# java_cert – Uses keytool to import/remove key from java keystore (cacerts)

- Synopsis
- Parameters
- Examples
- Return Values
- Status

## Synopsis

- This is a wrapper module around keytool, which can be used to import/remove certificates from a given java keystore.

## Parameters

Parameter | Choices/Defaults | Comments
--- | --- | ---
cert_alias string |  | Imported certificate alias. The alias is used when checking for the presence of a certificate in the keystore.
cert_path path |  | Local path to load certificate from. One of `cert_url` or `cert_path` is required to load certificate.
cert_port integer | Default: 443 | Port to connect to URL. This will be used to create server URL:PORT.
cert_url string |  | Basic URL to fetch SSL certificate from. One of `cert_url` or `cert_path` is required to load certificate.
executable string | Default: "keytool" | Path to keytool binary if not used we search in PATH for it.

keystore_create
boolean

Choices:
- no
- yes

Create keystore if it does not exist.

keystore_pass string / required |  | Keystore password.
keystore_path path |  | Path to keystore.
keystore_type string added in 2.8 |  | Keystore type (JCEKS, JKS).
pkcs12_alias string added in 2.4 |  | Alias in the PKCS12 keystore.
pkcs12_password string added in 2.4 | Default: "" | Password for importing from PKCS12 keystore.
pkcs12_path path added in 2.4 |  | Local path to load PKCS12 keystore from.

state
string

Choices:
- absent
- present ←

Defines action which can be either certificate import or removal.

## Examples

    - name: Import SSL certificate from google.com to a given cacerts keystore
      java_cert:
        cert_url: google.com
        cert_port: 443
        keystore_path: /usr/lib/jvm/jre7/lib/security/cacerts
        keystore_pass: changeit
        state: present

    - name: Remove certificate with given alias from a keystore
      java_cert:
        cert_url: google.com
        keystore_path: /usr/lib/jvm/jre7/lib/security/cacerts
        keystore_pass: changeit
        executable: /usr/lib/jvm/jre7/bin/keytool
        state: absent

    - name: Import SSL certificate from google.com to a keystore, create it if it doesn't exist
      java_cert:
        cert_url: google.com
        keystore_path: /tmp/cacerts
        keystore_pass: changeit
        keystore_create: yes
        state: present

    - name: Import a pkcs12 keystore with a specified alias, create it if it doesn't exist
      java_cert:
        pkcs12_path: "/tmp/importkeystore.p12"
        cert_alias: default
        keystore_path: /opt/wildfly/standalone/configuration/defaultkeystore.jks
        keystore_pass: changeit
        keystore_create: yes
        state: present

    - name: Import SSL certificate to JCEKS keystore
      java_cert:
        pkcs12_path: "/tmp/importkeystore.p12"
        pkcs12_alias: default
        pkcs12_password: somepass
        cert_alias: default
        keystore_path: /opt/someapp/security/keystore.jceks
        keystore_type: "JCEKS"
        keystore_pass: changeit
        keystore_create: yes
        state: present

## Return Values

Common return values are documented here, the following are the fields unique to this module:

Key | Returned | Description
--- | --- | ---
cmd string | success | Executed command to get action done. Sample: keytool -importcert -noprompt -keystore
msg string | success | Output from stdout of keytool command after execution of given command. Sample: Module require existing keystore at keystore_path '/tmp/test/cacerts'
rc integer | success | Keytool command execution return value. Sample: 0

## Status

- This module is not guaranteed to have a backwards compatible interface. [preview]
- This module is maintained by the Ansible Community. [community]

### Authors

- Adam Hamsik (@haad)

Hint

If you notice any issues in this documentation, you can edit this document to improve it.