one of I(cert_expiry) or I(cert_lifetime) may be specified.
        type: str
        choices: [ P1Y, P2Y, P3Y ]
seealso:
    - module: openssl_privatekey
      description: Can be used to create private keys (both for certificates and accounts).
    - module: openssl_csr
      description: Can be used to create a Certificate Signing Request (CSR).
extends_documentation_fragment:
    - ecs_credential
s"
- name: Request a new certificate from Entrust with bare minimum parameters.
        Will request a new certificate if current one is valid but within 30
        days of expiry. If replacing an existing file in path, will back it up.
  ecs_certificate:
    backup: true
    path: /etc/ssl/crt/ansible.com.crt
    full_chain_path: /etc/ssl/crt/ansible.com.chain.crt
    csr: /etc/ssl/csr/ansible.com.csr
    cert_type: EV_SSL
    requester_name: Jo Doe
    requester_email: [email protected]
    requester_phone: 555-555-5555
    entrust_api_user: apiusername
    entrust_api_key: a^lv*32!cd9LnT
    entrust_api_client_cert_path: /etc/ssl/entrust/ecs-client.crt
    entrust_api_client_cert_key_path: /etc/ssl/entrust/ecs-client.key

- name: If there is no certificate present in path, request a new certificate
        of type EV_SSL. Otherwise, if there is an Entrust managed certificate
        in path and it is within 63 days of expiration, request a renew of that
        certificate.
  ecs_certificate:
    path: /etc/ssl/crt/ansible.com.crt
    csr: /etc/ssl/csr/ansible.com.csr
    cert_type: EV_SSL
    cert_expiry: '2020-08-20'
    request_type: renew
    remaining_days: 63
    requester_name: Jo Doe
    requester_email: [email protected]
    requester_phone: 555-555-5555
    entrust_api_user: apiusername
    entrust_api_key: a^lv*32!cd9LnT
    entrust_api_client_cert_path: /etc/ssl/entrust/ecs-client.crt
    entrust_api_client_cert_key_path: /etc/ssl/entrust/ecs-client.key

- name: If there is no certificate present in path, download certificate
        specified by tracking_id if it is still valid. Otherwise, if the
        certificate is within 79 days of expiration, request a renew of that
        certificate and save it in path. This can be used to "migrate" a
        certificate to be Ansible managed.
  ecs_certificate:
    path: /etc/ssl/crt/ansible.com.crt
    csr: /etc/ssl/csr/ansible.com.csr
    tracking_id: 2378915
    request_type: renew
    remaining_days: 79
    entrust_api_user: apiusername
    entrust_api_key: a^lv*32!cd9LnT
    entrust_api_client_cert_path: /etc/ssl/entrust/ecs-client.crt
    entrust_api_client_cert_key_path: /etc/ssl/entrust/ecs-client.key

- name: Force a reissue of the certificate specified by tracking_id.
  ecs_certificate:
    path: /etc/ssl/crt/ansible.com.crt
    force: true
    tracking_id: 2378915
    request_type: reissue
    entrust_api_user: apiusername
    entrust_api_key: a^lv*32!cd9LnT
    entrust_api_client_cert_path: /etc/ssl/entrust/ecs-client.crt
    entrust_api_client_cert_key_path: /etc/ssl/entrust/ecs-client.key

- name: Request a new certificate with an alternative client. Note that the
        issued certificate will have it's Subject Distinguished Name use the
        organization details associated with that client, rather than what is
        in the CSR.
  ecs_certificate:
    path: /etc/ssl/crt/ansible.com.crt
    csr: /etc/ssl/csr/ansible.com.csr
    client_id: 2
    requester_name: Jo Doe
    requester_email: [email protected]
    requester_phone: 555-555-5555
    entrust_api_user: apiusername
    entrust_api_key: a^lv*32!cd9LnT
    entrust_api_client_cert_path: /etc/ssl/entrust/ecs-client.crt
    entrust_api_client_cert_key_path: /etc/ssl/entrust/ecs-client.key

- name: Request a new certificate with a number of CSR parameters overridden
        and tracking information
  ecs_certificate:
    path: /etc/ssl/crt/ansible.com.crt
    full_chain_path: /etc/ssl/crt/ansible.com.chain.crt
    csr: /etc/ssl/csr/ansible.com.csr
    subject_alt_name:
      - ansible.testcertificates.com
      - www.testcertificates.com
    eku: SERVER_AND_CLIENT_AUTH
    ct_log: true
    org: Test Organization Inc.
    ou:
      - Administration
    tracking_info: "Submitted via Ansible"
    additional_emails:
      - [email protected]
      - [email protected]
    custom_fields:
      text1: Admin
      text2: Invoice 25
      number1: 342
      date1: '2018-01-01'
      email1: [email protected]
      dropdown1: red
    cert_expiry: '2020-08-15'
    requester_name: Jo Doe
    requester_email: [email protected]
    requester_phone: 555-555-5555
    entrust_api_user: apiusername
    entrust_api_key: a^lv*32!cd9LnT
    entrust_api_client_cert_path: /etc/ssl/entrust/ecs-client.crt
    entrust_api_client_cert_key_path: /etc/ssl/entrust/ecs-client.key

s^
filename:
    description: The destination path for the generated certificate.
    returned: changed or success
    type: str
    sample: /etc/ssl/crt/www.ansible.com.crt
backup_file:
    description: Name of backup file created for the certificate.
    returned: changed and if I(backup) is C(true)
    type: str
    sample: /path/to/www.ansible.com.crt.2019-03-09@11:22~
backup_full_chain_file:
    description: Name of the backup file created for the certificate chain.
    returned: changed and if I(backup) is C(true) and I(full_chain_path) is set.
    type: str
    sample: /path/to/ca.chain.crt.2019-03-09@11:22~
tracking_id:
    description: The tracking ID to reference and track the certificate in ECS.
    returned: success
    type: int
    sample: 380079
serial_number:
    description: The serial number of the issued certificate.
    returned: success
    type: int
    sample: 1235262234164342
cert_days:
    description: The number of days the certificate remains valid.
    returned: success
    type: int
    sample: 253
cert_status:
    description:
        - The certificate status in ECS.
        - 'Current possible values (which may be expanded in the future) are: C(ACTIVE), C(APPROVED), C(DEACTIVATED), C(DECLINED), C(EXPIRED), C(NA),
          C(PENDING), C(PENDING_QUORUM), C(READY), C(REISSUED), C(REISSUING), C(RENEWED), C(RENEWING), C(REVOKED), C(SUSPENDED)'
    returned: success
    type: str
    sample: ACTIVE
cert_details:
    description:
        - The full response JSON from the Get Certificate call of the ECS API.
        - 'While the response contents are guaranteed to be forwards compatible with new ECS API releases, Entrust recommends that you do not make any
          playbooks take actions based on the content of this field. However it may be useful for debugging, logging, or auditing purposes.'
    returned: success
    type: dict

(tecs_client_argument_spect	ECSClienttRestOperationExceptiontSessionConfigurationExceptionN(tLooseVersion(tcrypto(t
AnsibleModuletmissing_required_lib(t	to_nativetto_bytess1.6cC`sDtjd�}tjd�}|j|�s<|j|�r@tStS(Ns4^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])\Zs�^([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(.[0-9]+)?(([Zz])|([+|-]([01][0-9]|2[0-3]):[0-5][0-9]))\Z(tretcompiletmatchtTruetFalse(tcert_expirytsearch_string_partialtsearch_string_full((sR/usr/lib/python2.7/site-packages/ansible/modules/crypto/entrust/ecs_certificate.pytvalidate_cert_expiry!s
cC`s>d}|r:tjj|d�}|tjj�j}n|S(Nis%Y-%m-%dT%H:%M:%SZ(tdatetimetstrptimetnowtdays(t
expires_aftert	cert_daystexpires_after_datetime((sR/usr/lib/python2.7/site-packages/ansible/modules/crypto/entrust/ecs_certificate.pytcalculate_cert_days*s
cC`sDi}|j|dk	r@|j|r3d||<q@d||<n|S(Nttruetfalse(tparamstNone(tmoduletdict_param_namet
param_nametbody((sR/usr/lib/python2.7/site-packages/ansible/modules/crypto/entrust/ecs_certificate.pyt!convert_module_param_to_json_bool5s


tEcsCertificatecB`sheZdZd�Zd�Zd�Zd�Zd�Zd�Zd�Z	d�Z
d	�Zd
�ZRS(s9
    Entrust Certificate Services certificate class.
    c
C`s�|jd|_|jd|_|jd|_|jd|_|jd|_|jd|_t|_d|_
d|_d|_d|_
d|_d|_d|_d|_d|_d|_|jr"tjj|j�r"ytj|jdd�|_Wq"tk
r}d|_q"XnyQtd	|jd	d
|jd
d|jdd
|jdd|jd�|_Wn2tk
r�}|jddjt|���nXy|jj�Wn5tk
r�}|jddjt|j ���nXdS(Ntpathtfull_chain_pathtforcetbackuptrequest_typetcsrtbackendtcryptographytentrust_api_usertentrust_api_keytentrust_api_certtentrust_api_client_cert_pathtentrust_api_cert_keyt entrust_api_client_cert_key_pathtentrust_api_specification_pathtmsgs*Failed to initialize Entrust Provider: {0}sYPlease verify credential information. Received exception when testing ECS connection: {0}(!R%R-R.R/R0R1R2RtchangedR&tfilenamettracking_idtcert_statust
serial_numberR tcert_detailstbackup_filetbackup_full_chain_filetcertt
ecs_clienttostexiststcrypto_utilstload_certificatet	ExceptionR	Rt	fail_jsontformatRt
GetAppVersionR
tmessage(tselfR'tdummyte((sR/usr/lib/python2.7/site-packages/ansible/modules/crypto/entrust/ecs_certificate.pyt__init__DsF											



#cC`si}i}|jdr-|jd|d<n|jdrN|jd|d<n|jdro|jd|d<n|jdr�|jd|d<n|jd	r�i}x:|jd	j�D]%\}}|dk	r�|||<q�q�W||d
<n|jdr|jd|d<n||d
<|S(Ntrequester_namet
requesterNametrequester_emailtrequesterEmailtrequester_phonetrequesterPhonet
tracking_infottrackingInfot
custom_fieldstcustomFieldstadditional_emailstadditionalEmailsttracking(R%titemsR&(RPR'R*R`R\tktv((sR/usr/lib/python2.7/site-packages/ansible/modules/crypto/entrust/ecs_certificate.pytconvert_tracking_paramsos(




 


cC`smi}|jdr'|jd|d<n|jdrH|jd|d<n|jdri|jd|d<n|S(Ntsubject_alt_nametsubjectAltNametorgtou(R%(RPR'R*((sR/usr/lib/python2.7/site-packages/ansible/modules/crypto/entrust/ecs_certificate.pytconvert_cert_subject_params�s


cC`s�i}|jdr'|jd|d<n|jdkrJ|jd|d<n|jd|d<|jt|dd��|jt|d	d
��|S(Ntekutnewt	cert_typetcertTypet	client_idtclientIdtctLogtct_logtendUserKeyStorageAgreementtend_user_key_storage_agreement(R%R1tupdateR+(RPR'R*((sR/usr/lib/python2.7/site-packages/ansible/modules/crypto/entrust/ecs_certificate.pytconvert_general_params�s
cC`s�i}|jdr'|jd|d<n}|jdrH|jd|d<n\|jdkr�tjjtjtj���}|tjdd�}|jd�|d<n|S(	Nt
cert_lifetimetcertLifetimeRtcertExpiryDatetreissueRims%Y-%m-%dT%H:%M:%S.00Z(	R%R1Rt
fromtimestampttimetmktimetgmtimet	timedeltatstrftime(RPR'R*tgmt_nowtexpiry((sR/usr/lib/python2.7/site-packages/ansible/modules/crypto/entrust/ecs_certificate.pytconvert_expiry_params�s

!cC`s�yedj|jj�}|jjd|�jdi�}t|�dkrd|djd�|_nWntk
r{}dSXdS(Ns{0:X}tserialNumbertcertificatesiit
trackingId(	RMRERARFtGetCertificatestgettlenR?R
(RPR'RAtcert_resultsRQ((sR/usr/lib/python2.7/site-packages/ansible/modules/crypto/entrust/ecs_certificate.pyt set_tracking_id_by_serial_number�s!cC`s�yd|jjd|j�|_|jjd�|_|jjd�|_t|jjd��|_Wn8t	k
r�}|j
dj|j�t|j
��nXdS(NR�RR�texpiresAftersDFailed to get details of certificate with tracking_id="{0}", Error: (RFtGetCertificateR?RBR�R@RAR"R R
RLRMRRO(RPR'RR((sR/usr/lib/python2.7/site-packages/ansible/modules/crypto/entrust/ecs_certificate.pytset_cert_details�scC`s�|jrq|j|�|jdrq|jrq|jd|jkrq|jdj|jd|j|j��qqn|js�|jd|_n|js�tS|j|�|j	dks�|j	dks�|j	dkr�tS|j
|jdkr�tStS(NR?s�tracking_id parameter of "{0}" provided, but will be ignored. Valid certificate was present in path "{1}" with tracking_id of "{2}".tEXPIREDt	SUSPENDEDtREVOKEDtremaining_days(RER�R%R?twarnRMR-RR�R@R R(RPR'((sR/usr/lib/python2.7/site-packages/ansible/modules/crypto/entrust/ecs_certificate.pytcheck�s	
,#		
-cC`s�|j|�s|jr,i}|jrktjj|j�rkt|jd��}|j�|d<WdQXn|jdkr�|j	r�|j
dj|j|j|j��d|_n(|jdkr�|j	r�|j
d�n|j|j
|��|j|j|��|j|j|��|j|j|��|js�y�|jdkrrd|d<|jjd	|�}n|jdkr�|jjd	|�}n`|jd
kr�|jjd|j	d	|�}n0|jdkr�|jjd|j	d	|�}n|jd�|_	|j|�Wn/tk
rJ}|jd
dj|j��nX|jdkr)|jr{|j|j�|_ntj|t |j!jd���|j"r|j!jd�r|jr�|j|j"�|_#ndj$|j!jd��d}tj|t |�d|j"�nt%|_&q)q�n�tjj|j�r�|j	r�|js�tj|t |j!jd���|j"r�|j!jd�r�dj$|j!jd��d}tj|t |�d|j"�q�nt%|_&ndS(NtrR2Rks�No existing Entrust certificate found in path={0} and no tracking_id was provided, setting request_type to "new" for this taskrun. Future playbook runs that point to the pathination file in {1} will use request_type={2}s�Existing certificate being acted upon, but request_type is "new", so will be a new certificate issuance rather than areissue or renewt
validate_onlyR#tvalidateOnlytBodytrenewR�RyR<s8Failed to request new certificate from Entrust (ECS) {0}t
endEntityCertt
chainCertss
R-('R�R/R2RGR-RHtopentreadR1R?R�RMRtRdRiRuR�t
check_modeRFtNewCertRequesttRenewCertRequesttReissueCertRequestR�R�R
RLROR0tbackup_localRCRIt
write_fileRRBR.RDtjoinRR=(RPR'R*tcsr_filetresultRRtchain_string((sR/usr/lib/python2.7/site-packages/ansible/modules/crypto/entrust/ecs_certificate.pytrequest_cert�s^	
!! 	"	"	"%cC`svi|jd6|jd6|jd6|jd6|jd6|jd6|jd6}|jrr|j|d<|j|d	<n|S(
NR=R>R?R@RAR RBRCRD(	R=R-R?R@RAR RBRCRD(RPR�((sR/usr/lib/python2.7/site-packages/ansible/modules/crypto/entrust/ecs_certificate.pytdumps






	
(
t__name__t
__module__t__doc__RSRdRiRuR�R�R�R�R�R�(((sR/usr/lib/python2.7/site-packages/ansible/modules/crypto/entrust/ecs_certificate.pyR,?s	+		
		
					?cIC`stdtdd�dtdd�dtdd�dtdd�dtdd�dtdd�d	tdd�d
tdd�dtdd�dtdd�d
tdd�dtdd�dtdd�dtdd�dtdd�dtdd�dtdd�dtdd�dtdd�dtdd�dtdd�dtdd�dtdd�dtdd�dtdd�dtdd�dtdd�dtdd�d tdd�d!tdd�d"tdd�d#tdd�d$tdd�d%tdd�d&tdd��#S('Nttext1ttypetstrttext2ttext3ttext4ttext5ttext6ttext7ttext8ttext9ttext10ttext11ttext12ttext13ttext14ttext15tnumber1tfloattnumber2tnumber3tnumber4tnumber5tdate1tdate2tdate3tdate4tdate5temail1temail2temail3temail4temail5t	dropdown1t	dropdown2t	dropdown3t	dropdown4t	dropdown5(tdict(((sR/usr/lib/python2.7/site-packages/ansible/modules/crypto/entrust/ecs_certificate.pytcustom_fields_spec'sHc7C`s&tdtdddt�dtdddt�dtdddt�dtdd�d	tdd
�dtdd
dd�d
tdddddddddg�dtddddddddddddddd d!d"g�d#tdd�d$tdd%d&d�d'tdddd(d)d*g�d+tdd�d,tdd
dd-�d.tdd�d/tdd%d&d�d0tdd�d1tdd�d2tdddt�d3tdddt�d4tdddt�d5tdd%d&d�d6tdd7ddd8t��d9tdd�d:tdddd;d<d=g��S(>NR0R�tbooltdefaultR/R-trequiredR.R?tintR�iR1R�RktchoicesR�RyR�RltSTANDARD_SSLt
ADVANTAGE_SSLtUC_SSLtEV_SSLtWILDCARD_SSLtPRIVATE_SSLtPD_SSLtCODE_SIGNINGtEV_CODE_SIGNINGtCDS_INDIVIDUALt	CDS_GROUPtCDS_ENT_LITEtCDS_ENT_PROt	SMIME_ENTR2RetlisttelementsRjtSERVER_AUTHtCLIENT_AUTHtSERVER_AND_CLIENT_AUTHRqRniRgRhRsRZRTRVRXR^R\R�toptionsRRvtP1YtP2YtP3Y(R�RRR&R�(((sR/usr/lib/python2.7/site-packages/ansible/modules/crypto/entrust/ecs_certificate.pytecs_certificate_argument_specOsL'cC`s't�}|jt��td|ddddggdddggdddggdd	dggfd
ddgfd
t�}ts�ttt�kr�|j	dt
djt��dt�n|j
dr|j
ddks�|j
ddkr|j	ddj|j
d��qn|j
ddkro|j
drL|j	dd�q�|j
dr�|j	dd�q�nt|j
d}|dkr�|j	ddj|j
d��n8tjj|�s�|j	ddj||j
d��n|j
drt|j
d�dkr|j	dd�n|j
dre|j
ddkre|j
dd	kre|j	dd�qen|j
dr�|j
ddkr�|j
ddkr�|j	dd �n|j
dr�t|j
d�s�|j	dd!j|j
d��q�nt|�}|j|�|j�}|j|�dS("Nt
argument_spectrequired_ifR1RkRlR�R�RsR�tmutually_exclusiveRRvtsupports_check_modeR<scryptography >= {0}t	exceptionR?s9The tracking_id field is invalid when request_type="{0}".Rys=The cert_expiry field is invalid when request_type="reissue".s?The cert_lifetime field is invalid when request_type="reissue".R2s/The csr field is required when request_type={0}sPThe csr field of {0} was not a valid path. csr is required when request_type={1}Rhis1Multiple "ou" values are not currently supported.slParameter "end_user_key_storage_agreement" is valid only for cert_types "CODE_SIGNING" and "EV_CODE_SIGNING"RgRnR�s{The "org" parameter is not supported when client_id parameter is set to a value other than 1, unless cert_type is "PD_SSL".sEThe "cert_expiry" parameter of "{0}" is not a valid date or date-time(RRtR�RRtCRYPTOGRAPHY_FOUNDtCRYPTOGRAPHY_VERSIONRtMINIMAL_CRYPTOGRAPHY_VERSIONRLRRMtCRYPTOGRAPHY_IMP_ERRR%R&RGR-RHR�RR,R�R�t	exit_json(tecs_argument_specR'tmodule_params_csrtcertificateR�((sR/usr/lib/python2.7/site-packages/ansible/modules/crypto/entrust/ecs_certificate.pytmainzsR		

&&


#&
&3
&
t__main__(4t
__future__RRRR�t
__metaclass__tANSIBLE_METADATAt
DOCUMENTATIONtEXAMPLEStRETURNtansible.module_utils.ecs.apiRR	R
RRtjsonRGRR{t	tracebacktdistutils.versionRtansible.module_utilsR
RItansible.module_utils.basicRRtansible.module_utils._textRRR&R�R4t__version__R�tImportErrort
format_excRR�RR�RR"R+tobjectR,R�R�R�R�(((sR/usr/lib/python2.7/site-packages/ansible/modules/crypto/entrust/ecs_certificate.pyt<module>sJ


�Nt1"

				
�	(	+	=

Anons79 File Manager Version 1.0, Coded By Anons79
Email: [email protected]