dellemc.openmanage.idrac_certificates module – Configure certificates for iDRAC

Note

This module is part of the dellemc.openmanage collection (version 11.0.0).

You might already have this collection installed if you are using the ansible package. It is not included in ansible-core. To check whether it is installed, run ansible-galaxy collection list.

To install it, use: ansible-galaxy collection install dellemc.openmanage. You need further requirements to be able to use this module, see Requirements for details.

To use it in a playbook, specify: dellemc.openmanage.idrac_certificates.

New in dellemc.openmanage 5.5.0

Synopsis 

This module allows to generate certificate signing request, import, and export certificates on iDRAC.

Requirements 

The below requirements are needed on the host that executes this module.

python >= 3.9.6

Parameters 

Parameter	Comments
ca_path path added in dellemc.openmanage 5.0.0	The Privacy Enhanced Mail (PEM) file that contains a CA certificate to be used for the validation.
cert_fingerprint string	SHA-256 fingerprint of the expected TLS certificate (hex digest, with or without colons). When supplied together with `validate_certs=false`, the module verifies the remote certificate’s fingerprint instead of performing full CA validation.
cert_params dictionary	Certificate parameters to generate signing request.
common_name string / required	The common name of the certificate.
country_code string / required	The country code of the country where the entity applying for certification is located.
email_address string	The email associated with the CSR.
locality_name string / required	The city or other location where the entity applying for certification is located.
organization_name string / required	The name associated with an organization.
organization_unit string / required	The name associated with an organizational unit. For example department name.
state_name string / required	The state where the entity applying for certification is located.
subject_alt_name list / elements=string	The alternative domain names associated with the request. Default: `[]`
certificate_path path	Absolute path of the certificate file if command is `import`. Directory path with write permissions if command is `generate_csr` or `export`.
certificate_type string	Type of the iDRAC certificate. `HTTPS` The Dell self-signed SSL certificate. `CA` Certificate Authority(CA) signed SSL certificate. `CUSTOMCERTIFICATE` The custom PKCS12 certificate and private key. Export of custom certificate is supported only on iDRAC firmware version 7.00.00.00 and above. `CSC` The custom signing SSL certificate. `CLIENT_TRUST_CERTIFICATE` Client trust certificate. `SCEP_CA_CERT` The CA certificate for ACME and SCEP enrollment. Supported on iDRAC9 >= 7.00.00.00 and iDRAC10 >= 1.20.50.50 with an active Datacenter license. Choices: `"HTTPS"` ← (default) `"CA"` `"CUSTOMCERTIFICATE"` `"CSC"` `"CLIENT_TRUST_CERTIFICATE"` `"SCEP_CA_CERT"`
command string	`generate_csr`, generate CSR. This requires cert_params and certificate_path. This is applicable only for `HTTPS` `import`, import the certificate file. This requires certificate_path. `export`, export the certificate. This requires certificate_path. `reset`, reset the certificate to default settings. This is applicable only for `HTTPS`. `view`, view certificate metadata via the iDRAC Attributes API. This is applicable for `SCEP_CA_CERT`. `delete`, delete the certificate. This is not supported for `SCEP_CA_CERT`. Choices: `"import"` `"export"` `"generate_csr"` ← (default) `"reset"` `"view"` `"delete"`
enforce_validate_certs boolean	If `true` and `validate_certs` is `false`, the module will fail with an error instead of just emitting a warning. Choices: `false` ← (default) `true`
idrac_ip string / required	iDRAC IP Address.
idrac_password aliases: idrac_pwd string	iDRAC user password. If the password is not provided, then the environment variable `IDRAC_PASSWORD` is used. Example: export IDRAC_PASSWORD=password
idrac_port integer	iDRAC port. Default: `443`
idrac_user string	iDRAC username. If the username is not provided, then the environment variable `IDRAC_USERNAME` is used. Example: export IDRAC_USERNAME=username
passphrase string	The passphrase string if the certificate to be imported is passphrase protected.
reset boolean	To reset the iDRAC after the certificate operation. This is applicable when command is `import` or `reset`. Choices: `false` `true` ← (default)
resource_id string	Redfish ID of the resource.
ssl_key path added in dellemc.openmanage 8.6.0	Absolute path of the private or SSL key file. This is applicable only when command is `import` and certificate_type is `HTTPS`. Uploading the SSL key to iDRAC is supported on firmware version 6.00.02.00 and above.
timeout integer added in dellemc.openmanage 5.0.0	The socket level timeout in seconds. Default: `30`
validate_certs boolean added in dellemc.openmanage 5.0.0	If `false`, the SSL certificates will not be validated. Configure `false` only on personally controlled sites where self-signed certificates are used. Prior to collection version `5.0.0`, the validate_certs is `false` by default. Choices: `false` `true` ← (default)
wait integer	Maximum wait time for iDRAC to start after the reset, in seconds. This is applicable when command is `import` or `reset` and reset is `true`. Default: `600`
x_auth_token string added in dellemc.openmanage 9.3.0	Authentication token. If the x_auth_token is not provided, then the environment variable `IDRAC_X_AUTH_TOKEN` is used. Example: export IDRAC_X_AUTH_TOKEN=x_auth_token

Notes 

Note

The certificate operations are supported on iDRAC firmware version 6.10.80.00 and above.
SCEP_CA_CERT operations require iDRAC9 >= 7.00.00.00 or iDRAC10 >= 1.20.50.50 with an active Datacenter license.
command values delete and export are not supported for SCEP_CA_CERT. Use view to retrieve certificate metadata via the Attributes API. Certificate rotation is supported via re-import (import overwrites the existing certificate).
Run this module from a system that has direct access to Dell iDRAC.
This module supports check_mode.
This module supports IPv4 and IPv6 addresses.

Examples 

---
- name: Generate HTTPS certificate signing request
  dellemc.openmanage.idrac_certificates:
    idrac_ip: "192.168.0.1"
    idrac_user: "user_name"
    idrac_password: "user_password"
    ca_path: "/path/to/ca_cert.pem"
    command: "generate_csr"
    certificate_type: "HTTPS"
    certificate_path: "/home/omam/mycerts"
    cert_params:
      common_name: "sample.domain.com"
      organization_unit: "OrgUnit"
      locality_name: "Bangalore"
      state_name: "Karnataka"
      country_code: "IN"
      email_address: "admin@domain.com"
      organization_name: "OrgName"
      subject_alt_name:
        - 192.198.2.1

- name: Import a HTTPS certificate.
  dellemc.openmanage.idrac_certificates:
    idrac_ip: "192.168.0.1"
    idrac_user: "user_name"
    idrac_password: "user_password"
    ca_path: "/path/to/ca_cert.pem"
    command: "import"
    certificate_type: "HTTPS"
    certificate_path: "/path/to/cert.pem"

- name: Import an HTTPS certificate along with its private key.
  dellemc.openmanage.idrac_certificates:
    idrac_ip: "192.168.0.1"
    idrac_user: "user_name"
    idrac_password: "user_password"
    ca_path: "/path/to/ca_cert.pem"
    command: "import"
    certificate_type: "HTTPS"
    certificate_path: "/path/to/cert.pem"
    ssl_key: "/path/to/private_key.pem"

- name: Export a HTTPS certificate.
  dellemc.openmanage.idrac_certificates:
    idrac_ip: "192.168.0.1"
    idrac_user: "user_name"
    idrac_password: "user_password"
    ca_path: "/path/to/ca_cert.pem"
    command: "export"
    certificate_type: "HTTPS"
    certificate_path: "/home/omam/mycert_dir"

- name: Import a CSC certificate.
  dellemc.openmanage.idrac_certificates:
    idrac_ip: "192.168.0.1"
    idrac_user: "user_name"
    idrac_password: "user_password"
    ca_path: "/path/to/ca_cert.pem"
    command: "import"
    certificate_type: "CSC"
    certificate_path: "/path/to/cert.pem"

- name: Import a custom certificate with a passphrase.
  dellemc.openmanage.idrac_certificates:
    idrac_ip: "192.168.0.1"
    idrac_user: "user_name"
    idrac_password: "user_password"
    command: "import"
    certificate_type: "CUSTOMCERTIFICATE"
    certificate_path: "/path/to/idrac_cert.p12"
    passphrase: "cert_passphrase"
    reset: false

- name: Export a Client trust certificate.
  dellemc.openmanage.idrac_certificates:
    idrac_ip: "192.168.0.1"
    idrac_user: "user_name"
    idrac_password: "user_password"
    ca_path: "/path/to/ca_cert.pem"
    command: "export"
    certificate_type: "CLIENT_TRUST_CERTIFICATE"
    certificate_path: "/home/omam/mycert_dir"

- name: Import a SCEP_CA_CERT certificate for ACME/SCEP enrollment.
  dellemc.openmanage.idrac_certificates:
    idrac_ip: "192.168.0.1"
    idrac_user: "user_name"
    idrac_password: "user_password"
    ca_path: "/path/to/ca_cert.pem"
    command: "import"
    certificate_type: "SCEP_CA_CERT"
    certificate_path: "/path/to/scep_ca_cert.pem"
    reset: false

- name: View SCEP_CA_CERT certificate metadata via Attributes API.
  dellemc.openmanage.idrac_certificates:
    idrac_ip: "192.168.0.1"
    idrac_user: "user_name"
    idrac_password: "user_password"
    ca_path: "/path/to/ca_cert.pem"
    command: "view"
    certificate_type: "SCEP_CA_CERT"

- name: Import SCEP_CA_CERT certificate in check mode (predicts changes without applying).
  dellemc.openmanage.idrac_certificates:
    idrac_ip: "192.168.0.1"
    idrac_user: "user_name"
    idrac_password: "user_password"
    ca_path: "/path/to/ca_cert.pem"
    command: "import"
    certificate_type: "SCEP_CA_CERT"
    certificate_path: "/path/to/scep_ca_cert.pem"
    reset: false
  check_mode: true

- name: Rotate SCEP_CA_CERT certificate via re-import (overwrites existing certificate).
  dellemc.openmanage.idrac_certificates:
    idrac_ip: "192.168.0.1"
    idrac_user: "user_name"
    idrac_password: "user_password"
    ca_path: "/path/to/ca_cert.pem"
    command: "import"
    certificate_type: "SCEP_CA_CERT"
    certificate_path: "/path/to/new_scep_ca_cert.pem"
    reset: false

Return Values 

Common return values are documented here, the following are the fields unique to this module:

Key	Description
cert_valid_from string	The certificate validity start date. Returned: when command is `view` and certificate_type is `SCEP_CA_CERT` Sample: `"Jan 19 05:43:11 2024 GMT"`
cert_valid_to string	The certificate validity end date. Returned: when command is `view` and certificate_type is `SCEP_CA_CERT` Sample: `"Jan 19 05:43:11 2025 GMT"`
certificate_path string	The csr or exported certificate file path Returned: when command is `export` or `generate_csr` Sample: `"/home/ansible/myfiles/cert.pem"`
certificate_type string	The certificate type returned by the `view` command for `SCEP_CA_CERT`. Returned: when command is `view` and certificate_type is `SCEP_CA_CERT` Sample: `"SCEP_CA"`
error_info dictionary	Details of the HTTP Error. Returned: on HTTP error Sample: `{"error": {"@Message.ExtendedInfo": [{"Message": "Unable to process the request because an error occurred.", "MessageArgs": [], "MessageId": "GEN1234", "RelatedProperties": [], "Resolution": "Retry the operation. If the issue persists, contact your system administrator.", "Severity": "Critical"}], "code": "Base.1.0.GeneralError", "message": "A general error has occurred. See ExtendedInfo for more information."}}`
expiry_state string	The certificate expiry state. Returned: when command is `view` and certificate_type is `SCEP_CA_CERT` Sample: `"Valid"`
issuer_common_name string	The issuer common name of the certificate. Returned: when command is `view` and certificate_type is `SCEP_CA_CERT` Sample: `"Dell CA"`
msg string	Status of the certificate configuration operation. Returned: always Sample: `"Successfully performed the 'generate_csr' certificate operation."`
serial_number string	The serial number of the certificate in colon-separated hex format. Returned: when command is `view` and certificate_type is `SCEP_CA_CERT` Sample: `"AA:BB:CC:DD:EE:FF"`
subject_common_name string	The subject common name of the certificate. Returned: when command is `view` and certificate_type is `SCEP_CA_CERT` Sample: `"example.com"`

Authors

Jagadeesh N V(@jagadeeshnv)
Rajshekar P(@rajshekarp87)
Kristian Lamb V(@kristian_lamb)

dellemc.openmanage.idrac_certificates module – Configure certificates for iDRAC

Synopsis

Requirements

Parameters

Notes

Examples

Return Values