Skip to content
Snippets Groups Projects
Commit 57bc35df authored by Rafael Guterres Jeffman's avatar Rafael Guterres Jeffman
Browse files

ipacert: Fix ipacert tests

It seems that in recent versions, a minimum of 2048 bits for RSA keys
are required to request a certificate. This seems to be enforced by
crypto policies.

By adjusting the key size all ipacert tests pass.
parent a2f59e1a
No related branches found
No related tags found
No related merge requests found
...@@ -40,7 +40,7 @@ ...@@ -40,7 +40,7 @@
- name: Create CSR - name: Create CSR
ansible.builtin.shell: ansible.builtin.shell:
cmd: "openssl req -newkey rsa:1024 -keyout /dev/null -nodes -subj /CN=certhost.{{ ipa_domain }}" cmd: "openssl req -newkey rsa:2048 -keyout /dev/null -nodes -subj /CN=certhost.{{ ipa_domain }}"
register: host_req register: host_req
- name: Create CSR file - name: Create CSR file
......
...@@ -51,7 +51,7 @@ ...@@ -51,7 +51,7 @@
- name: Create signing request for certificate - name: Create signing request for certificate
ansible.builtin.shell: ansible.builtin.shell:
cmd: "openssl req -newkey rsa:1024 -keyout /dev/null -nodes -subj /CN=certservice.{{ ipa_domain }}" cmd: "openssl req -newkey rsa:2048 -keyout /dev/null -nodes -subj /CN=certservice.{{ ipa_domain }}"
register: service_req register: service_req
- name: Create CSR file - name: Create CSR file
......
...@@ -36,7 +36,7 @@ ...@@ -36,7 +36,7 @@
- name: Crete CSR - name: Crete CSR
ansible.builtin.shell: ansible.builtin.shell:
cmd: cmd:
'openssl req -newkey rsa:1024 -keyout /dev/null -nodes -subj /CN=certuser -reqexts IECUserRoles 'openssl req -newkey rsa:2048 -keyout /dev/null -nodes -subj /CN=certuser -reqexts IECUserRoles
-config <(cat /etc/pki/tls/openssl.cnf; printf "[IECUserRoles]\n1.2.840.10070.8.1=ASN1:UTF8String:hello world")' -config <(cat /etc/pki/tls/openssl.cnf; printf "[IECUserRoles]\n1.2.840.10070.8.1=ASN1:UTF8String:hello world")'
executable: /bin/bash executable: /bin/bash
register: user_req register: user_req
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment