# Choosing Cipher In openssl\_privatekey Module With Cryptography Back End **URL:** \ **Category:** Ansible Project\ **Created:** [June 2, 2020, 7:30pm UTC](https://forum.ansible.com/t/choosing-cipher-in-openssl-privatekey-module-with-cryptography-back-end/33076 "2020-06-02T19:30:23Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![B.H](https://avatars.discourse-cdn.com/v4/letter/b/8797f3/32.png) [@B.H](https://forum.ansible.com/u/B.H)\ **Post date:** [June 2, 2020, 7:30pm UTC](https://forum.ansible.com/t/choosing-cipher-in-openssl-privatekey-module-with-cryptography-back-end/33076/1 "2020-06-02T19:30:23Z")
With the pyOpenSSL back end of the openssl\_privatekey module deprecated in Ansible 2.9, a colleague started looking at the cryptography back end. According to the documentation: openssl\_privatekey – Generate OpenSSL private keys [[https://docs.ansible.com/ansible/latest/modules/openssl\_privatekey\_module.html](https://docs.ansible.com/ansible/latest/modules/openssl_privatekey_module.html)] …the “cipher” parameter must be set to “auto” when using the cryptography back end. There does not seem to be a way, using the cryptography back end, to specify the cipher used to encrypt the private key. Does anybody know why? I don’t see that as a feature request: [[https://github.com/ansible/ansible/issues?q=is%3Aissue+is%3Aopen+openssl\_privatekey](https://github.com/ansible/ansible/issues?q=is%3Aissue+is%3Aopen+openssl_privatekey)] …so should I file one? Thanks! ---
**Author:** ![felixfontein](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/felixfontein/32/7530_2.png) [@felixfontein](https://forum.ansible.com/u/felixfontein)\ **Post date:** [June 2, 2020, 7:47pm UTC](https://forum.ansible.com/t/choosing-cipher-in-openssl-privatekey-module-with-cryptography-back-end/33076/2 "2020-06-02T19:47:30Z")
Hi, > With the pyOpenSSL back end of the openssl\_privatekey module > deprecated in Ansible 2.9, a colleague started looking at the > cryptography back end. According to the documentation: > > openssl\_privatekey – Generate OpenSSL private keys > [[https://docs.ansible.com/ansible/latest/modules/openssl\_privatekey\_module.html\](https://docs.ansible.com/ansible/latest/modules/openssl_privatekey_module.html%5C)] > > ...the "cipher" parameter must be set to "auto" when using the > cryptography back end. There does not seem to be a way, using the > cryptography back end, to specify the cipher used to encrypt the > private key. > > Does anybody know why? I don't see that as a feature request: > > [[https://github.com/ansible/ansible/issues?q=is%3Aissue+is%3Aopen+openssl\_privatekey](https://github.com/ansible/ansible/issues?q=is%3Aissue+is%3Aopen+openssl_privatekey)] > > ...so should I file one? Thanks! the reason is that cryptography ([https://cryptography.io/en/latest/](https://cryptography.io/en/latest/)) only supports two states: unencrypted, and encrypted with its own choice of algorithm ("best available algorithm"): [https://cryptography.io/en/latest/hazmat/primitives/asymmetric/serialization/#serialization-encryption-types](https://cryptography.io/en/latest/hazmat/primitives/asymmetric/serialization/#serialization-encryption-types) Cheers, Felix ---
**Author:** ![B.H](https://avatars.discourse-cdn.com/v4/letter/b/8797f3/32.png) [@B.H](https://forum.ansible.com/u/B.H)\ **Post date:** [June 2, 2020, 9:35pm UTC](https://forum.ansible.com/t/choosing-cipher-in-openssl-privatekey-module-with-cryptography-back-end/33076/3 "2020-06-02T21:35:09Z")
Thank you, Felix! I guess I'll have to submit a pull request[1].       Is there a particular reason Ansible is deprecating pyOpenSSL? It seems it has more features and is still an active project[2]. (The last change was not too long ago in November 2019.) [1][[https://github.com/pyca/cryptography/pulls\](https://github.com/pyca/cryptography/pulls%5C)] [2][[https://www.pyopenssl.org/en/stable/changelog.html\](https://www.pyopenssl.org/en/stable/changelog.html%5C)] ---
**Author:** ![felixfontein](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/felixfontein/32/7530_2.png) [@felixfontein](https://forum.ansible.com/u/felixfontein)\ **Post date:** [June 2, 2020, 9:54pm UTC](https://forum.ansible.com/t/choosing-cipher-in-openssl-privatekey-module-with-cryptography-back-end/33076/4 "2020-06-02T21:54:27Z")
Hi, > \> the reason is that cryptography ([https://cryptography.io/en/latest/](https://cryptography.io/en/latest/)) > \> only supports two states: unencrypted, and encrypted with its own > \> choice of algorithm ("best available algorithm"): > \> [https://cryptography.io/en/latest/hazmat/primitives/asymmetric/serialization/#serialization-encryption-types](https://cryptography.io/en/latest/hazmat/primitives/asymmetric/serialization/#serialization-encryption-types) > \> > >       Thank you, Felix! I guess I'll have to submit a pull > request[1]. Is there a particular reason Ansible is deprecating > pyOpenSSL? It seems it has more features and is still an active > project[2]. (The last change was not too long ago in November 2019.) well, there's the big fat note in [https://github.com/pyca/pyopenssl/blob/master/README.rst:](https://github.com/pyca/pyopenssl/blob/master/README.rst:) > \*\*Note:\*\* The Python Cryptographic Authority \*\*strongly suggests\*\* the > use of pyca/cryptography where possible. If you are using pyOpenSSL for > anything other than making a TLS connection \*\*you should move to > cryptography and drop your pyOpenSSL dependency\*\*. Besides that, working with pyOpenSSL is really not that much fun. I'd rather get rid of the pyOpenSSL backends yesterday than somewhen in the future... Cheers, Felix ---
**Author:** ![B.H](https://avatars.discourse-cdn.com/v4/letter/b/8797f3/32.png) [@B.H](https://forum.ansible.com/u/B.H)\ **Post date:** [June 2, 2020, 10:06pm UTC](https://forum.ansible.com/t/choosing-cipher-in-openssl-privatekey-module-with-cryptography-back-end/33076/5 "2020-06-02T22:06:45Z")
I missed that; thank you. That was super helpful.