# Issue with openssl\_csr authority\_cert\_issuer **URL:** \ **Category:** Ansible Project\ **Created:** [February 21, 2020, 10:46pm UTC](https://forum.ansible.com/t/issue-with-openssl-csr-authority-cert-issuer/32300 "2020-02-21T22:46:01Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Joshua\_Goldman](https://avatars.discourse-cdn.com/v4/letter/j/90ced4/32.png) [@Joshua\_Goldman](https://forum.ansible.com/u/Joshua_Goldman)\ **Post date:** [February 21, 2020, 10:46pm UTC](https://forum.ansible.com/t/issue-with-openssl-csr-authority-cert-issuer/32300/1 "2020-02-21T22:46:01Z")
Hello, I am trying to specify O and CN authority\_cert\_issuer: ‘dirName:O = Example Net, CN = [example.net](http://example.net)’ authority\_key\_identifier: xxxxxxxx authority\_cert\_serial\_number: xxxxxxxxx I get the following error on playbook run. “msg”: “Cannot parse Subject Alternative Name "dirName:O = Packet Hosting" (potentially unsupported by cryptography backend)” Here is the trace The full traceback is: WARNING: The below traceback may _not_ be related to the actual failure. File “/tmp/ansible\_openssl\_csr\_payload\_wKv9F1/ansible\_openssl\_csr\_payload.zip/ansible/modules/crypto/openssl\_csr.py”, line 1088, in main File “/tmp/ansible\_openssl\_csr\_payload\_wKv9F1/ansible\_openssl\_csr\_payload.zip/ansible/modules/crypto/openssl\_csr.py”, line 541, in generate File “/tmp/ansible\_openssl\_csr\_payload\_wKv9F1/ansible\_openssl\_csr\_payload.zip/ansible/modules/crypto/openssl\_csr.py”, line 812, in \_generate\_csr File “/tmp/ansible\_openssl\_csr\_payload\_wKv9F1/ansible\_openssl\_csr\_payload.zip/ansible/module\_utils/crypto.py”, line 1772, in cryptography\_get\_name raise OpenSSLObjectError(‘Cannot parse Subject Alternative Name “{0}” (potentially unsupported by cryptography backend)’.format(name)) > ` > > | > | | > | > > def cryptography\_get\_name(name): > > | > | | > > ‘’’ > > | > | | > > Given a name string, returns a cryptography x509.Name object. > > | > | | > > Raises an OpenSSLObjectError if the name is unknown or cannot be parsed. > > | > | | > > ‘’’ > > | > | | > > try: > > | > | | > > if name.startswith(‘DNS:’): > > | > | | > > return x509.DNSName(to\_text(name[4:])) > > | > | | > > if name.startswith(‘IP:’): > > | > | | > > return x509.IPAddress(ipaddress.ip\_address(to\_text(name[3:]))) > > | > | | > > if name.startswith(‘email:’): > > | > | | > > return x509.RFC822Name(to\_text(name[6:])) > > | > | | > > if name.startswith(‘URI:’): > > | > | | > > return x509.UniformResourceIdentifier(to\_text(name[4:])) > > | > | | > > except Exception as e: > > | > | | > > raise OpenSSLObjectError(‘Cannot parse Subject Alternative Name “{0}”: {1}’.format(name, e)) > > | > | | > > if ‘:’ not in name: > > | > | | > > raise OpenSSLObjectError(‘Cannot parse Subject Alternative Name “{0}” (forgot “DNS:” prefix?)’.format(name)) > > | > | | > > raise OpenSSLObjectError(‘Cannot parse Subject Alternative Name “{0}” (potentially unsupported by cryptography backend)’.format(name)) > > | > | | > > ` The documentation says it should support dirname but indeed it doesn’t. Can we amend the documentation? Thanks, Josh Goldman ---
**Author:** ![felixfontein](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/felixfontein/32/7530_2.png) [@felixfontein](https://forum.ansible.com/u/felixfontein)\ **Post date:** [February 22, 2020, 6:44pm UTC](https://forum.ansible.com/t/issue-with-openssl-csr-authority-cert-issuer/32300/2 "2020-02-22T18:44:22Z")
Hi, > I am trying to specify O and CN > >             authority\_cert\_issuer: 'dirName:O = Example Net, CN = > example.net' >             authority\_key\_identifier: xxxxxxxx >             authority\_cert\_serial\_number: xxxxxxxxx > > I get the following error on playbook run. > >     "msg": "Cannot parse Subject Alternative Name \"dirName:O = > Packet Hosting\" (potentially unsupported by cryptography backend)" > [...] > > The documentation says it should support dirname but indeed it > doesn't. Can we amend the documentation? It does list it as a possible prefix for authorityCertIssuer, but IMO it doesn't really say that it is actually supported 🙂 The main reason I didn't add support for dirName (and otherName and RID) when adding the cryptography backend is that I wasn't very familiar with them, and then I forgot about that and never followed up on that. Also, so far, nobody asked for them or created a PR to add them. (The same problem is true for subjectAltName, which in fact uses the same code to parse the names.) I've played around with it a bit today, and created a PR to add support for these names (instead of removing them from the documentation). I think that's the better way forward. Feel free to test it and/or give it a review: [https://github.com/ansible/ansible/pull/67669](https://github.com/ansible/ansible/pull/67669) Cheers, Felix ---
**Author:** ![Joshua\_Goldman](https://avatars.discourse-cdn.com/v4/letter/j/90ced4/32.png) [@Joshua\_Goldman](https://forum.ansible.com/u/Joshua_Goldman)\ **Post date:** [February 24, 2020, 4:22pm UTC](https://forum.ansible.com/t/issue-with-openssl-csr-authority-cert-issuer/32300/3 "2020-02-24T16:22:54Z")
Amazing!! Thank you, I am looking at the code now. Let me see if I can test it.