openssl_pkcs12: cannot re-create pkcs12 with no private key

[Zeroji]

Original issue from Ansible github: https:/ansible/ansible/issues/59945

SUMMARY

When generating a PKCS12 keystore without a private key, if the file exists, parsing it fails

ISSUE TYPE

• Bug Report

COMPONENT NAME

openssl_pkcs12 (likely caused by https:/ansible-collections/community.crypto/blob/main/plugins/modules/openssl_pkcs12.py#L363)

ANSIBLE VERSION

ansible 2.9.6
  config file = /home/redacted/dev/redacted/ansible.cfg
  configured module search path = ['/home/redacted/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /home/redacted/.local/lib/python3.6/site-packages/ansible
  executable location = /home/redacted/.local/bin/ansible
  python version = 3.6.9 (default, Nov  7 2019, 10:44:02) [GCC 8.3.0]

CONFIGURATION

ANSIBLE_NOCOWS(env: ANSIBLE_NOCOWS) = True
DEFAULT_CALLBACK_WHITELIST(/home/redacted/dev/redacted/ansible.cfg) = ['timer']
DEFAULT_FILTER_PLUGIN_PATH(/home/redacted/dev/redacted/ansible.cfg) = ['/home/redacted/dev/redacted/filter_plugins']
DEFAULT_LOG_PATH(/home/redacted/dev/redacted/ansible.cfg) = /var/log/ansible.log
DEFAULT_ROLES_PATH(/home/redacted/dev/redacted/ansible.cfg) = ['/home/redacted/dev/redacted/roles']
DEFAULT_STDOUT_CALLBACK(/home/redacted/dev/redacted/ansible.cfg) = yaml

OS / ENVIRONMENT

Ubuntu 18.04 inside WSL1 on Windows 10, but issue has been reproduced across various platforms (mainly CentOS 7.7)

STEPS TO REPRODUCE

EXPECTED RESULTS

• Create a PFX/P12 file with only certificates ("other_certificates")
• Try to parse the file or run the export again over the same file

openssl_pkcs12:
    path: "{{ truststore_path }}"
    name: truststore
    other_certificates: "{{ cacert_path }}"

ACTUAL RESULTS

PyOpenSSL fails to dump the private key (which is None when parsed from p12)

      File "/tmp/ansible_openssl_pkcs12_payload_tfn6ujgx/ansible_openssl_pkcs12_payload.zip/ansible/modules/crypto/openssl_pkcs12.py", line 449, in <module>
      File "/tmp/ansible_openssl_pkcs12_payload_tfn6ujgx/ansible_openssl_pkcs12_payload.zip/ansible/modules/crypto/openssl_pkcs12.py", line 412, in main
      File "/tmp/ansible_openssl_pkcs12_payload_tfn6ujgx/ansible_openssl_pkcs12_payload.zip/ansible/modules/crypto/openssl_pkcs12.py", line 246, in check
      File "/tmp/ansible_openssl_pkcs12_payload_tfn6ujgx/ansible_openssl_pkcs12_payload.zip/ansible/modules/crypto/openssl_pkcs12.py", line 341, in parse
      File "/usr/lib/python3/dist-packages/OpenSSL/crypto.py", line 1899, in dump_privatekey
        raise TypeError("pkey must be a PKey")
    TypeError: pkey must be a PKey