# Signature based authentication

**URL:** <https://forum.ansible.com/t/signature-based-authentication/30701>\
**Category:** Ansible Project\
**Created:** [July 2, 2019, 8:37pm UTC](https://forum.ansible.com/t/signature-based-authentication/30701 "2019-07-02T20:37:59Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Tariq\_Iqbal](https://avatars.discourse-cdn.com/v4/letter/t/7bcc69/32.png) [@Tariq\_Iqbal](https://forum.ansible.com/u/Tariq_Iqbal)\
**Post date:** [July 2, 2019, 8:37pm UTC](https://forum.ansible.com/t/signature-based-authentication/30701/1 "2019-07-02T20:37:59Z")

</div>

Hello All,

I am trying to follow this process outlined below for Ansible to authenicate to APIC controller using signature based authentication.

[https://docs.ansible.com/ansible/latest/scenario\_guides/guide\_aci.html#signature-based-authentication-using-certificates](https://docs.ansible.com/ansible/latest/scenario_guides/guide_aci.html#signature-based-authentication-using-certificates)

I need to determine where the open ssl command is ran. Is it ran on the APIC controller or the Ansible controller?

#### Generate certificate and private key

Signature-based authentication requires a (self-signed) X.509 certificate with private key, and a configuration step for your AAA user in ACI. To generate a working X.509 certificate and private key, use the following procedure:

```auto
$ openssl req -new -newkey rsa:1024 -days 36500 -nodes -x509 -keyout admin.key -out admin.crt -subj '/CN=Admin/O=Your Company/C=US'

```

---

<div class="post-metadata">

**Author:** ![Kai\_Stian\_Olstad](https://avatars.discourse-cdn.com/v4/letter/k/e19adc/32.png) [@Kai\_Stian\_Olstad](https://forum.ansible.com/u/Kai_Stian_Olstad)\
**Post date:** [July 2, 2019, 8:48pm UTC](https://forum.ansible.com/t/signature-based-authentication/30701/2 "2019-07-02T20:48:12Z")

</div>

If you read the whole page you are linking to you find your answer  
[https://docs.ansible.com/ansible/latest/scenario\_guides/guide\_aci.html#running-on-the-controller-locally](https://docs.ansible.com/ansible/latest/scenario_guides/guide_aci.html#running-on-the-controller-locally)

---

<div class="post-metadata">

**Author:** ![Thomas\_Renzy](https://avatars.discourse-cdn.com/v4/letter/t/a9adbd/32.png) [@Thomas\_Renzy](https://forum.ansible.com/u/Thomas_Renzy)\
**Post date:** [July 2, 2019, 9:46pm UTC](https://forum.ansible.com/t/signature-based-authentication/30701/3 "2019-07-02T21:46:38Z")

</div>

Hi Tariq,

You generate this key on your Ansible control system.

Thanks,  
Thomas

---

<div class="post-metadata">

**Author:** ![Tariq\_Iqbal](https://avatars.discourse-cdn.com/v4/letter/t/7bcc69/32.png) [@Tariq\_Iqbal](https://forum.ansible.com/u/Tariq_Iqbal)\
**Post date:** [July 3, 2019, 6:32pm UTC](https://forum.ansible.com/t/signature-based-authentication/30701/4 "2019-07-03T18:32:26Z")

</div>

Thanks Tom for all your help.

---

<div class="post-metadata">

**Author:** ![Thomas\_Renzy](https://avatars.discourse-cdn.com/v4/letter/t/a9adbd/32.png) [@Thomas\_Renzy](https://forum.ansible.com/u/Thomas_Renzy)\
**Post date:** [July 4, 2019, 12:18am UTC](https://forum.ansible.com/t/signature-based-authentication/30701/5 "2019-07-04T00:18:15Z")

</div>

Hey Tariq,

One issue to be aware of. When I generated my certificate and keys, it had the start time set for 8 hours ahead of time. I can only imagine it set this because of GMT time and I am US PST. You can check the start time for the cert with the following command:

openssl x509 -in (name of cert).crt -text

Hope this helps.

Thanks,  
Thomas