openssl_pkcs12 parse action: always changed in check mode

[Normo]

SUMMARY

When dumping / parsing a PKCS#12 file in check mode the corresponding task always results in 'changed' state.

ISSUE TYPE

• Bug Report

COMPONENT NAME

• community.crypto.openssl_pkcs12

ANSIBLE VERSION

ansible 2.10.3
  config file = /etc/ansible/ansible.cfg
  configured module search path = ['/home/user/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/local/lib/python3.6/dist-packages/ansible
  executable location = /usr/local/bin/ansible
  python version = 3.6.9 (default, Oct  8 2020, 12:12:24) [GCC 8.4.0]

CONFIGURATION

OS / ENVIRONMENT

• Ubuntu 20.04

STEPS TO REPRODUCE

- name: Generate an OpenSSL private key with the default values (4096 bits, RSA)
  community.crypto.openssl_privatekey:
    path: /etc/ssl/private/ansible.com.pem

- name: Generate an OpenSSL Certificate Signing Request
  community.crypto.openssl_csr:
    path: /etc/ssl/private/www.ansible.com.csr
    privatekey_path: /etc/ssl/private/ansible.com.pem
    common_name: www.ansible.com

- name: Generate a Self Signed OpenSSL certificate
  community.crypto.x509_certificate:
    path: /etc/ssl/private/ansible.com.crt
    privatekey_path: /etc/ssl/private/ansible.com.pem
    csr_path: /etc/ssl/private/www.ansible.com.csr
    provider: selfsigned

- name: Generate PKCS#12 file
  community.crypto.openssl_pkcs12:
    action: export
    path: /etc/ssl/private/ansible.p12
    friendly_name: raclette
    privatekey_path: /etc/ssl/private/ansible.com.pem
    certificate_path: /etc/ssl/private/ansible.com.crt
    state: present

- name: Dump/Parse PKCS#12 file
  community.crypto.openssl_pkcs12:
    action: parse
    src: /etc/ssl/private/ansible.p12
    path: /etc/ssl/private/ansible.pem
    state: present

EXPECTED RESULTS

    TASK [my_test : Dump/Parse PKCS#12 file] ***************************************
    ok: [instance]

ACTUAL RESULTS

    
    TASK [my_test : Dump/Parse PKCS#12 file] ***************************************
    changed: [instance]

[felixfontein]

That's apparently intended by the code: https://github.com/ansible-collections/community.crypto/blob/main/plugins/modules/openssl_pkcs12.py#L306

[Normo]

@felixfontein I wonder, is there a good reason for this?

[felixfontein]

@Normo I don't think so.