Vhe>ddlmZmZmZeZdZdZdZddl Z ddl Z ddl Z ddl m Z mZddlmZmZddlmZmZdd lmZmZdd lmZmZmZmZmZmZmZm Z m!Z!m"Z"m#Z#dd l$m%Z%m&Z&m'Z'm(Z(m)Z)m*Z*m+Z+dd l,m-Z-dd l.m/Z/ddl0m1Z1m2Z2m3Z3m4Z4m5Z5m6Z6ddl7m8Z8ddl9m:Z:ddl;mZ>dZ?dZ@ ddlAZAddlAmBZBddlCmDZDddlEmFZFddlGmHZHmIZImJZJmKZKe>eAjZMdZNGddeZQGdde1ZRdZSeTdk(reSyy#eO$re jZ@dZNYAwxYw) )absolute_importdivisionprint_functiona- module: x509_crl version_added: '1.0.0' short_description: Generate Certificate Revocation Lists (CRLs) description: - This module allows one to (re)generate or update Certificate Revocation Lists (CRLs). - Certificates on the revocation list can be either specified by serial number and (optionally) their issuer, or as a path to a certificate file in PEM format. requirements: - cryptography >= 1.2 author: - Felix Fontein (@felixfontein) extends_documentation_fragment: - ansible.builtin.files - community.crypto.attributes - community.crypto.attributes.files - community.crypto.name_encoding attributes: check_mode: support: full diff_mode: support: full safe_file_operations: support: full idempotent: support: partial details: - The module is not idempotent if O(force=true). - If relative timestamps and O(ignore_timestamps=false) (default), the module is not idempotent. options: state: description: - Whether the CRL file should exist or not, taking action if the state is different from what is stated. type: str default: present choices: [absent, present] crl_mode: description: - Defines how to process entries of existing CRLs. - If set to V(generate), makes sure that the CRL has the exact set of revoked certificates as specified in O(revoked_certificates). - If set to V(update), makes sure that the CRL contains the revoked certificates from O(revoked_certificates), but can also contain other revoked certificates. If the CRL file already exists, all entries from the existing CRL will also be included in the new CRL. When using V(update), you might be interested in setting O(ignore_timestamps) to V(true). - The default value is V(generate). - This parameter was called O(mode) before community.crypto 2.13.0. It has been renamed to avoid a collision with the common O(mode) parameter for setting the CRL file's access mode. type: str # default: generate choices: [generate, update] version_added: 2.13.0 mode: description: - This parameter has been renamed to O(crl_mode). The old name O(mode) is now deprecated and will be removed in community.crypto 3.0.0. Replace usage of this parameter with O(crl_mode). - Note that from community.crypto 3.0.0 on, O(mode) will be used for the CRL file's mode. type: str # default: generate choices: [generate, update] force: description: - Should the CRL be forced to be regenerated. type: bool default: false backup: description: - Create a backup file including a timestamp so you can get the original CRL back if you overwrote it with a new one by accident. type: bool default: false path: description: - Remote absolute path where the generated CRL file should be created or is already located. type: path required: true format: description: - Whether the CRL file should be in PEM or DER format. - If an existing CRL file does match everything but O(format), it will be converted to the correct format instead of regenerated. type: str choices: [pem, der] default: pem privatekey_path: description: - Path to the CA's private key to use when signing the CRL. - Either O(privatekey_path) or O(privatekey_content) must be specified if O(state) is V(present), but not both. type: path privatekey_content: description: - The content of the CA's private key to use when signing the CRL. - Either O(privatekey_path) or O(privatekey_content) must be specified if O(state) is V(present), but not both. type: str privatekey_passphrase: description: - The passphrase for the O(privatekey_path). - This is required if the private key is password protected. type: str issuer: description: - Key/value pairs that will be present in the issuer name field of the CRL. - If you need to specify more than one value with the same key, use a list as value. - If the order of the components is important, use O(issuer_ordered). - One of O(issuer) and O(issuer_ordered) is required if O(state) is V(present). - Mutually exclusive with O(issuer_ordered). type: dict issuer_ordered: description: - A list of dictionaries, where every dictionary must contain one key/value pair. This key/value pair will be present in the issuer name field of the CRL. - If you want to specify more than one value with the same key in a row, you can use a list as value. - One of O(issuer) and O(issuer_ordered) is required if O(state) is V(present). - Mutually exclusive with O(issuer). type: list elements: dict version_added: 2.0.0 last_update: description: - The point in time from which this CRL can be trusted. - Time can be specified either as relative time or as absolute timestamp. - Time will always be interpreted as UTC. - Valid format is C([+-]timespec | ASN.1 TIME) where timespec can be an integer + C([w | d | h | m | s]) (for example V(+32w1d2h)). - Note that if using relative time this module is NOT idempotent, except when O(ignore_timestamps) is set to V(true). type: str default: "+0s" next_update: description: - The absolute latest point in time by which this O(issuer) is expected to have issued another CRL. Many clients will treat a CRL as expired once O(next_update) occurs. - Time can be specified either as relative time or as absolute timestamp. - Time will always be interpreted as UTC. - Valid format is C([+-]timespec | ASN.1 TIME) where timespec can be an integer + C([w | d | h | m | s]) (for example V(+32w1d2h)). - Note that if using relative time this module is NOT idempotent, except when O(ignore_timestamps) is set to V(true). - Required if O(state) is V(present). type: str digest: description: - Digest algorithm to be used when signing the CRL. type: str default: sha256 serial_numbers: description: - This option determines which values will be accepted for O(revoked_certificates[].serial_number). - If set to V(integer) (default), serial numbers are assumed to be integers, for example V(66223). (This example value is equivalent to the hex octet string V(01:02:AF)). - If set to V(hex-octets), serial numbers are assumed to be colon-separated hex octet strings, for example V(01:02:AF). (This example value is equivalent to the integer V(66223)). type: str choices: - integer - hex-octets default: integer version_added: 2.18.0 revoked_certificates: description: - List of certificates to be revoked. - Required if O(state) is V(present). type: list elements: dict suboptions: path: description: - Path to a certificate in PEM format. - The serial number and issuer will be extracted from the certificate. - Mutually exclusive with O(revoked_certificates[].content) and O(revoked_certificates[].serial_number). One of these three options must be specified. type: path content: description: - Content of a certificate in PEM format. - The serial number and issuer will be extracted from the certificate. - Mutually exclusive with O(revoked_certificates[].path) and O(revoked_certificates[].serial_number). One of these three options must be specified. type: str serial_number: description: - Serial number of the certificate. - Mutually exclusive with O(revoked_certificates[].path) and O(revoked_certificates[].content). One of these three options must be specified. - This option accepts integers or hex octet strings, depending on the value of O(serial_numbers). - If O(serial_numbers=integer), integers such as V(66223) must be provided. - If O(serial_numbers=hex-octets), strings such as V(01:02:AF) must be provided. - You can use the filters P(community.crypto.parse_serial#filter) and P(community.crypto.to_serial#filter) to convert these two representations. type: raw revocation_date: description: - The point in time the certificate was revoked. - Time can be specified either as relative time or as absolute timestamp. - Time will always be interpreted as UTC. - Valid format is C([+-]timespec | ASN.1 TIME) where timespec can be an integer + C([w | d | h | m | s]) (for example V(+32w1d2h)). - Note that if using relative time this module is NOT idempotent, except when O(ignore_timestamps) is set to V(true). type: str default: "+0s" issuer: description: - The certificate's issuer. - 'Example: V(DNS:ca.example.org).' type: list elements: str issuer_critical: description: - Whether the certificate issuer extension should be critical. type: bool default: false reason: description: - The value for the revocation reason extension. type: str choices: - unspecified - key_compromise - ca_compromise - affiliation_changed - superseded - cessation_of_operation - certificate_hold - privilege_withdrawn - aa_compromise - remove_from_crl reason_critical: description: - Whether the revocation reason extension should be critical. type: bool default: false invalidity_date: description: - The point in time it was known/suspected that the private key was compromised or that the certificate otherwise became invalid. - Time can be specified either as relative time or as absolute timestamp. - Time will always be interpreted as UTC. - Valid format is C([+-]timespec | ASN.1 TIME) where timespec can be an integer + C([w | d | h | m | s]) (for example V(+32w1d2h)). - Note that if using relative time this module is NOT idempotent. This will NOT change when O(ignore_timestamps) is set to V(true). type: str invalidity_date_critical: description: - Whether the invalidity date extension should be critical. type: bool default: false ignore_timestamps: description: - Whether the timestamps O(last_update), O(next_update) and O(revoked_certificates[].revocation_date) should be ignored for idempotency checks. The timestamp O(revoked_certificates[].invalidity_date) will never be ignored. - Use this in combination with relative timestamps for these values to get idempotency. type: bool default: false return_content: description: - If set to V(true), will return the (current or generated) CRL's content as RV(crl). type: bool default: false notes: - All ASN.1 TIME values should be specified following the YYYYMMDDHHMMSSZ pattern. - Date specified should be UTC. Minutes and seconds are mandatory. seealso: - plugin: community.crypto.parse_serial plugin_type: filter - plugin: community.crypto.to_serial plugin_type: filter a: --- - name: Generate a CRL community.crypto.x509_crl: path: /etc/ssl/my-ca.crl privatekey_path: /etc/ssl/private/my-ca.pem issuer: CN: My CA last_update: "+0s" next_update: "+7d" revoked_certificates: - serial_number: 1234 revocation_date: 20190331202428Z issuer: CN: My CA - serial_number: 2345 revocation_date: 20191013152910Z reason: affiliation_changed invalidity_date: 20191001000000Z - path: /etc/ssl/crt/revoked-cert.pem revocation_date: 20191010010203Z a^ filename: description: Path to the generated CRL. returned: changed or success type: str sample: /path/to/my-ca.crl backup_file: description: Name of backup file created. returned: changed and if O(backup) is V(true) type: str sample: /path/to/my-ca.crl.2019-03-09@11:22~ privatekey: description: Path to the private CA key. returned: changed or success type: str sample: /path/to/my-ca.pem format: description: - Whether the CRL is in PEM format (V(pem)) or in DER format (V(der)). returned: success type: str sample: pem choices: - pem - der issuer: description: - The CRL's issuer. - Note that for repeated values, only the last one will be returned. - See O(name_encoding) for how IDNs are handled. returned: success type: dict sample: {"organizationName": "Ansible", "commonName": "ca.example.com"} issuer_ordered: description: The CRL's issuer as an ordered list of tuples. returned: success type: list elements: list sample: [["organizationName", "Ansible"], ["commonName": "ca.example.com"]] last_update: description: The point in time from which this CRL can be trusted as ASN.1 TIME. returned: success type: str sample: 20190413202428Z next_update: description: The point in time from which a new CRL will be issued and the client has to check for it as ASN.1 TIME. returned: success type: str sample: 20190413202428Z digest: description: The signature algorithm used to sign the CRL. returned: success type: str sample: sha256WithRSAEncryption revoked_certificates: description: List of certificates to be revoked. returned: success type: list elements: dict contains: serial_number: description: - Serial number of the certificate. - This return value is an B(integer). If you need the serial numbers as a colon-separated hex string, such as C(11:22:33), you need to convert it to that form with P(community.crypto.to_serial#filter). type: int sample: 1234 revocation_date: description: The point in time the certificate was revoked as ASN.1 TIME. type: str sample: 20190413202428Z issuer: description: - The certificate's issuer. - See O(name_encoding) for how IDNs are handled. type: list elements: str sample: ["DNS:ca.example.org"] issuer_critical: description: Whether the certificate issuer extension is critical. type: bool sample: false reason: description: - The value for the revocation reason extension. type: str sample: key_compromise choices: - unspecified - key_compromise - ca_compromise - affiliation_changed - superseded - cessation_of_operation - certificate_hold - privilege_withdrawn - aa_compromise - remove_from_crl reason_critical: description: Whether the revocation reason extension is critical. type: bool sample: false invalidity_date: description: |- The point in time it was known/suspected that the private key was compromised or that the certificate otherwise became invalid as ASN.1 TIME. type: str sample: 20190413202428Z invalidity_date_critical: description: Whether the invalidity date extension is critical. type: bool sample: false crl: description: - The (current or generated) CRL's content. - Will be the CRL itself if O(format) is V(pem), and Base64 of the CRL if O(format) is V(der). returned: if O(state) is V(present) and O(return_content) is V(true) type: str N) AnsibleModulemissing_required_lib) to_nativeto_text)check_type_intcheck_type_str)OpenSSLBadPassphraseErrorOpenSSLObjectError) %CRYPTOGRAPHY_TIMEZONE_INVALIDITY_DATEREVOCATION_REASON_MAPTIMESTAMP_FORMAT'cryptography_decode_revoked_certificatecryptography_dump_revoked1cryptography_get_signature_algorithm_oid_from_crlget_last_updateget_next_updateset_last_updateset_next_updateset_revocation_date)CRYPTOGRAPHY_TIMEZONEcryptography_decode_namecryptography_get_name)cryptography_key_needs_digest_for_signingcryptography_name_to_oidcryptography_oid_to_name"cryptography_serial_number_of_cert) get_crl_info)identify_pem_format) OpenSSLObjectload_certificateload_privatekeyparse_name_fieldparse_ordered_name_fieldselect_message_digest) write_file) parse_serial)get_relative_time_option) LooseVersionz1.2)x509)default_backend)Encoding) CertificateRevocationListBuilderName NameAttributeRevokedCertificateBuilderTFc eZdZy)CRLErrorN)__name__ __module__ __qualname__m/home/dcms/DCMS/lib/python3.12/site-packages/ansible_collections/community/crypto/plugins/modules/x509_crl.pyr4r4 sr9r4cZeZdZfdZdZdZfdZdZd fd ZdZ dZ d d Z xZ S) CRLc  tt| |jd|jd|jd|j|jd|_|jddk(|_|jd|_|jd|_|jd |_ |jd |_ d|_ |jd |_ |jd |_ |j |jjd |_ |jd|_ |jdr&d|_t#|jdd|_n%d|_t'|jdd|_t1|jddt2|_t1|jddt2|_t9|jd|_|j:'t=dj |jd||_g|_ tC|jdD]+\}}ddddddddd}dj |}|d|d@ |d|djd |d<tE|d|dd}tG||d<n|jK|d||d<|dr(|dD cgc]} tM| dc} |d<|d"|d"<t1|d#|d#zt2|d#<|d$rtN|d$|d$<|d%|d%<|d&r#t1|d&|d&ztP|d&<|d'|d'<|j@jS|.|jd(|_*d|_+ tY|j|j|jd)|_-d|_/ ta|jbd*5} | je} dddtg rd+nd,|_4|jhd+k(r7tkjl| to|_/|jrQ| |_ nItkjp| to|_/|jrtsjt| |_ |jy| x|_=|_>y#t(t*f$r&}|j-t/|Yd}~cd}~wwxYw#tH$rk}|d,|j-d j |t/|n/|j-d!j ||dt/|Yd}~d}~wwxYwcc} w#t\$r}t=|d}~wwxYw#1swYxYw#tv$rd|_ |j |_4d} Y!wxYw)-Npathstateforceformatcrl_modeupdateignore_timestampsreturn_content name_encodingserial_numbersprivatekey_pathprivatekey_contentzutf-8privatekey_passphraseissuer_orderedTFissuermsg last_update) with_timezone next_updatedigestz!The digest "{0}" is not supportedrevoked_certificates) serial_numberrevocation_daterLissuer_criticalreasonreason_criticalinvalidity_dateinvalidity_date_criticalzrevoked_certificates[{0}].content cryptography)r[backendrTz-Cannot parse certificate from {0}content: {1}z/Cannot read certificate "{1}" from {0}path: {2}rVrUrWrXrYrZbackup)r>r[ passphraser]rbpemder)?superr<__init__params check_moderArCrDrErFserial_numbers_format crl_contentrHrIencoderJrKr&rLr% TypeError ValueError fail_jsonrr*rrOrQr'rRr4modulerS enumerater#rr _parse_serial_numberrrrappendr^ backup_filer$ privatekeyr crlopenr>readr! actual_formatr,load_pem_x509_crlr-load_der_x509_crlbase64 b64encode Exception _get_info diff_after diff_before) selfrmexcircresult path_prefixcerterLfdata __class__s r:rdz CRL.__init__s c4! MM& ! MM' " MM' "     mmH- mmJ/8; !'/B!C$mm,<=#]]?;%+]]3C%D"%}}->?"(--0D"E  " " .&*&=&=&D&DW&MD #%+]]3J%K" 1}}-.&*#6MM"235E ',#.v}}X/FQ 4 MM- ( /  4 MM- ( /  ,FMM(,CD ;; 3::6==;RS  $&!v}}-CDE< 5EAr!%#'#(#(#',1 F7==a@K&z%I)B)}0(*9 (<(D/QQU.VF?+ +/*C*C'+'(|JLX,$@F)&(;$x -//@,A()(@$%//3)F$ % (|#8H#Fx ,./@,A()#$,D()"33"G-() 688R5S12  % % , ,V 4y< 5|mmH-  -))//55& DO dii& !vvx *=d*CD !!U*11$8IJ&&'+D$11$8IJ&&'-'7'7'=D$ .2^^D-AA$*i:& 1   3  0 0 1X* )}0(( O V V +Yq\!) (( Q X X +RZ1!) ($>) 3-     #D !%D D s{4AS:>S9U02U5V'V8B+VS6S11S69 U-A U((U-5 V> V  VVV#WWc |jdk(r t|S|jdk(r tt|Std|jd #t$rC}|jj dj |dzt |Yd}~d}~wwxYw#ttf$rC}|jj dj |dzt |Yd}~d}~wwxYw) NintegerzRError while parsing revoked_certificates[{idx}].serial_number as an integer: {exc})idxrrM hex-octetszkError while parsing revoked_certificates[{idx}].serial_number as an colon-separated hex octet string: {exc}zUnexpected value z of serial_numbers) rgr rjrmrlrArr)r rk RuntimeError)rvalueindexrs r:rozCRL._parse_serial_numbers   % % 2 %e,,  % % 5 #N5$9::7;7Q7Q S  #  %%lss!AI%cNt& z*  %%FMM!AI%cNM& s. AB( B%"9B  B%(C:79C55C:c| tS t|j|}d|d<|S#t$rtdcYSwxYw)NT can_parse_crlF)r)dictr rmr{)rrrs r:r|z CRL._get_infosL <6M -!$++t4F&*F? #M -e, , -s+AAc|jr*|jj|j|_t t ||jy)N)r^rm backup_localr>rqrcr<remove)rrs r:rz CRL.removes8 ;;#{{77 BD  c4 ,r9c d}|dtd|dD}|jr|d||d|d|d|d|dfS|d|d ||d|d|d|d|dfS) NrLc36K|]}t|dyw)idna idn_rewriteN)r).0rLs r: z&CRL._compress_entry..s")VDDsrTrVrWrXrYrZrU)tuplerD)rentryrLs r:_compress_entryzCRL._compress_entrys ? &#HoF  ! !o&'(h'('(01 o&'('(h'('(01  r9ctt| |j|}|sy|jy|j t |jk7r |jsy|jt|jk7r |jsyt|jrN|jj7|jj|jjjk7ry|jjy|jDcgc]}t!|d|df}}|jjDcgc]}|j"|j$f}}|j&st)|}t)|}||k7ry|jD cgc]} |j+t-| } } |j.D cgc]} |j+| } } |j0r| D]} | j3|n| | k7ry|j6|j8k7r|syycc}wcc}wcc} wcc} w#t4$rYywxYw)z,Ensure the resource is in its desired state.FrrT)rcr<checkrmrsrOrrDrQrrrrsignature_hash_algorithmrRnamerLroidrrKsetrrrSrCrrkrArv) rrmperms_requiredignore_conversionstate_and_permsr want_issuersub is_issuerr old_entries new_entriesrs r:rz CRL.checks# T0nM 88    txx8 8AWAW   txx8 8AWAW 4T__ E119;;##txx'H'H'M'MMxx00<IM  ?D %eAh /q :  6:XX__Eccggsyy)E E""k*KII ) #   !H!N O  ?C>W>WXdt++D1X X ;;$ !!&&u- ! k) ;;$,, ,5F; F Y "! !s*H5 H:!!H?I>I  IIct}t} |jt|jDcgc]&}t t |dt|d(c}}t||j}t||j}|jr|jrst!|j"Dcgc]}|j%|c}}|jD]2}|j%t'|}||vs"|j)|}4|j"D]}t+}|j-|d}t/||d}|d+|j1t3j4|d|d}|d+|j1t3j6|d|d}|d +|j1t3j8|d |d }|j)|j;|}d}t=|j>r |j@}|jC|j>|| |_|jDd k(r)|jjGtHjJS|jjGtHjLScc}w#t$r}t|d}~wwxYwcc}w) NrrrTrUrLrVrWrXrYrZ)r]ra)'r-r/ issuer_namer0rLr1rr rkr4rrOrrQrCrsrrSrradd_revoked_certificater2rTr add_extensionr,CertificateIssuer CRLReasonInvalidityDatebuildrrrrRsignrA public_bytesr.PEMDER) rr]rsrrr decoded_entry revoked_certrRs r: _generate_crlzCRL._generate_crl*s!#.0 // &*[[ "&4U1X>a@Q Cc4#3#34c4#3#34 ;;488:>:S:ST%%e,TK = $ 4 4;EB! ! 355e)rrmr@rrsrArr.rrr|r}rErhryrzr^rr>rqr(changedload_file_common_argumentsrecheck_file_absent_if_check_modeset_fs_attributes_if_different)rr file_argss r:generatez CRL.generateesg 4;;uPT Uzz'')F 4;;uPU V{{e#..x||<..x||<  "nnV4DO"";;%''-D$'-'7'7'?D${{#';;#;#;DII#F t{{F +DLKK::4;;;M;MN ;; 6 6y7H IDL [[ 7 7 5 IDLJr9c 8|j|j|j|jdddddgd }|jr|j|d<|r|j j t|d<|jj t|d<|jjd|d<|j|d<i|d<|jD] \}}||d|<g|d<|jD]+}|djt||j -n7|j r*t#|j j t|d<t%|j j t|d<t't)|j |d<g}|j jD]2}|jt'|j*|j,g4||d<i|d<|D] \}}||d|<g|d<|j D]6}t/|}|djt||j 8|j0r|j2|d <t5|j6|j8 |d <|S) N) rfilenamerrrArOrQrRrKrLrSrqrOrQrRrKrLrSrrs)beforeafterdiff)rr>rHrArqrOstrftimerrQrmrerLrSrprrFrsrrrrrrrrErhrr~r}) rrfrkvrrL attributers r:dumpzCRL.dumps|| ..kk"$&     $($4$4F= ! $($4$4$=$=>N$OF= !$($4$4$=$=>N$OF= !#{{11(;F8 '+{{F# $!F8   (1&'x # (-/F) *22 -.55-eASAST XX$3DHH$=$F$FGW$XF= !$3DHH$=$F$FGW$XF= !7A$((K F8 F!XX__   -immidtddddgdtdddg d tdddgd d dtdddtdddtdddtddddgdtddtdddtdddtdd td!d"d#tdd$d%tdd&tdd'd(tddd)tddd*td!dttdtdtd+tdd$td!d"tddtdgd, tddtdtdd- gd.ggd.g/d0tdd1gd2d3tdd4d4d5gddddgdfdddd gdfddd%d*gdfgddgdd gfdd6}|jd r<|jdr|jd7|jd |jd<|jj d dt s3|jt d8jtt9 t|}|jddk(r}|jr`|jd:}|jdxs(|j| xs|j|d; |d<<|jd>i||jno|jrS|jd:}t j"j%|jd|d<<|jd>i||j'|j}|jd>i|y#t($r%}|jt+|=Yd}~yd}~wwxYw)?Nr?strpresentabsent)typedefaultchoicesrBrrC)rrmodez3.0.0zcommunity.crypto)rrremoved_in_versionremoved_from_collectionr@boolF)rrr^r>T)rrequiredrArarbrH)rrI)rno_logrJrLrrKlist)relementsrOz+0srQrRsha256rDrErSraw) unspecifiedkey_compromise ca_compromiseaffiliation_changed supersededcessation_of_operationcertificate_holdprivilege_withdrawn aa_compromiseremove_from_crl) r>r[rTrUrLrVrWrXrYrZ)r>r[rT)rroptionsrequired_one_ofmutually_exclusiverFignore)rrunicoderGrr) argument_spec required_ifrsupports_check_modeadd_file_common_argsz:You cannot use both `mode` and `crl_mode`. Use `crl_mode`.zcryptography >= {0})rN exception)rf)rrrMr8)rrrerlpopCRYPTOGRAPHY_FOUNDrrAMINIMAL_CRYPTOGRAPHY_VERSIONCRYPTOGRAPHY_IMP_ERRr<rfrr exit_jsonrosr>existsrr r)rmrsrrs r:mainrsO B E9y(>STB #X.B #X.#*(: B FE2B VU3B 6D1!B "UEE5>J#B $!f-%B & $t<'B (#'E$"?)B *V$+B , Vf=-B .%7/B 0%(1B 2UH53B 4#>5B 6 VU;7B 8"&6* e,"&E"2$(eU$CVe<$(fe$D" !%)fe$D$(e$4-1vu-M14"F F$H#I="9B xH6SyB ~ I <7PB Hi"35I!JD Q i(,ansible_collections.community.crypto.plugins.module_utils.timer*Aansible_collections.community.crypto.plugins.module_utils.versionr+rrr\r,cryptography.hazmat.backendsr-,cryptography.hazmat.primitives.serializationr.cryptography.x509r/r0r1r2 __version__CRYPTOGRAPHY_VERSIONr ImportError format_excr4r<rr5r8r9r:rs7A@ X t .v r JJQ    T %!<E( (@(@A  ! t-tn }-@ zFE/9//1s$4DDD