Support Custom Cipher Selection

plugins/modules/get_certificate.py

@@ -81,6 +81,15 @@
       type: str
       default: auto
       choices: [ auto, cryptography ]
+    ciphers:
+      description:
+        - SSL/TLS Ciphers to use for the request.
+        - 'When a list is provided, all ciphers are joined in order with C(:)'
+        - See the L(OpenSSL Cipher List Format,https://www.openssl.org/docs/manmaster/man1/openssl-ciphers.html#CIPHER-LIST-FORMAT)
+          for more details.
+        - The available ciphers is dependent on the Python and OpenSSL/LibreSSL versions
+      type: list
+      elements: str
 
 notes:
     - When using ca_cert on OS X it has been reported that in some conditions the validate will always succeed.
@@ -247,6 +256,7 @@ def main():
             timeout=dict(type='int', default=10),
             select_crypto_backend=dict(type='str', choices=['auto', 'cryptography'], default='auto'),
             starttls=dict(type='str', choices=['mysql']),
+            ciphers=dict(type='list', elements='str'),
         ),
     )
 
@@ -258,6 +268,7 @@ def main():
     timeout = module.params.get('timeout')
     server_name = module.params.get('server_name')
     start_tls_server_type = module.params.get('starttls')
+    ciphers = module.params.get('ciphers')
 
     backend = module.params.get('select_crypto_backend')
     if backend == 'auto':
@@ -325,6 +336,10 @@ def main():
             if start_tls_server_type is not None:
                 send_starttls_packet(sock, start_tls_server_type)
 
+            if ciphers is not None:
+                ciphers_joined = ":".join(ciphers)
+                ctx.set_ciphers(ciphers_joined)
+
             cert = ctx.wrap_socket(sock, server_hostname=server_name or host).getpeercert(True)
             cert = DER_cert_to_PEM_cert(cert)
         except Exception as e: