From 38ab2f55bb2a366850638e13701e5753a509efb3 Mon Sep 17 00:00:00 2001 From: Markus Pesch Date: Mon, 7 Sep 2026 14:38:31 +0200 Subject: [PATCH] fix: drop passphrase from CSR task for unencrypted client key This task file is only included when `certificate_authority_client_tls_key_passphrase` is empty, so the private key is created without encryption. Passing the empty passphrase to `openssl_csr` made the module attempt to decrypt an unencrypted key instead of treating it as absent. The sibling CSR task for certificates with SANs already omitted the attribute, so this also aligns both code paths. Co-authored-by: Copilot --- tasks/client_certificate_unprotected.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/tasks/client_certificate_unprotected.yaml b/tasks/client_certificate_unprotected.yaml index 8b913ee..4fbaa65 100644 --- a/tasks/client_certificate_unprotected.yaml +++ b/tasks/client_certificate_unprotected.yaml @@ -16,7 +16,6 @@ organization_name: "{{ certificate_authority_client_organization_name }}" organizational_unit_name: "{{ certificate_authority_client_organizational_unit_name }}" path: "{{ certificate_authority_client_path }}/cert-req.pem" - privatekey_passphrase: "{{ certificate_authority_client_tls_key_passphrase }}" privatekey_path: "{{ certificate_authority_client_path }}/privkey.pem" state_or_province_name: "{{ certificate_authority_client_state_or_province_name }}" when: |