java_cert – Uses keytool to import/remove key from java keystore (cacerts)

Synopsis

  • This is a wrapper module around keytool, which can be used to import/remove certificates from a given java keystore.

Parameters

Parameter Choices/Defaults Comments
cert_alias
string
Imported certificate alias.
The alias is used when checking for the presence of a certificate in the keystore.
cert_path
path
Local path to load certificate from.
One of cert_url or cert_path is required to load certificate.
cert_port
integer
Default:
443
Port to connect to URL.
This will be used to create server URL:PORT.
cert_url
string
Basic URL to fetch SSL certificate from.
One of cert_url or cert_path is required to load certificate.
executable
string
Default:
"keytool"
Path to keytool binary if not used we search in PATH for it.
keystore_create
boolean
    Choices:
  • no
  • yes
Create keystore if it does not exist.
keystore_pass
string / required
Keystore password.
keystore_path
path
Path to keystore.
keystore_type
string
added in 2.8
Keystore type (JCEKS, JKS).
pkcs12_alias
string
added in 2.4
Alias in the PKCS12 keystore.
pkcs12_password
string
added in 2.4
 Default:
""
Password for importing from PKCS12 keystore.
pkcs12_path
path
added in 2.4
Local path to load PKCS12 keystore from.
state
string
    Choices:
  • absent
  • present ←
Defines action which can be either certificate import or removal.

Examples

- name: Import SSL certificate from google.com to a given cacerts keystore
  java_cert:
    cert_url: google.com
    cert_port: 443
    keystore_path: /usr/lib/jvm/jre7/lib/security/cacerts
    keystore_pass: changeit
    state: present

- name: Remove certificate with given alias from a keystore
  java_cert:
    cert_url: google.com
    keystore_path: /usr/lib/jvm/jre7/lib/security/cacerts
    keystore_pass: changeit
    executable: /usr/lib/jvm/jre7/bin/keytool
    state: absent

- name: Import SSL certificate from google.com to a keystore, create it if it doesn't exist
  java_cert:
    cert_url: google.com
    keystore_path: /tmp/cacerts
    keystore_pass: changeit
    keystore_create: yes
    state: present

- name: Import a pkcs12 keystore with a specified alias, create it if it doesn't exist
  java_cert:
    pkcs12_path: "/tmp/importkeystore.p12"
    cert_alias: default
    keystore_path: /opt/wildfly/standalone/configuration/defaultkeystore.jks
    keystore_pass: changeit
    keystore_create: yes
    state: present

- name: Import SSL certificate to JCEKS keystore
  java_cert:
    pkcs12_path: "/tmp/importkeystore.p12"
    pkcs12_alias: default
    pkcs12_password: somepass
    cert_alias: default
    keystore_path: /opt/someapp/security/keystore.jceks
    keystore_type: "JCEKS"
    keystore_pass: changeit
    keystore_create: yes
    state: present

Return Values

Common return values are documented here, the following are the fields unique to this module:

Key Returned Description
cmd
string
success
Executed command to get action done.

Sample:
keytool -importcert -noprompt -keystore
msg
string
success
Output from stdout of keytool command after execution of given command.

Sample:
Module require existing keystore at keystore_path '/tmp/test/cacerts'
rc
integer
success
Keytool command execution return value.

Sample:
0


Status

Authors

  • Adam Hamsik (@haad)

Hint

If you notice any issues in this documentation, you can edit this document to improve it.