##### SUMMARY
During some discussions over the last half year or so, we've discussed deprecating the `assertonly` provider and replacing it with `_info` modules + assert statements, or possibly more `_info` / other modules.

I want to use this issue to track what can already be replaced with `openssl_certificate_info` + `assert`, and what still needs features (or new modules).

I hope I listed everything that `assertonly` can check; please verify this :)

##### ISSUE TYPE
- Feature Idea

##### COMPONENT NAME
openssl_certificate
openssl_certificate_info

##### ASSERTONLY FEATURES
The task snippets assume that `result` is the result of registering the `openssl_certificate_info` output, if not said otherwise.

- [x] `signature_algorithms`

  ```.yaml
  - assert:
      that:
        - "result.signature_algorithm == 'sha256WithRSAEncryption' or result.signature_algorithm == 'sha512WithRSAEncryption'"
  ```

- [x] `subject` and  `subject_strict`

  ```.yaml
  - assert:
      that:
        - "result.subject.commonName == 'ansible.com'"
        - "result.subject | len == 1"  # for subject_strict
  ```

- [x] `issuer` and `issuer_strict`

  ```.yaml
  - assert:
      that:
        - "result.issuer.commonName == 'ansible.com'"
        - "result.issuer | len == 1"  # for issuer_strict
  ```

- [x] `has_expired`

  ```.yaml
  - assert:
      that:
        - result.expired
  ```

- [x] `version`

  ```.yaml
  - assert:
      that:
        - result.version == 3
  ```

- [x] `key_usage` and `key_usage_strict`

  ```.yaml
  - assert:
      that:
        - "'Data Encipherment' in result.key_usage"
        - "result.key_usage | len == 1"  # for key_usage_strict
  ```

- [x] `extended_key_usage` and `extended_key_usage_strict`

  ```.yaml
  - assert:
      that:
        - "'DVCS' in result.extended_key_usage"
        - "result.extended_key_usage | len == 1"  # for extended_key_usage_strict
  ```

- [x] `subject_alt_name` and `subject_alt_name_strict`

  ```.yaml
  - assert:
      that:
        - "'dns:ansible.com' in result.subject_alt_name"
        - "result.subject_alt_name | len == 1"  # for subject_alt_name_strict
  ```

- [x] `not_before` and `not_after`

  ```.yaml
  - assert:
      that:
        - "result.not_before == '20190413202428Z'"
        - "result.not_after == '20190331202428Z'"
  ```

  What's not working yet: relative timestamps don't work out of the box, since Ansible has no date / time filters. This can partially be done with `valid_at`, though.

- [x] `valid_at`,  `invalid_at` and  `valid_in`

  ```.yaml
  - openssl_certificate_info:
      path: ...
      valid_at:
        one_day_ten_hours: "+1d+10h"
    register: result
  - assert:
      that:
        - "result.valid_at.one_day_ten_hours"  # for valid_at
        - "not result.valid_at.one_day_ten_hours"  # for invalid_at
  ```

- [x] `privatekey`: check whether public keys of private key and certificate are identical

  ```.yaml
  - openssl_privatekey_info:
      path: ...
    register: result_privatekey
  - assert:
      that:
        - result.public_key == result_privatekey.public_key
  ```

- [x] `csr`: check CSR signature (CSR signature must be valid, and CSR public key must equal certificate public key)

  ```.yaml
  - openssl_csr_info:
      path: ...
      # module will fail if CSR signature is invalid
    register: result_csr
  - assert:
      that:
        - result.public_key == result_csr.public_key
  ```

- [x] `csr`: check CSR subject

  ```.yaml
  - openssl_csr_info:
      path: ...
    register: result_csr
  - assert:
      that:
        - result.subject == result_csr.subject
  ```

- [x] `csr`: check CSR extensions

  ```.yaml
  - openssl_csr_info:
      path: ...
    register: result_csr
  - assert:
      that:
        - result.extensions_by_oid == result_csr.extensions_by_oid
  ```

- "Please note that the module regenerates existing certificate if it doesn't match the module's
      options, or if it seems to be corrupt. If you are concerned that this could overwrite
      your existing certificate, consider using the I(backup) option."
    - It uses the pyOpenSSL or cryptography python library to interact with OpenSSL.
    - If both the cryptography and PyOpenSSL libraries are available (and meet the minimum version requirements)
      cryptography will be preferred as a backend over PyOpenSSL (unless the backend is forced with C(select_crypto_backend))
requirements:
    - PyOpenSSL >= 0.15 or cryptography >= 1.6 (if using C(selfsigned) or C(assertonly) provider)
    - acme-tiny (if using the C(acme) provider)
author:
  - Yanis Guenane (@Spredzy)
  - Markus Teufelberger (@MarkusTeufelberger)
options:
    state:
        description:
            - Whether the certificate should exist or not, taking action if the state is different from what is stated.
        type: str
        default: present
        choices: [ absent, present ]
    path:
        description:
            - Remote absolute path where the generated certificate file should be created or is already located.
        type: path
        required: true
    provider:
        description:
            - Name of the provider to use to generate/retrieve the OpenSSL certificate.
            - The C(assertonly) provider will not generate files and fail if the certificate file is missing.
            - "The C(entrust) provider was added for Ansible 2.9 and requires credentials for the
               L(https://www.entrustdatacard.com/products/categories/ssl-certificates,Entrust Certificate Services) (ECS) API."