Create certificate without password?

[kepi]

Hi,

is there any way how to create private key without password? According to features, it should be possible:

Functionality
...
Don't password-encrypt certificate private-keys

but when not setting password for certs or setting it to empty string, password quality assertion kicks in:

infra_pki/tasks/instance/certs/manage.yml

Line 14 in da9cd71

- pki_cert_pwd | meets_password_complexity(PKI_HC)

IMHO passwords for server certificates aren't used as much as for clients certificates, so it would be great to allow it. If setting empty string to password env variable would work, fix should be probably easy.

Thanks for considering.

[ansibleguy]

Greetings!

It may be that I've forgotten to test that case, yes (:
Should work now.

Thank you for reporting the issue!

[kepi]

Just heads up that the fix isn't enough. It seems that pki_cert.sh have to be adjusted too.

I tried to fix this igloonet@05c4fcd but didn't have time to test it yet as it took me too much time and when digging through code I discovered that you can export unencrypted pem, which is working for me too. Maybe there is no need to certs without password this way.

If you want, feel free to take the changes in our branch and try them, I'm afraid now that I'll never get to finish it.