I am using the ansible shell module to compare the chain of 2 SSL certificate with openssl (they have the same chain):

openssl x509 -issuer -noout -in Certiticate1
openssl x509 -issuer -noout -in Certiticate2

I register the output in variables chain_from_certificate1 and chain_from_certificate2 then i compares there standard output:

- name: Compare the Chain
      msg: Error The chains aren't the same
    when: chain_from_certificate1.stdout !=  chain_from_certificate2.stdout

Ansible tell me that the chains are not similar (and it's false because they are).

I think that the issue came from the comparison operator because the type of the variable are "AnsibleUnsafeText" and not string.

My question how to compare 2 AnsibleUnsafeText ? and it's necessary to convert them to string before comparison ?

Thank you in advance.

  • Did you manually confirm the output of openssl x509 -issuer -noout -in Certiticate1 and openssl x509 -issuer -noout -in Certiticate2 are the same?
    – akane
    Commented Oct 9, 2020 at 11:16
  • @akane Yes i aleardy check manually and they are the same
    – Med
    Commented Oct 9, 2020 at 11:47

1 Answer 1


I believe this is due to non existing variable attribute.
Most likely chain_from_certificate1 and chain_from_certificate2 don't have stdout

Did you try debug by printing the variables?
With stdout:
Did this throw similar failure?

    - name: print variable
        msg: "{{ chain_from_certificate1.stdout }}"

Without stdout:
What is output of this?
Will this print same output as of manually execute openssl x509 -issuer -noout -in Certiticate1?

    - name: print variable
        msg: "{{ chain_from_certificate1 }}"

My assumption is that the script set the value of stdout in chain_from_certificate1 and chain_from_certificate2 rather than the stdout: <value>. Therefor stdout do not exist as attribute.
Or chain_from_certificate1 and chain_from_certificate2 contain another data structure.

The key is to print them out.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.