# openssl genrsa require password in ansible script

**URL:** <https://forum.ansible.com/t/openssl-genrsa-require-password-in-ansible-script/28487>\
**Category:** Ansible Project\
**Created:** [September 1, 2018, 4:24pm UTC](https://forum.ansible.com/t/openssl-genrsa-require-password-in-ansible-script/28487 "2018-09-01T16:24:57Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Pradeep\_Drall](https://avatars.discourse-cdn.com/v4/letter/p/ea666f/32.png) [@Pradeep\_Drall](https://forum.ansible.com/u/Pradeep_Drall)\
**Post date:** [September 1, 2018, 4:24pm UTC](https://forum.ansible.com/t/openssl-genrsa-require-password-in-ansible-script/28487/1 "2018-09-01T16:24:57Z")

</div>

when I run below mentioned commands to generate RSA and csr in linux prompt , its require a password (Enter pass phrase for pradeep.key) and mention there “abc” password. Please do let me know how to capture this password in ansible script. When I mention -des3 then its require the password and its mandatory part.

1. openssl genrsa -des3 -out pradeep.key 2048
2. openssl req -new -key pradeep.key -out pradeepcsr.csr -config set.txt
3. openssl pkcs12 -export -out pradeep.p12 -inkey pradeep.key -in cert.pem

Generating RSA private key, 2048 bit long modulus  
…+++  
…+++  
e is 65537 (0x10001)  
Enter pass phrase for pradeep.key:  
Verifying - Enter pass phrase for pradeep.key:

I mentioned below ansible script :

command: openssl genrsa   
-des3   
-out “/app/ex.key” 2048

command: openssl req   
-new   
-subj ‘/C=US/ST=Florida/L=atlanta View/O=xx/CN=abc’  
-key “/app/ex.key”   
-out “/app/ex.csr”

Secondly, can we do this part with any ansible module, I tried with openssl\_privatekey but its not cover all above details.

---

<div class="post-metadata">

**Author:** ![Stephane\_Emilien](https://avatars.discourse-cdn.com/v4/letter/s/5fc32e/32.png) [@Stephane\_Emilien](https://forum.ansible.com/u/Stephane_Emilien)\
**Post date:** [September 2, 2018, 9:42am UTC](https://forum.ansible.com/t/openssl-genrsa-require-password-in-ansible-script/28487/2 "2018-09-02T09:42:22Z")

</div>

Hello,

Did you have issue generating your keys and csr via the openssl modules?

Because the following should correspond to your case (and work with ansible \>=2.4):

`

- openssl\_privatekey:  
path: /app/ex.key  
passphrase: abcd  
cipher: des3  
size: 2048

- openssl\_csr:  
path: /app/ex.csr  
privatekey\_path: /app/ex.key  
privatekey\_passphrase: abcd  
common\_name: abc  
state\_or\_province\_name: Florida  
locality\_name: atlanta View  
organization\_name: xx  
country\_name: US  
`

If you really want to go the other route, take a look at the expect module ([link](https://docs.ansible.com/ansible/latest/modules/expect_module.html))  
Below is an example:

`

- expect:  
command: openssl genrsa -des3 -out /tmp/pradeep.key 2048  
responses:  
Enter pass phrase: abcd  
`

The questions are by default quite fuzzy so in this case we’re using it as a substring (matches both: " **Enter pass phrase** for " and “Verifying - **Enter pass phrase** for”)

No modules are yet available in the release version for pkcs12 management.  
You may need to go the expect route or use the OpenSSL’s passin/passout options

PS: There is also a module available in the devel branch [https://github.com/ansible/ansible/pull/27320](https://github.com/ansible/ansible/pull/27320) if you want to try out

- SDE

---

<div class="post-metadata">

**Author:** ![Pradeep\_Drall](https://avatars.discourse-cdn.com/v4/letter/p/ea666f/32.png) [@Pradeep\_Drall](https://forum.ansible.com/u/Pradeep_Drall)\
**Post date:** [September 2, 2018, 4:34pm UTC](https://forum.ansible.com/t/openssl-genrsa-require-password-in-ansible-script/28487/3 "2018-09-02T16:34:35Z")

</div>

Thanks for your response.

I tried with expect module but getting below mentioned error

“msg”: “The pexpect python module is required”

//

---

<div class="post-metadata">

**Author:** ![Kai\_Stian\_Olstad](https://avatars.discourse-cdn.com/v4/letter/k/e19adc/32.png) [@Kai\_Stian\_Olstad](https://forum.ansible.com/u/Kai_Stian_Olstad)\
**Post date:** [September 2, 2018, 4:50pm UTC](https://forum.ansible.com/t/openssl-genrsa-require-password-in-ansible-script/28487/4 "2018-09-02T16:50:56Z")

</div>

As the documentation and the message say you need install the python module pexpect on the host(s).  
[https://docs.ansible.com/ansible/latest/modules/expect\_module.html#requirements](https://docs.ansible.com/ansible/latest/modules/expect_module.html#requirements)