Repository: ansible/ansible

Issue:
openssl_certificate should offer _strict options for issuer and subject
<!---
Verify first that your issue/request is not already reported on GitHub.
Also test if the latest release, and master branch are affected too.
-->

##### ISSUE TYPE
<!--- Pick one below and delete the rest: -->
 - Feature Idea

##### COMPONENT NAME
<!--- Name of the module/plugin/task/feature -->
openssl_certificate

##### ANSIBLE VERSION
<!--- Paste verbatim output from “ansible --version” between quotes below -->
```
2.4
```


##### SUMMARY
<!--- Explain the problem briefly -->
The parameters `subject_strict` and `issuer_strict` should also be available in openssl_certificate, with similar semantics as the existing `_strict` parameters.

<!--- You can also paste gist.github.com links for larger files -->

##### EXPECTED RESULTS
<!--- What did you expect to happen when running the steps above? -->
It is possible to make sure that an issuer/subject _only_ contains certain values, not any more than that.

##### ACTUAL RESULTS
<!--- What actually happened? If possible run with extra verbosity (-vvvv) -->

Additional key:value pairs in these fields are accepted as correct.


Discussion:
cc @Spredzy
[click here for bot help](https://github.com/ansible/ansibullbot/blob/master/ISSUE_HELP.md)
<!--- boilerplate: notify --->
Parameters are created in #30338, once this merges, I'll expose them in another PR

Resolving patch:
diff --git a/lib/ansible/modules/crypto/openssl_certificate.py b/lib/ansible/modules/crypto/openssl_certificate.py
--- a/lib/ansible/modules/crypto/openssl_certificate.py
+++ b/lib/ansible/modules/crypto/openssl_certificate.py
@@ -112,11 +112,25 @@
             - Key/value pairs that must be present in the issuer name field of the certificate.
               If you need to specify more than one value with the same key, use a list as value.
 
+    issuer_strict:
+        default: False
+        type: bool
+        description:
+            - If set to True, the I(issuer) field must contain only these values.
+        version_added: "2.5"
+
     subject:
         description:
             - Key/value pairs that must be present in the subject name field of the certificate.
               If you need to specify more than one value with the same key, use a list as value.
 
+    subject_strict:
+        default: False
+        type: bool
+        description:
+            - If set to True, the I(subject) field must contain only these values.
+        version_added: "2.5"
+
     has_expired:
         default: False
         type: bool
@@ -457,12 +471,12 @@ def __init__(self, module):
             self.subject = crypto_utils.parse_name_field(module.params['subject'])
         else:
             self.subject = []
-        self.subject_strict = False
+        self.subject_strict = module.params['subject_strict']
         if module.params['issuer']:
             self.issuer = crypto_utils.parse_name_field(module.params['issuer'])
         else:
             self.issuer = []
-        self.issuer_strict = False
+        self.issuer_strict = module.params['issuer_strict']
         self.has_expired = module.params['has_expired']
         self.version = module.params['version']
         self.keyUsage = module.params['keyUsage']
@@ -754,7 +768,9 @@ def main():
             privatekey_passphrase=dict(type='path', no_log=True),
             signature_algorithms=dict(type='list'),
             subject=dict(type='dict'),
+            subject_strict=dict(type='bool', default=False),
             issuer=dict(type='dict'),
+            issuer_strict=dict(type='bool', default=False),
             has_expired=dict(type='bool', default=False),
             version=dict(type='int'),
             keyUsage=dict(type='list', aliases=['key_usage']),


Test patch: