##### SUMMARY
Some of the providers for the openssl_certificate module attempt to load the contents of csr_path during their init() methods, 

##### ISSUE TYPE
- Bug Report

##### COMPONENT NAME
crypto/openssl_certificate

##### ANSIBLE VERSION
<!--- Paste verbatim output from "ansible --version" between quotes -->
```
config file = /opt/ansible-openssl-module/molecule_openssl_test/ansible.cfg
  configured module search path = ['/root/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /opt/python-environments/py36env/lib/python3.6/site-packages/ansible
  executable location = /opt/python-environments/py36env/bin/ansible
  python version = 3.6.7 (default, Dec  5 2018, 15:02:05) [GCC 4.8.5 20150623 (Red Hat 4.8.5-36)]

```

##### CONFIGURATION
<!--- Paste verbatim output from "ansible-config dump --only-changed" between quotes -->
```

```

##### OS / ENVIRONMENT
<!--- Provide all relevant information below, e.g. target OS versions, network device firmware, etc. -->
Not applicable, bug identified during code review.

##### STEPS TO REPRODUCE
<!--- Describe exactly how to reproduce the problem, using a minimal test-case -->

<!--- Paste example playbooks or commands between quotes below -->
```
- name: Generate self-signed certificate with cryptography, CSR is an invalid path
  openssl_certificate:
    path: /etc/ssl/crt/ansible.com.crt
    privatekey_path: /etc/ssl/private/ansible.com.pem
    csr_path: /etc/ssl/csr/ansible.com.INVALID.csr
    provider: selfsigned
- name: Generate self-signed certificate with pyopenssl, CSR is invalid path
    openssl_certificate:
    path: /etc/ssl/crt/ansible.com.crt
    privatekey_path: /etc/ssl/private/ansible.com.pem
    csr_path: /etc/ssl/csr/ansible.com.INVALID.csr
    provider: selfsigned
    select_crypto_backend: pyopenssl
- name: Generate OwnCA certificate with cryptography, CSR is invalid path
   openssl_certificate:
     path: /etc/ssl/crt/ansible.com.crt
     csr_path: /etc/ssl/csr/ansible.com.INVALID.csr
     ownca_path: /etc/ssl/crt/ansible_CA.crt
     ownca_privatekey_path: /etc/ssl/private/ansible_CA.pem
     provider: ownca
Name: Generate OwnCA certificate with pyopenssl, CSR is invalid path
   openssl_certificate:
     path: /etc/ssl/crt/ansible.com.crt
     csr_path: /etc/ssl/csr/ansible.com.INVALID.csr
     ownca_path: /etc/ssl/crt/ansible_CA.crt
     ownca_privatekey_path: /etc/ssl/private/ansible_CA.pem
     provider: ownca
     select_crypto_backend: pyopenssl
```
<!--- HINT: You can paste gist.github.com links for larger files -->

##### EXPECTED RESULTS
Should throw error:
raise CertificateError(
                'The certificate signing request file %s does not exist' % self.csr_path
            )

That error is currently in the generate method instead of init(), so it ends up attempting the certificate load via crypto_utils.load_certificate_request in init prior to the check for file path existence.

##### ACTUAL RESULTS
Will update ticket to populate once I have a chance to create test cases.

<!--- Paste verbatim command output between quotes -->
```

```

- The point in time at which the certificate stops being valid.
            - Time can be specified either as relative time or as absolute timestamp.
            - Time will always be interpreted as UTC.
            - Note that only the date (day, month, year) is supported for specifying expiry date of the issued certificate.
            - The full date-time is adjusted to EST (GMT -5:00) before issuance, which may result in a certificate with an expiration date one day
              earlier than expected if a relative time is used.
            - The minimum certificate lifetime is 90 days, and maximum is three years.
            - Valid format is C([+-]timespec | ASN.1 TIME) where timespec can be an integer
              + C([w | d | h | m | s]) (e.g. C(+32w1d2h).
            - If this value is not specified, the certificate will stop being valid 365 days from now.
            - This is only used by the C(entrust) provider.
        type: str
        default: +365d
        version_added: "2.9"
    entrust_api_specification_path:
        description:
            - Path to the specification file defining the Entrust Certificate Services (ECS) API.
            - Can be used to keep a local copy of the specification to avoid downloading it every time the module is used.
            - This is only used by the C(entrust) provider.
        type: path
        default: https://cloud.entrust.net/EntrustCloud/documentation/cms-api-2.1.0.yaml
        version_added: "2.9"
extends_documentation_fragment: files
notes:
    - All ASN.1 TIME values should be specified following the YYYYMMDDHHMMSSZ pattern.
    - Date specified should be UTC. Minutes and seconds are mandatory.
    - For security reason, when you use C(ownca) provider, you should NOT run M(openssl_certificate) on
      a target machine, but on a dedicated CA machine. It is recommended not to store the CA private key
      on the target machine. Once signed, the certificate can be moved to the target machine.
seealso: