Backport of ansible-collections/community.crypto#180 to stable-2.9.

felixfontein · Mar 8, 2021 · b79d056 · b79d056
1 parent fc4c154
commit b79d056
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 3 deletions.
diff --git a/changelogs/fragments/community.cryto-180-openssl-csr-basic-constraint.yml b/changelogs/fragments/community.cryto-180-openssl-csr-basic-constraint.yml
@@ -0,0 +1,3 @@
+---
+bugfixes:
+  - "openssl_csr - no longer fails when comparing CSR without basic constraint when ``basic_constraints`` is specified (https://github.com/ansible-collections/community.crypto/issues/179, https://github.com/ansible-collections/community.crypto/pull/180)."
diff --git a/lib/ansible/modules/crypto/openssl_csr.py b/lib/ansible/modules/crypto/openssl_csr.py
@@ -911,9 +911,9 @@ def _check_basicConstraints(extensions):
                 return False
             # Check criticality
             if self.basicConstraints:
-                if bc_ext.critical != self.basicConstraints_critical:
-                    return False
-            return True
+                return bc_ext is not None and bc_ext.critical == self.basicConstraints_critical
+            else:
+                return bc_ext is None
 
         def _check_ocspMustStaple(extensions):
             try: