# openssl\_certificate\_info subject\_hash?

**URL:** <https://forum.ansible.com/t/openssl-certificate-info-subject-hash/36328>\
**Category:** Ansible Project\
**Created:** [February 13, 2022, 5:17pm UTC](https://forum.ansible.com/t/openssl-certificate-info-subject-hash/36328 "2022-02-13T17:17:48Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Dick\_Visser](https://avatars.discourse-cdn.com/v4/letter/d/d9b06d/32.png) [@Dick\_Visser](https://forum.ansible.com/u/Dick_Visser)\
**Post date:** [February 13, 2022, 5:17pm UTC](https://forum.ansible.com/t/openssl-certificate-info-subject-hash/36328/1 "2022-02-13T17:17:48Z")

</div>

Hi

I am moving some older code that uses openssl shell commands to use  
the newer community crypto OpenSSL ansible modules. Most of that works  
well.  
However, I have this task to find the issuer's hash:

shell: echo "{{ tls\_cert\_crt }}" | openssl x509 -noout -issuer\_hash

I don't see any way of doing this using the community.crypto modules.  
I've looked at community.crypto.x509\_certificate\_info but I don't see  
this in the returned results.  
Does anyone have a suggestion?

Similar for the issuer\_hash.

thx

---

<div class="post-metadata">

**Author:** ![felixfontein](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/felixfontein/32/7530_2.png) [@felixfontein](https://forum.ansible.com/u/felixfontein)\
**Post date:** [February 13, 2022, 6:56pm UTC](https://forum.ansible.com/t/openssl-certificate-info-subject-hash/36328/2 "2022-02-13T18:56:33Z")

</div>

Hi Dick,

> I am moving some older code that uses openssl shell commands to use  
> the newer community crypto OpenSSL ansible modules. Most of that works  
> well.  
> However, I have this task to find the issuer's hash:
> 
> shell: echo "{{ tls\_cert\_crt }}" | openssl x509 -noout -issuer\_hash
> 
> I don't see any way of doing this using the community.crypto modules.  
> I've looked at community.crypto.x509\_certificate\_info but I don't see  
> this in the returned results.  
> Does anyone have a suggestion?

I haven't checked, but if the issuer/subject hash for certificates is  
similar to the one for CRLs, this unfortunately isn't easy to implement  
(using the library we're using). Or at least that used to be the case  
when I last checked this ~10 months ago 🙂 The issue where it was  
discussed is  
[https://github.com/ansible-collections/community.crypto/issues/200](https://github.com/ansible-collections/community.crypto/issues/200)

Cheers,  
Felix

---

<div class="post-metadata">

**Author:** ![Dick\_Visser](https://avatars.discourse-cdn.com/v4/letter/d/d9b06d/32.png) [@Dick\_Visser](https://forum.ansible.com/u/Dick_Visser)\
**Post date:** [February 14, 2022, 1:28pm UTC](https://forum.ansible.com/t/openssl-certificate-info-subject-hash/36328/3 "2022-02-14T13:28:34Z")

</div>

Yup, this is exactly the issue.  
I did read [https://stackoverflow.com/questions/71004481/what-does-openssl-x509-hash-calculate-the-hash-of/71004482](https://stackoverflow.com/questions/71004481/what-does-openssl-x509-hash-calculate-the-hash-of/71004482),  
and figured as much (very specific OpenSSL-ism), and didn't see any  
refs to it in python cryptography.  
We use certificates from only a handful of different CAs and we use an  
ansible role that, given just the certificate, looks up what CA and/or  
intermediates go with that. This avoids errors in deployment of the  
CA(s), the order of the intermediate(s), and also avoids the  
accidental deployment of root certs.  
Up to now I had used the issuer\_hash and subject\_hash to do this matching.  
This works, but after having read  
[https://security.stackexchange.com/a/200301](https://security.stackexchange.com/a/200301) I think this is actually  
not entirely correct.  
The correct thing to do is using the subject/issuer key identifier -  
which \*are\* reported by openssl\_certificate\_info.  
I have rewritten the tasks, and now the logic is more correct, and the  
code is simpler.