0

I am using the ansible shell module to compare the chain of 2 SSL certificate with openssl (they have the same chain):

openssl x509 -issuer -noout -in Certiticate1
openssl x509 -issuer -noout -in Certiticate2

I register the output in variables chain_from_certificate1 and chain_from_certificate2 then i compares there standard output:

- name: Compare the Chain
    fail:
      msg: Error The chains aren't the same
    when: chain_from_certificate1.stdout !=  chain_from_certificate2.stdout

Ansible tell me that the chains are not similar (and it's false because they are).

I think that the issue came from the comparison operator because the type of the variable are "AnsibleUnsafeText" and not string.

My question how to compare 2 AnsibleUnsafeText ? and it's necessary to convert them to string before comparison ?

Thank you in advance.

  • Did you manually confirm the output of openssl x509 -issuer -noout -in Certiticate1 and openssl x509 -issuer -noout -in Certiticate2 are the same? – akane Oct 9 at 11:16
  • @akane Yes i aleardy check manually and they are the same – Med Oct 9 at 11:47
0

I believe this is due to non existing variable attribute.
Most likely chain_from_certificate1 and chain_from_certificate2 don't have stdout

Did you try debug by printing the variables?
With stdout:
Did this throw similar failure?

    - name: print variable
      debug:
        msg: "{{ chain_from_certificate1.stdout }}"

Without stdout:
What is output of this?
Will this print same output as of manually execute openssl x509 -issuer -noout -in Certiticate1?

    - name: print variable
      debug:
        msg: "{{ chain_from_certificate1 }}"

My assumption is that the script set the value of stdout in chain_from_certificate1 and chain_from_certificate2 rather than the stdout: <value>. Therefor stdout do not exist as attribute.
Or chain_from_certificate1 and chain_from_certificate2 contain another data structure.

The key is to print them out.

| improve this answer | |
  • tnxs for you help – Med Oct 11 at 20:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.