Repository: ansible-collections/community.general

Issue:
module java_cert: PKCS12 file not properly imported into keystore
### Summary

When importing a PKCS12 file into a Java keystore using the `java_cert` module on Ansible 3.3.0 (which uses `community.general 2.5.1`) only the certificate is imported but not the key.

This worked well in Ansible 3.2.0 (wich used `community.general 2.4.0`).

### Issue Type

Bug Report

### Component Name

java_cert

### Ansible Version

Ansible 3.3.0
Ansible-Base 2.10.9
community.general 2.5.1

### Configuration

_No response_

### OS / Environment

Debian 9 and 10
OpenJDK 11

### Steps to Reproduce

Running this sample play on Ansible 3.2.0 and 3.3.0 yields different results:

```yaml
    - name: Create certificate
      command: >
        openssl req -newkey rsa:4096
              -x509
              -sha256
              -nodes
              -out /tmp/example.crt
              -keyout /tmp/example.key
              -subj /C=DE/ST=Berlin/L=Berlin/O=ACME/OU=ACME/CN=localhost

    - name: Generate p12 file for certificate and private key
      command: >
        openssl pkcs12
                -export
                -in /tmp/example.crt
                -inkey /tmp/example.key
                -name localhost
                -out /tmp/example.pksc12
                -password "pass:123456789"

    - name: Generate Java keystore from p12 keystore
      java_cert:
        keystore_create: true
        keystore_pass: 123456789
        keystore_path: /tmp/keystore.jks
        pkcs12_alias: localhost
        pkcs12_path: /tmp/example.pksc12
        pkcs12_password: 123456789
        cert_alias: localhost
        state: present

    - name: Print keystore content
      command: >
        keytool
          -list
          -v
          -keystore /tmp/keystore.jks
          -storepass 123456789
```


### Expected Results

Run with Ansible 3.2.0 this results in a correct keystore that contains a `PrivateKeyEntry`:
```
    Keystore type: PKCS12
    Keystore provider: SUN
  
    Your keystore contains 1 entry
  
    Alias name: localhost
    Creation date: May 6, 2021
    Entry type: PrivateKeyEntry
    Certificate chain length: 1
    Certificate[1]:
    Owner: CN=localhost, OU=ACME, O=ACME, L=Berlin, ST=Berlin, C=DE
    Issuer: CN=localhost, OU=ACME, O=ACME, L=Berlin, ST=Berlin, C=DE
```



### Actual Results

Where on Ansible 3.3.0 the resulting keystore is
```
    Keystore type: PKCS12
    Keystore provider: SUN
  
    Your keystore contains 1 entry
  
    Alias name: localhost
    Creation date: May 6, 2021
    Entry type: trustedCertEntry
  
    Owner: CN=localhost, OU=ACME, O=ACME, L=Berlin, ST=Berlin, C=DE
    Issuer: CN=localhost, OU=ACME, O=ACME, L=Berlin, ST=Berlin, C=DE
```
It only has certificate entry but not a `PrivateKeyEntry` entry. Software using the keystore will thus complain with errors like "The KeyStore xxx does not contain any keys"

Running the play in verbose mode shows that the `keytool` commands executed differ between the Ansible versions.

On Ansible 3.2.0 `keytool -importkeystore` is invoked:
```
keytool -importkeystore -noprompt -destkeystore ''/tmp/keystore.jks'' -srcstoretype PKCS12 -deststorepass ''********'' -destkeypass ''********'' -srckeystore ''/tmp/example.pksc12'' -srcstorepass ''********'' -srcalias ''localhost'' -destalias ''localhost'' '
```

whereas on Ansible 3.3.0 `keytool -importcert` is executed:
```
  cmd:
  - keytool
  - -importcert
  - -noprompt
  - -keystore
  - /tmp/keystore.jks
  - -file
  - /tmp/tmps1mpw0xn
  - -alias
  - localhost
```
This command is only suitable for importing certificates but not a keystore as a whole:
```
$ keytool -importcert --help
keytool -importcert [OPTION]...

Imports a certificate or a certificate chain
```

### Code of Conduct

- [X] I agree to follow the Ansible Code of Conduct


Discussion:
Files identified in the description:
* [`plugins/modules/system/java_cert.py`](https://github.com/ansible-collections/community.general/blob/master/plugins/modules/system/java_cert.py)

If these files are inaccurate, please update the `component name` section of the description or use the `!component` bot command.

[click here for bot help](https://github.com/ansible/ansibullbot/blob/master/ISSUE_HELP.md)
<!--- boilerplate: components_banner --->
cc @absynth76 @haad
[click here for bot help](https://github.com/ansible/ansibullbot/blob/master/ISSUE_HELP.md)
<!--- boilerplate: notify --->
Tried out most recent versions:
Ansible 4.0.0
Ansible-Core 2.11.0
community.general 3.0.2

Issue persists in these versions too.
It has not yet been fixed, so there's no reason it should suddenly start working again :)
Hello, I think it's a to be discussed.

Between ansible 3.2.0 and 3.3.0, the logic changed in order to import the certificate, however, as the module synopsis mentions:
"This is a wrapper module around keytool, which can be used to import/remove certificates from a given java keystore"

In the previous code version, when the source was a pkcs12, the "-importkeystore" functionality of keytool was used. This method was importing the whole pkcs12 to the target keystore, including the private key. Here I would add that it was a side effect, I mean I don't think this was the intention at first. Indeed the module is called "java_cert".

I agree this is a regression in the newer version, where the logic is: whatever source it is, certificate, url or another keystore, extract the requested certificate, and import it in the - potentially new - keystore.

This logic works only on certificates so.

Unfortunately the original PR (https://github.com/ansible/ansible/pull/24616) does not mention whether importing private keys is a side-effect or not. Also unfortunately the documentation is not very precise, the short description says "Uses keytool to import/remove **key** from java keystore" (emphasis mine). It should have said "certificate".

I agree though that it makes sense to not import private keys.
Since you mention previous PR, I also retrieved one of the comment of the https://github.com/ansible/ansible/pull/24616 author, found in the really first PR introducing this module: https://github.com/ansible/ansible/pull/20274

> Hi,

>I made a simple addition to this module which makes it able to import from pkcs12 keystore files. The java keytool utility does >not support the importation of private keys in PEM format only from another keystore. Since I wanted to use ansible to >generate a keystore (containing the cert and the private key as well) for my java appservers, it was an important function to me.

> @haad If you think it is worth to add this function to the mainline, I'm happy to share the diff with you.

so it's clear that the second PR was to introduce the import private key object feature even if the original one title was:
>Add simple module to import/delete ssl certificate from/to java keystore
quite explicit :) 

Because it's already the second issue found with the new version, I would not mind rolling back until finding a cleaner solution for both issues.
> Because it's already the second issue found with the new version, I would not mind rolling back until finding a cleaner solution for both issues.

I think this (i.e. rolling back) is something we should avoid.
> > Because it's already the second issue found with the new version, I would not mind rolling back until finding a cleaner solution for both issues.
> 
> I think this (i.e. rolling back) is something we should avoid.

Agreed, the other issue is solved anyway, it was due to a typo. For this specific issue however, I think it needs discussion, looking at the way we use the module, we never relied on the fact it could potentially import a keypair, assuming the initial description was a valid statement.
I guess it would be nice to re-add support for it, since it obviously was supported before, even though it wasn't documented.
Also after #2008 java_cert doesn't import a certificates chain.
Before refactoring: there was an _import_pkcs12_path()_ function with _keytool -importkeystore_ feature 
After refactoring: there's an _import_cert_path()_ function with _keytool -importcert_ feature which doesn't import a certificate chain.
for me, https://github.com/ansible/ansible/pull/24616 makes clear that `pkcs12_*` options were introduced to import a private key into a keystore, as well as its matching certificate. So, import of private key is not a side effect, but an explicit intention, even if is is not well documented in the module. What could be considered as a side effect, in my opinion, is the import of the CA chain.

What I mean is that keytool commands taking a PKCS#12 file as input should still import the cert+key bundle, not just the cert. Otherwise it would make no sense to maintain `pkcs12_*` options, since the PKCS#12 itself is mostly used as an intermediary file to be able to put the private key into the JKS. There is no need of `pkcs12_*` options to only import a certificate.

Resolving patch:
diff --git a/plugins/modules/system/java_cert.py b/plugins/modules/system/java_cert.py
--- a/plugins/modules/system/java_cert.py
+++ b/plugins/modules/system/java_cert.py
@@ -11,15 +11,15 @@
 ---
 module: java_cert
 
-short_description: Uses keytool to import/remove key from java keystore (cacerts)
+short_description: Uses keytool to import/remove certificate to/from java keystore (cacerts)
 description:
-  - This is a wrapper module around keytool, which can be used to import/remove
-    certificates from a given java keystore.
+  - This is a wrapper module around keytool, which can be used to import certificates
+    and optionally private keys to a given java keystore, or remove them from it.
 options:
   cert_url:
     description:
       - Basic URL to fetch SSL certificate from.
-      - One of C(cert_url) or C(cert_path) is required to load certificate.
+      - Exactly one of C(cert_url), C(cert_path) or C(pkcs12_path) is required to load certificate.
     type: str
   cert_port:
     description:
@@ -30,7 +30,7 @@
   cert_path:
     description:
       - Local path to load certificate from.
-      - One of C(cert_url) or C(cert_path) is required to load certificate.
+      - Exactly one of C(cert_url), C(cert_path) or C(pkcs12_path) is required to load certificate.
     type: path
   cert_alias:
     description:
@@ -46,6 +46,10 @@
   pkcs12_path:
     description:
       - Local path to load PKCS12 keystore from.
+      - Unlike C(cert_url) and C(cert_path), the PKCS12 keystore embeds the private key matching
+        the certificate, and is used to import both the certificate and its private key into the
+        java keystore.
+      - Exactly one of C(cert_url), C(cert_path) or C(pkcs12_path) is required to load certificate.
     type: path
   pkcs12_password:
     description:
@@ -267,6 +271,7 @@ def _export_public_cert_from_pkcs12(module, executable, pkcs_file, alias, passwo
     export_cmd = [
         executable,
         "-list",
+        "-noprompt",
         "-keystore",
         pkcs_file,
         "-alias",
@@ -336,6 +341,44 @@ def _download_cert_url(module, executable, url, port):
     return fetch_out
 
 
+def import_pkcs12_path(module, executable, pkcs12_path, pkcs12_pass, pkcs12_alias,
+                       keystore_path, keystore_pass, keystore_alias, keystore_type):
+    ''' Import pkcs12 from path into keystore located on
+        keystore_path as alias '''
+    import_cmd = [
+        executable,
+        "-importkeystore",
+        "-noprompt",
+        "-srcstoretype",
+        "pkcs12",
+        "-srckeystore",
+        pkcs12_path,
+        "-srcalias",
+        pkcs12_alias,
+        "-destkeystore",
+        keystore_path,
+        "-destalias",
+        keystore_alias
+    ]
+    import_cmd += _get_keystore_type_keytool_parameters(keystore_type)
+
+    secret_data = "%s\n%s" % (keystore_pass, pkcs12_pass)
+    # Password of a new keystore must be entered twice, for confirmation
+    if not os.path.exists(keystore_path):
+        secret_data = "%s\n%s" % (keystore_pass, secret_data)
+
+    # Use local certificate from local path and import it to a java keystore
+    (import_rc, import_out, import_err) = module.run_command(import_cmd, data=secret_data, check_rc=False)
+
+    diff = {'before': '\n', 'after': '%s\n' % keystore_alias}
+    if import_rc == 0 and os.path.exists(keystore_path):
+        module.exit_json(changed=True, msg=import_out,
+                         rc=import_rc, cmd=import_cmd, stdout=import_out,
+                         error=import_err, diff=diff)
+    else:
+        module.fail_json(msg=import_out, rc=import_rc, cmd=import_cmd, error=import_err)
+
+
 def import_cert_path(module, executable, path, keystore_path, keystore_pass, alias, keystore_type, trust_cacert):
     ''' Import certificate from path into keystore located on
         keystore_path as alias '''
@@ -522,8 +565,12 @@ def main():
                 # The existing certificate must first be deleted before we insert the correct one
                 delete_cert(module, executable, keystore_path, keystore_pass, cert_alias, keystore_type, exit_after=False)
 
-            import_cert_path(module, executable, new_certificate, keystore_path,
-                             keystore_pass, cert_alias, keystore_type, trust_cacert)
+            if pkcs12_path:
+                import_pkcs12_path(module, executable, pkcs12_path, pkcs12_pass, pkcs12_alias,
+                                   keystore_path, keystore_pass, cert_alias, keystore_type)
+            else:
+                import_cert_path(module, executable, new_certificate, keystore_path,
+                                 keystore_pass, cert_alias, keystore_type, trust_cacert)
 
     module.exit_json(changed=False)
 


Test patch:
diff --git a/tests/integration/targets/java_cert/defaults/main.yml b/tests/integration/targets/java_cert/defaults/main.yml
--- a/tests/integration/targets/java_cert/defaults/main.yml
+++ b/tests/integration/targets/java_cert/defaults/main.yml
@@ -5,9 +5,11 @@ test_keystore2_path: "{{ output_dir }}/keystore2.jks"
 test_keystore2_password: changeit
 test_cert_path: "{{ output_dir }}/cert.pem"
 test_key_path: "{{ output_dir }}/key.pem"
+test_csr_path: "{{ output_dir }}/req.csr"
 test_cert2_path: "{{ output_dir }}/cert2.pem"
 test_key2_path: "{{ output_dir }}/key2.pem"
+test_csr2_path: "{{ output_dir }}/req2.csr"
 test_pkcs_path: "{{ output_dir }}/cert.p12"
 test_pkcs2_path: "{{ output_dir }}/cert2.p12"
 test_ssl: setupSSLServer.py
-test_ssl_port: 21500
\ No newline at end of file
+test_ssl_port: 21500
diff --git a/tests/integration/targets/java_cert/tasks/main.yml b/tests/integration/targets/java_cert/tasks/main.yml
--- a/tests/integration/targets/java_cert/tasks/main.yml
+++ b/tests/integration/targets/java_cert/tasks/main.yml
@@ -7,32 +7,34 @@
   block:
 
     - name: prep pkcs12 file
-      copy: src="{{ test_pkcs12_path }}" dest="{{output_dir}}/{{ test_pkcs12_path }}"
+      ansible.builtin.copy:
+        src: "{{ test_pkcs12_path }}"
+        dest: "{{ output_dir }}/{{ test_pkcs12_path }}"
 
     - name: import pkcs12
-      java_cert:
-        pkcs12_path: "{{output_dir}}/{{ test_pkcs12_path }}"
+      community.general.java_cert:
+        pkcs12_path: "{{ output_dir }}/{{ test_pkcs12_path }}"
         pkcs12_password: changeit
         pkcs12_alias: default
         cert_alias: default
-        keystore_path: "{{output_dir}}/{{ test_keystore_path }}"
+        keystore_path: "{{ output_dir }}/{{ test_keystore_path }}"
         keystore_pass: changeme_keystore
         keystore_create: yes
         state: present
       register: result_success
 
     - name: verify success
-      assert:
+      ansible.builtin.assert:
         that:
         - result_success is successful
 
     - name: import pkcs12 with wrong password
-      java_cert:
-        pkcs12_path: "{{output_dir}}/{{ test_pkcs12_path }}"
+      community.general.java_cert:
+        pkcs12_path: "{{ output_dir }}/{{ test_pkcs12_path }}"
         pkcs12_password: wrong_pass
         pkcs12_alias: default
         cert_alias: default_new
-        keystore_path: "{{output_dir}}/{{ test_keystore_path }}"
+        keystore_path: "{{ output_dir }}/{{ test_keystore_path }}"
         keystore_pass: changeme_keystore
         keystore_create: yes
         state: present
@@ -40,16 +42,16 @@
       register: result_wrong_pass
 
     - name: verify fail with wrong import password
-      assert:
+      ansible.builtin.assert:
         that:
         - result_wrong_pass is failed
 
     - name: test fail on mutually exclusive params
-      java_cert:
+      community.general.java_cert:
         cert_path: ca.crt
-        pkcs12_path: "{{output_dir}}/{{ test_pkcs12_path }}"
+        pkcs12_path: "{{ output_dir }}/{{ test_pkcs12_path }}"
         cert_alias: default
-        keystore_path: "{{output_dir}}/{{ test_keystore_path }}"
+        keystore_path: "{{ output_dir }}/{{ test_keystore_path }}"
         keystore_pass: changeme_keystore
         keystore_create: yes
         state: present
@@ -57,26 +59,26 @@
       register: result_excl_params
 
     - name: verify failed exclusive params
-      assert:
+      ansible.builtin.assert:
         that:
         - result_excl_params is failed
 
     - name: test fail on missing required params
-      java_cert:
-        keystore_path: "{{output_dir}}/{{ test_keystore_path }}"
+      community.general.java_cert:
+        keystore_path: "{{ output_dir }}/{{ test_keystore_path }}"
         keystore_pass: changeme_keystore
         state: absent
       ignore_errors: true
       register: result_missing_required_param
 
     - name: verify failed missing required params
-      assert:
+      ansible.builtin.assert:
         that:
         - result_missing_required_param is failed
 
     - name: delete object based on cert_alias parameter
-      java_cert:
-        keystore_path: "{{output_dir}}/{{ test_keystore_path }}"
+      community.general.java_cert:
+        keystore_path: "{{ output_dir }}/{{ test_keystore_path }}"
         keystore_pass: changeme_keystore
         cert_alias: default
         state: absent
@@ -84,15 +86,15 @@
       register: result_alias_deleted
 
     - name: verify object successfully deleted
-      assert:
+      ansible.builtin.assert:
         that:
         - result_alias_deleted is successful
 
-    - name: include extended test suite 
+    - name: include extended test suite
       import_tasks: state_change.yml
 
     - name: cleanup environment
-      file:
+      ansible.builtin.file:
         path: "{{ item }}"
         state: absent
       loop:
@@ -101,7 +103,9 @@
         - "{{ test_keystore2_path }}"
         - "{{ test_cert_path }}"
         - "{{ test_key_path }}"
+        - "{{ test_csr_path }}"
         - "{{ test_cert2_path }}"
         - "{{ test_key2_path }}"
+        - "{{ test_csr2_path }}"
         - "{{ test_pkcs_path }}"
-        - "{{ test_pkcs2_path }}"
\ No newline at end of file
+        - "{{ test_pkcs2_path }}"
diff --git a/tests/integration/targets/java_cert/tasks/state_change.yml b/tests/integration/targets/java_cert/tasks/state_change.yml
--- a/tests/integration/targets/java_cert/tasks/state_change.yml
+++ b/tests/integration/targets/java_cert/tasks/state_change.yml
@@ -1,36 +1,96 @@
 ---
-- name: Generate the self signed cert used as a place holder to create the java keystore
-  command: openssl req -x509 -newkey rsa:4096 -keyout {{ test_key_path }} -out {{ test_cert_path }} -days 365 -nodes -subj '/CN=localhost'
-  args:
-    creates: "{{ test_key_path }}"
+#
+# Prepare X509 and PKCS#12 materials
+#
+
+- name: Create private keys
+  community.crypto.openssl_privatekey:
+    path: "{{ item }}"
+    mode: "u=rw,go="
+  loop:
+    - "{{ test_key_path }}"
+    - "{{ test_key2_path }}"
+
+- name: Generate CSR for self-signed certificate used as a placeholder to create the java keystore
+  community.crypto.openssl_csr:
+    path: "{{ test_csr_path }}"
+    privatekey_path: "{{ test_key_path }}"
+    commonName: "localhost"
+
+- name: Generate CSR for self-signed certificate used for testing
+  community.crypto.openssl_csr:
+    path: "{{ test_csr2_path }}"
+    privatekey_path: "{{ test_key2_path }}"
+    commonName: "localhost"
+
+- name: Generate the self-signed cert used as a placeholder to create the java keystore
+  community.crypto.x509_certificate:
+    path: "{{ test_cert_path }}"
+    csr_path: "{{ test_csr_path }}"
+    privatekey_path: "{{ test_key_path }}"
+    provider: selfsigned
 
 - name: Generate the self signed cert we will use for testing
-  command: openssl req -x509 -newkey rsa:4096 -keyout '{{ test_key2_path }}' -out '{{ test_cert2_path }}' -days 365 -nodes -subj '/CN=localhost'
-  args:
-    creates: "{{ test_key2_path }}"
+  community.crypto.x509_certificate:
+    path: "{{ test_cert2_path }}"
+    csr_path: "{{ test_csr2_path }}"
+    privatekey_path: "{{ test_key2_path }}"
+    provider: selfsigned
 
 - name: Create the pkcs12 archive from the test x509 cert
-  command: >
-    openssl pkcs12
-    -in {{ test_cert_path }}
-    -inkey {{ test_key_path }}
-    -export
-    -name test_pkcs12_cert
-    -out {{ test_pkcs_path }}
-    -passout pass:"{{ test_keystore2_password }}"
+  community.crypto.openssl_pkcs12:
+    name: "test_pkcs12_cert"
+    path: "{{ test_pkcs_path }}"
+    passphrase: "{{ test_keystore2_password }}"
+    certificate_path: "{{ test_cert_path }}"
+    privatekey_path: "{{ test_key_path }}"
+  when:
+    - "not (ansible_os_family == 'RedHat' and ansible_distribution_version is version('8.0', '<'))"
+
+- name: Create the pkcs12 archive from the test x509 cert (command)
+  ansible.builtin.command:
+    cmd: >
+      openssl pkcs12 -export
+      -in {{ test_cert_path }}
+      -inkey {{ test_key_path }}
+      -name test_pkcs12_cert
+      -out {{ test_pkcs_path }}
+      -passout stdin
+    stdin: "{{ test_keystore2_password }}"
+  when:
+    - "ansible_os_family == 'RedHat'"
+    - "ansible_distribution_version is version('8.0', '<')"
 
 - name: Create the pkcs12 archive from the certificate we will be trying to add to the keystore
-  command: >
-    openssl pkcs12
-    -in {{ test_cert2_path }}
-    -inkey {{ test_key2_path }}
-    -export
-    -name test_pkcs12_cert
-    -out {{ test_pkcs2_path }}
-    -passout pass:"{{ test_keystore2_password }}"
+  community.crypto.openssl_pkcs12:
+    name: "test_pkcs12_cert"
+    path: "{{ test_pkcs2_path }}"
+    passphrase: "{{ test_keystore2_password }}"
+    certificate_path: "{{ test_cert2_path }}"
+    privatekey_path: "{{ test_key2_path }}"
+  when:
+    - "not (ansible_os_family == 'RedHat' and ansible_distribution_version is version('8.0', '<'))"
+
+- name: Create the pkcs12 archive from the certificate we will be trying to add to the keystore (command)
+  ansible.builtin.command:
+    cmd: >
+      openssl pkcs12 -export
+      -in {{ test_cert2_path }}
+      -inkey {{ test_key2_path }}
+      -name test_pkcs12_cert
+      -out {{ test_pkcs2_path }}
+      -passout stdin
+    stdin: "{{ test_keystore2_password }}"
+  when:
+    - "ansible_os_family == 'RedHat'"
+    - "ansible_distribution_version is version('8.0', '<')"
+
+#
+# Run tests
+#
 
 - name: try to create the test keystore based on the just created pkcs12, keystore_create flag not enabled
-  java_cert:
+  community.general.java_cert:
     cert_alias: test_pkcs12_cert
     pkcs12_alias: test_pkcs12_cert
     pkcs12_path: "{{ test_pkcs_path }}"
@@ -41,12 +101,12 @@
   register: result_x509_changed
 
 - name: Verify the x509 status is failed
-  assert:
+  ansible.builtin.assert:
     that:
       - result_x509_changed is failed
 
 - name: Create the test keystore based on the just created pkcs12
-  java_cert:
+  community.general.java_cert:
     cert_alias: test_pkcs12_cert
     pkcs12_alias: test_pkcs12_cert
     pkcs12_path: "{{ test_pkcs_path }}"
@@ -55,8 +115,19 @@
     keystore_pass: "{{ test_keystore2_password }}"
     keystore_create: yes
 
+- name: List newly created keystore content
+  ansible.builtin.command:
+    cmd: "keytool -list -keystore {{ test_keystore2_path }}"
+    stdin: "{{ test_keystore2_password }}"
+  register: keytool_list_keystore
+
+- name: Assert that the keystore has a private key entry
+  ansible.builtin.assert:
+    that:
+      - "keytool_list_keystore.stdout_lines[5] is match('test_pkcs12_cert,.*, PrivateKeyEntry, $')"
+
 - name: try to import from pkcs12 a non existing alias
-  java_cert:
+  community.general.java_cert:
     cert_alias: test_pkcs12_cert
     pkcs12_alias: non_existing_alias
     pkcs12_path: "{{ test_pkcs_path }}"
@@ -68,12 +139,12 @@
   register: result_x509_changed
 
 - name: Verify the x509 status is failed
-  assert:
+  ansible.builtin.assert:
     that:
       - result_x509_changed is failed
 
 - name:  import initial test certificate from file path
-  java_cert:
+  community.general.java_cert:
     cert_alias: test_cert
     cert_path: "{{ test_cert_path }}"
     keystore_path: "{{ test_keystore2_path }}"
@@ -83,7 +154,7 @@
   register: result_x509_changed
 
 - name: Verify the x509 status is changed
-  assert:
+  ansible.builtin.assert:
     that:
       - result_x509_changed is changed
 
@@ -92,7 +163,7 @@
     If the java_cert has been updated properly, then this task will report changed each time
     since the module will be comparing the hash of the certificate instead of validating that the alias
     simply exists
-  java_cert:
+  community.general.java_cert:
     cert_alias: test_cert
     cert_path: "{{ test_cert2_path }}"
     keystore_path: "{{ test_keystore2_path }}"
@@ -101,13 +172,13 @@
   register: result_x509_changed
 
 - name: Verify the x509 status is changed
-  assert:
+  ansible.builtin.assert:
     that:
       - result_x509_changed is changed
 
 - name: |
     We also want to make sure that the status doesnt change if we import the same cert
-  java_cert:
+  community.general.java_cert:
     cert_alias: test_cert
     cert_path: "{{ test_cert2_path }}"
     keystore_path: "{{ test_keystore2_path }}"
@@ -116,13 +187,13 @@
   register: result_x509_succeeded
 
 - name: Verify the x509 status is ok
-  assert:
+  ansible.builtin.assert:
     that:
       - result_x509_succeeded is succeeded
 
 - name: >
     Ensure the original pkcs12 cert is in the keystore
-  java_cert:
+  community.general.java_cert:
     cert_alias: test_pkcs12_cert
     pkcs12_alias: test_pkcs12_cert
     pkcs12_path: "{{ test_pkcs_path }}"
@@ -134,7 +205,7 @@
 - name: |
     Perform the same test, but we will now be testing the pkcs12 functionality
     If we add a different pkcs12 cert with the same alias, we should have a changed result, NOT the same
-  java_cert:
+  community.general.java_cert:
     cert_alias: test_pkcs12_cert
     pkcs12_alias: test_pkcs12_cert
     pkcs12_path: "{{ test_pkcs2_path }}"
@@ -145,13 +216,13 @@
   register: result_pkcs12_changed
 
 - name: Verify the pkcs12 status is changed
-  assert:
+  ansible.builtin.assert:
     that:
       - result_pkcs12_changed is changed
 
 - name: |
     We are requesting the same cert now, so the status should show OK
-  java_cert:
+  community.general.java_cert:
     cert_alias: test_pkcs12_cert
     pkcs12_alias: test_pkcs12_cert
     pkcs12_path: "{{ test_pkcs2_path }}"
@@ -161,7 +232,7 @@
   register: result_pkcs12_succeeded
 
 - name: Verify the pkcs12 status is ok
-  assert:
+  ansible.builtin.assert:
     that:
       - result_pkcs12_succeeded is succeeded
 
@@ -178,7 +249,7 @@
 - name: |
     Download the original cert.pem from our temporary server. The current cert should contain
      cert2.pem. Importing this cert should return a status of changed
-  java_cert:
+  community.general.java_cert:
     cert_alias: test_cert_localhost
     cert_url: localhost
     cert_port: "{{ test_ssl_port }}"
@@ -188,12 +259,12 @@
   register: result_url_changed
 
 - name: Verify that the url status is changed
-  assert:
+  ansible.builtin.assert:
     that:
       - result_url_changed is changed
 
 - name: Ensure we can remove the x509 cert
-  java_cert:
+  community.general.java_cert:
     cert_alias: test_cert
     keystore_path: "{{ test_keystore2_path }}"
     keystore_pass: "{{ test_keystore2_password }}"
@@ -201,12 +272,12 @@
   register: result_x509_absent
 
 - name: Verify the x509 cert is absent
-  assert:
+  ansible.builtin.assert:
     that:
       - result_x509_absent is changed
 
 - name: Ensure we can remove the certificate imported from pkcs12 archive
-  java_cert:
+  community.general.java_cert:
     cert_alias: test_pkcs12_cert
     keystore_path: "{{ test_keystore2_path }}"
     keystore_pass: "{{ test_keystore2_password }}"
@@ -214,6 +285,6 @@
   register: result_pkcs12_absent
 
 - name: Verify the pkcs12 archive is absent
-  assert:
+  ansible.builtin.assert:
     that:
       - result_pkcs12_absent is changed