##### SUMMARY
During some discussions over the last half year or so, we've discussed deprecating the `assertonly` provider and replacing it with `_info` modules + assert statements, or possibly more `_info` / other modules.

I want to use this issue to track what can already be replaced with `openssl_certificate_info` + `assert`, and what still needs features (or new modules).

I hope I listed everything that `assertonly` can check; please verify this :)

##### ISSUE TYPE
- Feature Idea

##### COMPONENT NAME
openssl_certificate
openssl_certificate_info

##### ASSERTONLY FEATURES
The task snippets assume that `result` is the result of registering the `openssl_certificate_info` output, if not said otherwise.

- [x] `signature_algorithms`

  ```.yaml
  - assert:
      that:
        - "result.signature_algorithm == 'sha256WithRSAEncryption' or result.signature_algorithm == 'sha512WithRSAEncryption'"
  ```

- [x] `subject` and  `subject_strict`

  ```.yaml
  - assert:
      that:
        - "result.subject.commonName == 'ansible.com'"
        - "result.subject | len == 1"  # for subject_strict
  ```

- [x] `issuer` and `issuer_strict`

  ```.yaml
  - assert:
      that:
        - "result.issuer.commonName == 'ansible.com'"
        - "result.issuer | len == 1"  # for issuer_strict
  ```

- [x] `has_expired`

  ```.yaml
  - assert:
      that:
        - result.expired
  ```

- [x] `version`

  ```.yaml
  - assert:
      that:
        - result.version == 3
  ```

- [x] `key_usage` and `key_usage_strict`

  ```.yaml
  - assert:
      that:
        - "'Data Encipherment' in result.key_usage"
        - "result.key_usage | len == 1"  # for key_usage_strict
  ```

- [x] `extended_key_usage` and `extended_key_usage_strict`

  ```.yaml
  - assert:
      that:
        - "'DVCS' in result.extended_key_usage"
        - "result.extended_key_usage | len == 1"  # for extended_key_usage_strict
  ```

- [x] `subject_alt_name` and `subject_alt_name_strict`

  ```.yaml
  - assert:
      that:
        - "'dns:ansible.com' in result.subject_alt_name"
        - "result.subject_alt_name | len == 1"  # for subject_alt_name_strict
  ```

- [x] `not_before` and `not_after`

  ```.yaml
  - assert:
      that:
        - "result.not_before == '20190413202428Z'"
        - "result.not_after == '20190331202428Z'"
  ```

  What's not working yet: relative timestamps don't work out of the box, since Ansible has no date / time filters. This can partially be done with `valid_at`, though.

- [x] `valid_at`,  `invalid_at` and  `valid_in`

  ```.yaml
  - openssl_certificate_info:
      path: ...
      valid_at:
        one_day_ten_hours: "+1d+10h"
    register: result
  - assert:
      that:
        - "result.valid_at.one_day_ten_hours"  # for valid_at
        - "not result.valid_at.one_day_ten_hours"  # for invalid_at
  ```

- [x] `privatekey`: check whether public keys of private key and certificate are identical

  ```.yaml
  - openssl_privatekey_info:
      path: ...
    register: result_privatekey
  - assert:
      that:
        - result.public_key == result_privatekey.public_key
  ```

- [x] `csr`: check CSR signature (CSR signature must be valid, and CSR public key must equal certificate public key)

  ```.yaml
  - openssl_csr_info:
      path: ...
      # module will fail if CSR signature is invalid
    register: result_csr
  - assert:
      that:
        - result.public_key == result_csr.public_key
  ```

- [x] `csr`: check CSR subject

  ```.yaml
  - openssl_csr_info:
      path: ...
    register: result_csr
  - assert:
      that:
        - result.subject == result_csr.subject
  ```

- [x] `csr`: check CSR extensions

  ```.yaml
  - openssl_csr_info:
      path: ...
    register: result_csr
  - assert:
      that:
        - result.extensions_by_oid == result_csr.extensions_by_oid
  ```

if self.cert.get_signature_algorithm() not in self.signature_algorithms:
            return self.cert.get_signature_algorithm()
    def _validate_subject(self):
        expected_subject = [(OpenSSL._util.lib.OBJ_txt2nid(sub[0]), sub[1]) for sub in self.subject]
        cert_subject = self.cert.get_subject().get_components()
        current_subject = [(OpenSSL._util.lib.OBJ_txt2nid(sub[0]), sub[1]) for sub in cert_subject]
        if not compare_sets(expected_subject, current_subject, self.subject_strict):
            return expected_subject, current_subject
    def _validate_issuer(self):
        expected_issuer = [(OpenSSL._util.lib.OBJ_txt2nid(iss[0]), iss[1]) for iss in self.issuer]
        cert_issuer = self.cert.get_issuer().get_components()
        current_issuer = [(OpenSSL._util.lib.OBJ_txt2nid(iss[0]), iss[1]) for iss in cert_issuer]
        if not compare_sets(expected_issuer, current_issuer, self.issuer_strict):
            return self.issuer, cert_issuer
    def _validate_has_expired(self):
        
        
        
        time_string = to_native(self.cert.get_notAfter())
        not_after = datetime.datetime.strptime(time_string, "%Y%m%d%H%M%SZ")
        cert_expired = not_after < datetime.datetime.utcnow()
        return cert_expired
    def _validate_version(self):
        
        
        return self.cert.get_version() + 1
    def _validate_key_usage(self):