# openssl genrsa require password in ansible script

**URL:** <https://forum.ansible.com/t/openssl-genrsa-require-password-in-ansible-script/28488>\
**Category:** Ansible Developer\
**Created:** [September 1, 2018, 4:27pm UTC](https://forum.ansible.com/t/openssl-genrsa-require-password-in-ansible-script/28488 "2018-09-01T16:27:20Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Pradeep\_Drall](https://avatars.discourse-cdn.com/v4/letter/p/ea666f/32.png) [@Pradeep\_Drall](https://forum.ansible.com/u/Pradeep_Drall)\
**Post date:** [September 1, 2018, 4:27pm UTC](https://forum.ansible.com/t/openssl-genrsa-require-password-in-ansible-script/28488/1 "2018-09-01T16:27:20Z")

</div>

when I run below mentioned commands to generate RSA and csr in linux prompt , its require a password (Enter pass phrase for pradeep.key) and mention there “abc” password. Please do let me know how to capture this password in ansible script. When I mention -des3 then its require the password and its mandatory part.

1. openssl genrsa -des3 -out pradeep.key 2048
2. openssl req -new -key pradeep.key -out pradeepcsr.csr -config set.txt
3. openssl pkcs12 -export -out pradeep.p12 -inkey pradeep.key -in cert.pem

Generating RSA private key, 2048 bit long modulus  
…+++  
…+++  
e is 65537 (0x10001)  
Enter pass phrase for pradeep.key:  
Verifying - Enter pass phrase for pradeep.key:

I mentioned below ansible script :

command: openssl genrsa   
-des3   
-out “/app/ex.key” 2048

command: openssl req   
-new   
-subj ‘/C=US/ST=Florida/L=atlanta View/O=xx/CN=abc’  
-key “/app/ex.key”   
-out “/app/ex.csr”

Secondly, can we do this part with any ansible module, I tried with openssl\_privatekey but its not cover all above details.

---

<div class="post-metadata">

**Author:** ![Yanis\_Guenane](https://avatars.discourse-cdn.com/v4/letter/y/90db22/32.png) [@Yanis\_Guenane](https://forum.ansible.com/u/Yanis_Guenane)\
**Post date:** [September 1, 2018, 9:40pm UTC](https://forum.ansible.com/t/openssl-genrsa-require-password-in-ansible-script/28488/2 "2018-09-01T21:40:18Z")

</div>

Hi Pradeep,

The scenario you mentionned can be realized using only Ansible openssl  
modules[1]. Note: openssl\_pkcs12 is only available starting with Ansible  
2.7.

---

<div class="post-metadata">

**Author:** ![ipitythaphool](https://avatars.discourse-cdn.com/v4/letter/i/6de8d8/32.png) [@ipitythaphool](https://forum.ansible.com/u/ipitythaphool)\
**Post date:** [September 1, 2018, 11:06pm UTC](https://forum.ansible.com/t/openssl-genrsa-require-password-in-ansible-script/28488/3 "2018-09-01T23:06:37Z")

</div>

Assuming you have pyopenssl, and depending on your requirements and python knowledge... you could write your own module to do this pretty easily for earlier ansible versions