# Openssl\_certificate -- register my certs in my CA database **URL:** \ **Category:** Get Help\ **Tags:** ssl, openssl, module, crypto, collections\ **Created:** [September 12, 2023, 12:58pm UTC](https://forum.ansible.com/t/openssl-certificate-register-my-certs-in-my-ca-database/549 "2023-09-12T12:58:00Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![erichymowitz](https://avatars.discourse-cdn.com/v4/letter/e/9d8465/32.png) [@erichymowitz](https://forum.ansible.com/u/erichymowitz)\ **Post date:** [September 12, 2023, 12:58pm UTC](https://forum.ansible.com/t/openssl-certificate-register-my-certs-in-my-ca-database/549/1 "2023-09-12T12:58:00Z")
Greetings. I have a local CA for my network of machines. I am successfully using ansible modules openssl\_privatekey / openssl\_csr / openssl\_certificate to create and distribute SSL certificates. However … When I use the `openssl ca` command to create a cert, it will - check my CA database (index.txt) for a matching subject - generate a sequential serial number - register my new cert in the database Sadly, the ansible modules don’t do this. It simply generates a certificate with (what I think is) a random serial number and does nothing with my index.txt file. Is there a way that I can configure the ansible modules to manage my CA database? Or will I need to use a shell module to run the `openssl ca` command the way i want it to run? Thanks. ---
**Author:** ![ptn](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/ptn/32/481_2.png) [@ptn](https://forum.ansible.com/u/ptn)\ **Post date:** [September 13, 2023, 2:47pm UTC](https://forum.ansible.com/t/openssl-certificate-register-my-certs-in-my-ca-database/549/2 "2023-09-13T14:47:34Z")
Hey, Sadly, I don’t have a definitive answer to your question :/. I was looking for this a few years back, and couldn’t find a better solution than using ‘command’ module to this effect. Right now, [community.crypto](https://docs.ansible.com/ansible/latest/collections/community/crypto/index.html#modules) collection doesn’t seem indeed to provide such a module. These days, I’m using [this role](https://github.com/gametize/ansible-role-install-root-cert) to push CA certs to remote servers; as you can see, install tasks directly use `update-ca-certificates` command, which is indeed not very elegant. I hope someone else will provide a better solution. ---
**Author:** ![felixfontein](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/felixfontein/32/7530_2.png) [@felixfontein](https://forum.ansible.com/u/felixfontein)\ **Post date:** [September 17, 2023, 11:35am UTC](https://forum.ansible.com/t/openssl-certificate-register-my-certs-in-my-ca-database/549/3 "2023-09-17T11:35:59Z")
The community.crypto collection has nothing which can help you with this. The openssl\_\* modules only indirectly use OpenSSL as a library under the hood (mostly via Python’s cryptography library, which is for many parts also using its own Rust code instead of relying on OpenSSL nowadays), and in very few cases (I think mostly openssl\_pkcs12) PyOpenSSL. They never intended to support all features that the OpenSSL binary provides. The CA feature of the OpenSSL binary is something very specific to OpenSSL that the x509\_certificate module (it has been renamed to that from openssl\_certificate years ago since it really isn’t about OpenSSL, but about X.509 certificates) never supported and never will. If someone wants support for `openssl ca`, then a new module (or even multiple modules, since `openssl ca` can do quite a few things), for example named `openssl_ca`, needs to be added for that. ---
**Author:** ![erichymowitz](https://avatars.discourse-cdn.com/v4/letter/e/9d8465/32.png) [@erichymowitz](https://forum.ansible.com/u/erichymowitz)\ **Post date:** [September 18, 2023, 2:29pm UTC](https://forum.ansible.com/t/openssl-certificate-register-my-certs-in-my-ca-database/549/4 "2023-09-18T14:29:35Z")
Thank you both. Indeed, I ended up putting my `openssl ca `command into a template, using that template to create a temporary script, and using `expect` to run the script and use my CA password from an ansible vault. –EbH ---
**Author:** ![system](https://us1.discourse-cdn.com/ansible/original/1X/1882d9a01da5d8996a862359b0913cc568a39b84.svg) [@system](https://forum.ansible.com/u/system)\ **Post date:** [October 18, 2023, 2:29pm UTC](https://forum.ansible.com/t/openssl-certificate-register-my-certs-in-my-ca-database/549/5 "2023-10-18T14:29:52Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.