Merging upstream version 9.5.1+dfsg.

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

41 files changed, 1559 insertions, 474 deletions

diff --git a/ansible_collections/community/crypto/.azure-pipelines/azure-pipelines.yml b/ansible_collections/community/crypto/.azure-pipelines/azure-pipelines.yml
index 8697acd43..19a36fb46 100644
--- a/ansible_collections/community/crypto/.azure-pipelines/azure-pipelines.yml
+++ b/ansible_collections/community/crypto/.azure-pipelines/azure-pipelines.yml
@@ -65,6 +65,17 @@ stages:
               test: 'devel/sanity/extra'
             - name: Units
               test: 'devel/units/1'
+  - stage: Ansible_2_17
+    displayName: Sanity & Units 2.17
+    dependsOn: []
+    jobs:
+      - template: templates/matrix.yml
+        parameters:
+          targets:
+            - name: Sanity
+              test: '2.17/sanity/1'
+            - name: Units
+              test: '2.17/units/1'
   - stage: Ansible_2_16
     displayName: Sanity & Units 2.16
     dependsOn: []
@@ -87,17 +98,6 @@ stages:
               test: '2.15/sanity/1'
             - name: Units
               test: '2.15/units/1'
-  - stage: Ansible_2_14
-    displayName: Sanity & Units 2.14
-    dependsOn: []
-    jobs:
-      - template: templates/matrix.yml
-        parameters:
-          targets:
-            - name: Sanity
-              test: '2.14/sanity/1'
-            - name: Units
-              test: '2.14/units/1'
 ### Docker
   - stage: Docker_devel
     displayName: Docker devel
@@ -111,8 +111,21 @@ stages:
               test: fedora39
             - name: Ubuntu 22.04
               test: ubuntu2204
-            - name: Alpine 3
-              test: alpine3
+            - name: Alpine 3.19
+              test: alpine319
+          groups:
+            - 1
+            - 2
+  - stage: Docker_2_17
+    displayName: Docker 2.17
+    dependsOn: []
+    jobs:
+      - template: templates/matrix.yml
+        parameters:
+          testFormat: 2.17/linux/{0}
+          targets:
+            - name: Alpine 3.19
+              test: alpine319
           groups:
             - 1
             - 2
@@ -128,6 +141,8 @@ stages:
               test: fedora38
             - name: openSUSE 15
               test: opensuse15
+            - name: Alpine 3
+              test: alpine3
           groups:
             - 1
             - 2
@@ -146,19 +161,6 @@ stages:
           groups:
             - 1
             - 2
-  - stage: Docker_2_14
-    displayName: Docker 2.14
-    dependsOn: []
-    jobs:
-      - template: templates/matrix.yml
-        parameters:
-          testFormat: 2.14/linux/{0}
-          targets:
-            - name: Ubuntu 20.04
-              test: ubuntu2004
-          groups:
-            - 1
-            - 2
 
 ### Community Docker
   - stage: Docker_community_devel
@@ -188,8 +190,8 @@ stages:
         parameters:
           testFormat: devel/{0}
           targets:
-            - name: Alpine 3.18
-              test: alpine/3.18
+            - name: Alpine 3.19
+              test: alpine/3.19
             - name: Fedora 39
               test: fedora/39
             - name: Ubuntu 22.04
@@ -204,12 +206,25 @@ stages:
         parameters:
           testFormat: devel/{0}
           targets:
-            - name: macOS 13.2
-              test: macos/13.2
+            - name: macOS 14.3
+              test: macos/14.3
             - name: RHEL 9.3
               test: rhel/9.3
-            - name: FreeBSD 13.2
-              test: freebsd/13.2
+            - name: FreeBSD 14.0
+              test: freebsd/14.0
+          groups:
+            - 1
+            - 2
+  - stage: Remote_2_17
+    displayName: Remote 2.17
+    dependsOn: []
+    jobs:
+      - template: templates/matrix.yml
+        parameters:
+          testFormat: 2.17/{0}
+          targets:
+            - name: FreeBSD 13.3
+              test: freebsd/13.3
           groups:
             - 1
             - 2
@@ -221,10 +236,14 @@ stages:
         parameters:
           testFormat: 2.16/{0}
           targets:
+            - name: macOS 13.2
+              test: macos/13.2
             - name: RHEL 9.2
               test: rhel/9.2
             - name: RHEL 8.8
               test: rhel/8.8
+            - name: FreeBSD 13.2
+              test: freebsd/13.2
           groups:
             - 1
             - 2
@@ -249,38 +268,34 @@ stages:
           groups:
             - 1
             - 2
-  - stage: Remote_2_14
-    displayName: Remote 2.14
+### Generic
+  - stage: Generic_devel
+    displayName: Generic devel
     dependsOn: []
     jobs:
       - template: templates/matrix.yml
         parameters:
-          testFormat: 2.14/{0}
+          nameFormat: Python {0}
+          testFormat: devel/generic/{0}
           targets:
-            #- name: macOS 12.0
-            #  test: macos/12.0
-            - name: RHEL 9.0
-              test: rhel/9.0
-            #- name: FreeBSD 12.4
-            #  test: freebsd/12.4
+            - test: 3.8
+            # - test: 3.9
+            # - test: "3.10"
+            - test: "3.11"
+            - test: "3.12"
           groups:
             - 1
             - 2
-### Generic
-  - stage: Generic_devel
-    displayName: Generic devel
+  - stage: Generic_2_17
+    displayName: Generic 2.17
     dependsOn: []
     jobs:
       - template: templates/matrix.yml
         parameters:
           nameFormat: Python {0}
-          testFormat: devel/generic/{0}
+          testFormat: 2.17/generic/{0}
           targets:
-            - test: 3.7
-            # - test: 3.8
-            # - test: 3.9
-            # - test: "3.10"
-            - test: "3.11"
+            - test: "3.7"
             - test: "3.12"
           groups:
             - 1
@@ -314,19 +329,6 @@ stages:
           groups:
             - 1
             - 2
-  - stage: Generic_2_14
-    displayName: Generic 2.14
-    dependsOn: []
-    jobs:
-      - template: templates/matrix.yml
-        parameters:
-          nameFormat: Python {0}
-          testFormat: 2.14/generic/{0}
-          targets:
-            - test: 3.9
-          groups:
-            - 1
-            - 2
 
   ## Finally
 
@@ -334,22 +336,22 @@ stages:
     condition: succeededOrFailed()
     dependsOn:
       - Ansible_devel
+      - Ansible_2_17
       - Ansible_2_16
       - Ansible_2_15
-      - Ansible_2_14
       - Remote_devel_extra_vms
       - Remote_devel
+      - Remote_2_17
       - Remote_2_16
       - Remote_2_15
-      - Remote_2_14
       - Docker_devel
+      - Docker_2_17
       - Docker_2_16
       - Docker_2_15
-      - Docker_2_14
       - Docker_community_devel
       - Generic_devel
+      - Generic_2_17
       - Generic_2_16
       - Generic_2_15
-      - Generic_2_14
     jobs:
       - template: templates/coverage.yml
diff --git a/ansible_collections/community/crypto/.github/workflows/ansible-test.yml b/ansible_collections/community/crypto/.github/workflows/ansible-test.yml
index be831028b..d31e861c4 100644
--- a/ansible_collections/community/crypto/.github/workflows/ansible-test.yml
+++ b/ansible_collections/community/crypto/.github/workflows/ansible-test.yml
@@ -34,6 +34,7 @@ jobs:
           - '2.11'
           - '2.12'
           - '2.13'
+          - '2.14'
     # Ansible-test on various stable branches does not yet work well with cgroups v2.
     # Since ubuntu-latest now uses Ubuntu 22.04, we need to fall back to the ubuntu-20.04
     # image for these stable branches. The list of branches where this is necessary will
@@ -74,6 +75,7 @@ jobs:
           - '2.11'
           - '2.12'
           - '2.13'
+          - '2.14'
 
     steps:
       - name: >-
@@ -253,6 +255,23 @@ jobs:
             docker: default
             python: '3.8'
             target: azp/generic/2/
+          # 2.14
+          - ansible: '2.14'
+            docker: ubuntu2004
+            python: ''
+            target: azp/posix/1/
+          - ansible: '2.14'
+            docker: ubuntu2004
+            python: ''
+            target: azp/posix/2/
+          - ansible: '2.14'
+            docker: default
+            python: '3.9'
+            target: azp/generic/1/
+          - ansible: '2.14'
+            docker: default
+            python: '3.9'
+            target: azp/generic/2/
 
     steps:
       - name: >-
diff --git a/ansible_collections/community/crypto/.github/workflows/reuse.yml b/ansible_collections/community/crypto/.github/workflows/reuse.yml
index 29b1f951a..7646c5cfb 100644
--- a/ansible_collections/community/crypto/.github/workflows/reuse.yml
+++ b/ansible_collections/community/crypto/.github/workflows/reuse.yml
@@ -29,4 +29,4 @@ jobs:
           rm -f tests/integration/targets/*/files/roots/*.pem
 
       - name: REUSE Compliance Check
-        uses: fsfe/reuse-action@v2
+        uses: fsfe/reuse-action@v3
diff --git a/ansible_collections/community/crypto/CHANGELOG.md b/ansible_collections/community/crypto/CHANGELOG.md
index f54352a87..1652a3ad2 100644
--- a/ansible_collections/community/crypto/CHANGELOG.md
+++ b/ansible_collections/community/crypto/CHANGELOG.md
@@ -1,217 +1,224 @@
 # Community Crypto Release Notes
 
 **Topics**
+
+- <a href="#v2-19-0">v2\.19\.0</a>
+    - <a href="#release-summary">Release Summary</a>
+    - <a href="#minor-changes">Minor Changes</a>
+    - <a href="#deprecated-features">Deprecated Features</a>
+    - <a href="#bugfixes">Bugfixes</a>
+    - <a href="#new-modules">New Modules</a>
 - <a href="#v2-18-0">v2\.18\.0</a>
-  - <a href="#release-summary">Release Summary</a>
-  - <a href="#minor-changes">Minor Changes</a>
-  - <a href="#deprecated-features">Deprecated Features</a>
-  - <a href="#bugfixes">Bugfixes</a>
-  - <a href="#new-plugins">New Plugins</a>
-    - <a href="#filter">Filter</a>
+    - <a href="#release-summary-1">Release Summary</a>
+    - <a href="#minor-changes-1">Minor Changes</a>
+    - <a href="#deprecated-features-1">Deprecated Features</a>
+    - <a href="#bugfixes-1">Bugfixes</a>
+    - <a href="#new-plugins">New Plugins</a>
+        - <a href="#filter">Filter</a>
 - <a href="#v2-17-1">v2\.17\.1</a>
-  - <a href="#release-summary-1">Release Summary</a>
-  - <a href="#bugfixes-1">Bugfixes</a>
+    - <a href="#release-summary-2">Release Summary</a>
+    - <a href="#bugfixes-2">Bugfixes</a>
 - <a href="#v2-17-0">v2\.17\.0</a>
-  - <a href="#release-summary-2">Release Summary</a>
-  - <a href="#minor-changes-1">Minor Changes</a>
+    - <a href="#release-summary-3">Release Summary</a>
+    - <a href="#minor-changes-2">Minor Changes</a>
 - <a href="#v2-16-2">v2\.16\.2</a>
-  - <a href="#release-summary-3">Release Summary</a>
-  - <a href="#bugfixes-2">Bugfixes</a>
+    - <a href="#release-summary-4">Release Summary</a>
+    - <a href="#bugfixes-3">Bugfixes</a>
 - <a href="#v2-16-1">v2\.16\.1</a>
-  - <a href="#release-summary-4">Release Summary</a>
-  - <a href="#bugfixes-3">Bugfixes</a>
+    - <a href="#release-summary-5">Release Summary</a>
+    - <a href="#bugfixes-4">Bugfixes</a>
 - <a href="#v2-16-0">v2\.16\.0</a>
-  - <a href="#release-summary-5">Release Summary</a>
-  - <a href="#minor-changes-2">Minor Changes</a>
-  - <a href="#bugfixes-4">Bugfixes</a>
+    - <a href="#release-summary-6">Release Summary</a>
+    - <a href="#minor-changes-3">Minor Changes</a>
+    - <a href="#bugfixes-5">Bugfixes</a>
 - <a href="#v2-15-1">v2\.15\.1</a>
-  - <a href="#release-summary-6">Release Summary</a>
-  - <a href="#bugfixes-5">Bugfixes</a>
+    - <a href="#release-summary-7">Release Summary</a>
+    - <a href="#bugfixes-6">Bugfixes</a>
 - <a href="#v2-15-0">v2\.15\.0</a>
-  - <a href="#release-summary-7">Release Summary</a>
-  - <a href="#minor-changes-3">Minor Changes</a>
-  - <a href="#deprecated-features-1">Deprecated Features</a>
-  - <a href="#bugfixes-6">Bugfixes</a>
-  - <a href="#new-plugins-1">New Plugins</a>
-    - <a href="#filter-1">Filter</a>
-    - <a href="#lookup">Lookup</a>
+    - <a href="#release-summary-8">Release Summary</a>
+    - <a href="#minor-changes-4">Minor Changes</a>
+    - <a href="#deprecated-features-2">Deprecated Features</a>
+    - <a href="#bugfixes-7">Bugfixes</a>
+    - <a href="#new-plugins-1">New Plugins</a>
+        - <a href="#filter-1">Filter</a>
+        - <a href="#lookup">Lookup</a>
 - <a href="#v2-14-1">v2\.14\.1</a>
-  - <a href="#release-summary-8">Release Summary</a>
-  - <a href="#bugfixes-7">Bugfixes</a>
-  - <a href="#known-issues">Known Issues</a>
+    - <a href="#release-summary-9">Release Summary</a>
+    - <a href="#bugfixes-8">Bugfixes</a>
+    - <a href="#known-issues">Known Issues</a>
 - <a href="#v2-14-0">v2\.14\.0</a>
-  - <a href="#release-summary-9">Release Summary</a>
-  - <a href="#minor-changes-4">Minor Changes</a>
+    - <a href="#release-summary-10">Release Summary</a>
+    - <a href="#minor-changes-5">Minor Changes</a>
 - <a href="#v2-13-1">v2\.13\.1</a>
-  - <a href="#release-summary-10">Release Summary</a>
-  - <a href="#bugfixes-8">Bugfixes</a>
+    - <a href="#release-summary-11">Release Summary</a>
+    - <a href="#bugfixes-9">Bugfixes</a>
 - <a href="#v2-13-0">v2\.13\.0</a>
-  - <a href="#release-summary-11">Release Summary</a>
-  - <a href="#minor-changes-5">Minor Changes</a>
-  - <a href="#deprecated-features-2">Deprecated Features</a>
-  - <a href="#bugfixes-9">Bugfixes</a>
+    - <a href="#release-summary-12">Release Summary</a>
+    - <a href="#minor-changes-6">Minor Changes</a>
+    - <a href="#deprecated-features-3">Deprecated Features</a>
+    - <a href="#bugfixes-10">Bugfixes</a>
 - <a href="#v2-12-0">v2\.12\.0</a>
-  - <a href="#release-summary-12">Release Summary</a>
-  - <a href="#minor-changes-6">Minor Changes</a>
+    - <a href="#release-summary-13">Release Summary</a>
+    - <a href="#minor-changes-7">Minor Changes</a>
 - <a href="#v2-11-1">v2\.11\.1</a>
-  - <a href="#release-summary-13">Release Summary</a>
+    - <a href="#release-summary-14">Release Summary</a>
 - <a href="#v2-11-0">v2\.11\.0</a>
-  - <a href="#release-summary-14">Release Summary</a>
-  - <a href="#minor-changes-7">Minor Changes</a>
-  - <a href="#bugfixes-10">Bugfixes</a>
+    - <a href="#release-summary-15">Release Summary</a>
+    - <a href="#minor-changes-8">Minor Changes</a>
+    - <a href="#bugfixes-11">Bugfixes</a>
 - <a href="#v2-10-0">v2\.10\.0</a>
-  - <a href="#release-summary-15">Release Summary</a>
-  - <a href="#bugfixes-11">Bugfixes</a>
-  - <a href="#new-plugins-2">New Plugins</a>
-    - <a href="#filter-2">Filter</a>
+    - <a href="#release-summary-16">Release Summary</a>
+    - <a href="#bugfixes-12">Bugfixes</a>
+    - <a href="#new-plugins-2">New Plugins</a>
+        - <a href="#filter-2">Filter</a>
 - <a href="#v2-9-0">v2\.9\.0</a>
-  - <a href="#release-summary-16">Release Summary</a>
-  - <a href="#minor-changes-8">Minor Changes</a>
+    - <a href="#release-summary-17">Release Summary</a>
+    - <a href="#minor-changes-9">Minor Changes</a>
 - <a href="#v2-8-1">v2\.8\.1</a>
-  - <a href="#release-summary-17">Release Summary</a>
+    - <a href="#release-summary-18">Release Summary</a>
 - <a href="#v2-8-0">v2\.8\.0</a>
-  - <a href="#release-summary-18">Release Summary</a>
-  - <a href="#minor-changes-9">Minor Changes</a>
+    - <a href="#release-summary-19">Release Summary</a>
+    - <a href="#minor-changes-10">Minor Changes</a>
 - <a href="#v2-7-1">v2\.7\.1</a>
-  - <a href="#release-summary-19">Release Summary</a>
-  - <a href="#bugfixes-12">Bugfixes</a>
+    - <a href="#release-summary-20">Release Summary</a>
+    - <a href="#bugfixes-13">Bugfixes</a>
 - <a href="#v2-7-0">v2\.7\.0</a>
-  - <a href="#release-summary-20">Release Summary</a>
-  - <a href="#minor-changes-10">Minor Changes</a>
-  - <a href="#bugfixes-13">Bugfixes</a>
+    - <a href="#release-summary-21">Release Summary</a>
+    - <a href="#minor-changes-11">Minor Changes</a>
+    - <a href="#bugfixes-14">Bugfixes</a>
 - <a href="#v2-6-0">v2\.6\.0</a>
-  - <a href="#release-summary-21">Release Summary</a>
-  - <a href="#minor-changes-11">Minor Changes</a>
+    - <a href="#release-summary-22">Release Summary</a>
+    - <a href="#minor-changes-12">Minor Changes</a>
 - <a href="#v2-5-0">v2\.5\.0</a>
-  - <a href="#release-summary-22">Release Summary</a>
-  - <a href="#minor-changes-12">Minor Changes</a>
+    - <a href="#release-summary-23">Release Summary</a>
+    - <a href="#minor-changes-13">Minor Changes</a>
 - <a href="#v2-4-0">v2\.4\.0</a>
-  - <a href="#release-summary-23">Release Summary</a>
-  - <a href="#deprecated-features-3">Deprecated Features</a>
-  - <a href="#bugfixes-14">Bugfixes</a>
+    - <a href="#release-summary-24">Release Summary</a>
+    - <a href="#deprecated-features-4">Deprecated Features</a>
+    - <a href="#bugfixes-15">Bugfixes</a>
 - <a href="#v2-3-4">v2\.3\.4</a>
-  - <a href="#release-summary-24">Release Summary</a>
+    - <a href="#release-summary-25">Release Summary</a>
 - <a href="#v2-3-3">v2\.3\.3</a>
-  - <a href="#release-summary-25">Release Summary</a>
-  - <a href="#bugfixes-15">Bugfixes</a>
+    - <a href="#release-summary-26">Release Summary</a>
+    - <a href="#bugfixes-16">Bugfixes</a>
 - <a href="#v2-3-2">v2\.3\.2</a>
-  - <a href="#release-summary-26">Release Summary</a>
-  - <a href="#bugfixes-16">Bugfixes</a>
+    - <a href="#release-summary-27">Release Summary</a>
+    - <a href="#bugfixes-17">Bugfixes</a>
 - <a href="#v2-3-1">v2\.3\.1</a>
-  - <a href="#release-summary-27">Release Summary</a>
-  - <a href="#bugfixes-17">Bugfixes</a>
+    - <a href="#release-summary-28">Release Summary</a>
+    - <a href="#bugfixes-18">Bugfixes</a>
 - <a href="#v2-3-0">v2\.3\.0</a>
-  - <a href="#release-summary-28">Release Summary</a>
-  - <a href="#minor-changes-13">Minor Changes</a>
-  - <a href="#bugfixes-18">Bugfixes</a>
+    - <a href="#release-summary-29">Release Summary</a>
+    - <a href="#minor-changes-14">Minor Changes</a>
+    - <a href="#bugfixes-19">Bugfixes</a>
 - <a href="#v2-2-4">v2\.2\.4</a>
-  - <a href="#release-summary-29">Release Summary</a>
-  - <a href="#bugfixes-19">Bugfixes</a>
+    - <a href="#release-summary-30">Release Summary</a>
+    - <a href="#bugfixes-20">Bugfixes</a>
 - <a href="#v2-2-3">v2\.2\.3</a>
-  - <a href="#release-summary-30">Release Summary</a>
-  - <a href="#bugfixes-20">Bugfixes</a>
+    - <a href="#release-summary-31">Release Summary</a>
+    - <a href="#bugfixes-21">Bugfixes</a>
 - <a href="#v2-2-2">v2\.2\.2</a>
-  - <a href="#release-summary-31">Release Summary</a>
-  - <a href="#bugfixes-21">Bugfixes</a>
+    - <a href="#release-summary-32">Release Summary</a>
+    - <a href="#bugfixes-22">Bugfixes</a>
 - <a href="#v2-2-1">v2\.2\.1</a>
-  - <a href="#release-summary-32">Release Summary</a>
-  - <a href="#bugfixes-22">Bugfixes</a>
+    - <a href="#release-summary-33">Release Summary</a>
+    - <a href="#bugfixes-23">Bugfixes</a>
 - <a href="#v2-2-0">v2\.2\.0</a>
-  - <a href="#release-summary-33">Release Summary</a>
-  - <a href="#minor-changes-14">Minor Changes</a>
-  - <a href="#bugfixes-23">Bugfixes</a>
+    - <a href="#release-summary-34">Release Summary</a>
+    - <a href="#minor-changes-15">Minor Changes</a>
+    - <a href="#bugfixes-24">Bugfixes</a>
 - <a href="#v2-1-0">v2\.1\.0</a>
-  - <a href="#release-summary-34">Release Summary</a>
-  - <a href="#minor-changes-15">Minor Changes</a>
-  - <a href="#bugfixes-24">Bugfixes</a>
-  - <a href="#new-modules">New Modules</a>
+    - <a href="#release-summary-35">Release Summary</a>
+    - <a href="#minor-changes-16">Minor Changes</a>
+    - <a href="#bugfixes-25">Bugfixes</a>
+    - <a href="#new-modules-1">New Modules</a>
 - <a href="#v2-0-2">v2\.0\.2</a>
-  - <a href="#release-summary-35">Release Summary</a>
+    - <a href="#release-summary-36">Release Summary</a>
 - <a href="#v2-0-1">v2\.0\.1</a>
-  - <a href="#release-summary-36">Release Summary</a>
-  - <a href="#minor-changes-16">Minor Changes</a>
-  - <a href="#bugfixes-25">Bugfixes</a>
+    - <a href="#release-summary-37">Release Summary</a>
+    - <a href="#minor-changes-17">Minor Changes</a>
+    - <a href="#bugfixes-26">Bugfixes</a>
 - <a href="#v2-0-0">v2\.0\.0</a>
-  - <a href="#release-summary-37">Release Summary</a>
-  - <a href="#minor-changes-17">Minor Changes</a>
-  - <a href="#breaking-changes--porting-guide">Breaking Changes / Porting Guide</a>
-  - <a href="#deprecated-features-4">Deprecated Features</a>
-  - <a href="#removed-features-previously-deprecated">Removed Features \(previously deprecated\)</a>
-  - <a href="#bugfixes-26">Bugfixes</a>
+    - <a href="#release-summary-38">Release Summary</a>
+    - <a href="#minor-changes-18">Minor Changes</a>
+    - <a href="#breaking-changes--porting-guide">Breaking Changes / Porting Guide</a>
+    - <a href="#deprecated-features-5">Deprecated Features</a>
+    - <a href="#removed-features-previously-deprecated">Removed Features \(previously deprecated\)</a>
+    - <a href="#bugfixes-27">Bugfixes</a>
 - <a href="#v1-9-4">v1\.9\.4</a>
-  - <a href="#release-summary-38">Release Summary</a>
-  - <a href="#bugfixes-27">Bugfixes</a>
+    - <a href="#release-summary-39">Release Summary</a>
+    - <a href="#bugfixes-28">Bugfixes</a>
 - <a href="#v1-9-3">v1\.9\.3</a>
-  - <a href="#release-summary-39">Release Summary</a>
-  - <a href="#bugfixes-28">Bugfixes</a>
+    - <a href="#release-summary-40">Release Summary</a>
+    - <a href="#bugfixes-29">Bugfixes</a>
 - <a href="#v1-9-2">v1\.9\.2</a>
-  - <a href="#release-summary-40">Release Summary</a>
+    - <a href="#release-summary-41">Release Summary</a>
 - <a href="#v1-9-1">v1\.9\.1</a>
-  - <a href="#release-summary-41">Release Summary</a>
+    - <a href="#release-summary-42">Release Summary</a>
 - <a href="#v1-9-0">v1\.9\.0</a>
-  - <a href="#release-summary-42">Release Summary</a>
-  - <a href="#minor-changes-18">Minor Changes</a>
-  - <a href="#bugfixes-29">Bugfixes</a>
+    - <a href="#release-summary-43">Release Summary</a>
+    - <a href="#minor-changes-19">Minor Changes</a>
+    - <a href="#bugfixes-30">Bugfixes</a>
 - <a href="#v1-8-0">v1\.8\.0</a>
-  - <a href="#release-summary-43">Release Summary</a>
-  - <a href="#minor-changes-19">Minor Changes</a>
-  - <a href="#bugfixes-30">Bugfixes</a>
+    - <a href="#release-summary-44">Release Summary</a>
+    - <a href="#minor-changes-20">Minor Changes</a>
+    - <a href="#bugfixes-31">Bugfixes</a>
 - <a href="#v1-7-1">v1\.7\.1</a>
-  - <a href="#release-summary-44">Release Summary</a>
-  - <a href="#bugfixes-31">Bugfixes</a>
+    - <a href="#release-summary-45">Release Summary</a>
+    - <a href="#bugfixes-32">Bugfixes</a>
 - <a href="#v1-7-0">v1\.7\.0</a>
-  - <a href="#release-summary-45">Release Summary</a>
-  - <a href="#minor-changes-20">Minor Changes</a>
-  - <a href="#bugfixes-32">Bugfixes</a>
-  - <a href="#new-modules-1">New Modules</a>
+    - <a href="#release-summary-46">Release Summary</a>
+    - <a href="#minor-changes-21">Minor Changes</a>
+    - <a href="#bugfixes-33">Bugfixes</a>
+    - <a href="#new-modules-2">New Modules</a>
 - <a href="#v1-6-2">v1\.6\.2</a>
-  - <a href="#release-summary-46">Release Summary</a>
-  - <a href="#bugfixes-33">Bugfixes</a>
+    - <a href="#release-summary-47">Release Summary</a>
+    - <a href="#bugfixes-34">Bugfixes</a>
 - <a href="#v1-6-1">v1\.6\.1</a>
-  - <a href="#release-summary-47">Release Summary</a>
-  - <a href="#bugfixes-34">Bugfixes</a>
+    - <a href="#release-summary-48">Release Summary</a>
+    - <a href="#bugfixes-35">Bugfixes</a>
 - <a href="#v1-6-0">v1\.6\.0</a>
-  - <a href="#release-summary-48">Release Summary</a>
-  - <a href="#minor-changes-21">Minor Changes</a>
-  - <a href="#deprecated-features-5">Deprecated Features</a>
-  - <a href="#bugfixes-35">Bugfixes</a>
+    - <a href="#release-summary-49">Release Summary</a>
+    - <a href="#minor-changes-22">Minor Changes</a>
+    - <a href="#deprecated-features-6">Deprecated Features</a>
+    - <a href="#bugfixes-36">Bugfixes</a>
 - <a href="#v1-5-0">v1\.5\.0</a>
-  - <a href="#release-summary-49">Release Summary</a>
-  - <a href="#minor-changes-22">Minor Changes</a>
-  - <a href="#deprecated-features-6">Deprecated Features</a>
-  - <a href="#bugfixes-36">Bugfixes</a>
+    - <a href="#release-summary-50">Release Summary</a>
+    - <a href="#minor-changes-23">Minor Changes</a>
+    - <a href="#deprecated-features-7">Deprecated Features</a>
+    - <a href="#bugfixes-37">Bugfixes</a>
 - <a href="#v1-4-0">v1\.4\.0</a>
-  - <a href="#release-summary-50">Release Summary</a>
-  - <a href="#minor-changes-23">Minor Changes</a>
-  - <a href="#bugfixes-37">Bugfixes</a>
+    - <a href="#release-summary-51">Release Summary</a>
+    - <a href="#minor-changes-24">Minor Changes</a>
+    - <a href="#bugfixes-38">Bugfixes</a>
 - <a href="#v1-3-0">v1\.3\.0</a>
-  - <a href="#release-summary-51">Release Summary</a>
-  - <a href="#minor-changes-24">Minor Changes</a>
-  - <a href="#bugfixes-38">Bugfixes</a>
-  - <a href="#new-modules-2">New Modules</a>
+    - <a href="#release-summary-52">Release Summary</a>
+    - <a href="#minor-changes-25">Minor Changes</a>
+    - <a href="#bugfixes-39">Bugfixes</a>
+    - <a href="#new-modules-3">New Modules</a>
 - <a href="#v1-2-0">v1\.2\.0</a>
-  - <a href="#release-summary-52">Release Summary</a>
-  - <a href="#minor-changes-25">Minor Changes</a>
-  - <a href="#security-fixes">Security Fixes</a>
-  - <a href="#bugfixes-39">Bugfixes</a>
+    - <a href="#release-summary-53">Release Summary</a>
+    - <a href="#minor-changes-26">Minor Changes</a>
+    - <a href="#security-fixes">Security Fixes</a>
+    - <a href="#bugfixes-40">Bugfixes</a>
 - <a href="#v1-1-1">v1\.1\.1</a>
-  - <a href="#release-summary-53">Release Summary</a>
-  - <a href="#bugfixes-40">Bugfixes</a>
+    - <a href="#release-summary-54">Release Summary</a>
+    - <a href="#bugfixes-41">Bugfixes</a>
 - <a href="#v1-1-0">v1\.1\.0</a>
-  - <a href="#release-summary-54">Release Summary</a>
-  - <a href="#minor-changes-26">Minor Changes</a>
-  - <a href="#bugfixes-41">Bugfixes</a>
-  - <a href="#new-modules-3">New Modules</a>
+    - <a href="#release-summary-55">Release Summary</a>
+    - <a href="#minor-changes-27">Minor Changes</a>
+    - <a href="#bugfixes-42">Bugfixes</a>
+    - <a href="#new-modules-4">New Modules</a>
 - <a href="#v1-0-0">v1\.0\.0</a>
-  - <a href="#release-summary-55">Release Summary</a>
-  - <a href="#minor-changes-27">Minor Changes</a>
-  - <a href="#deprecated-features-7">Deprecated Features</a>
-  - <a href="#removed-features-previously-deprecated-1">Removed Features \(previously deprecated\)</a>
-  - <a href="#bugfixes-42">Bugfixes</a>
-  - <a href="#new-modules-4">New Modules</a>
+    - <a href="#release-summary-56">Release Summary</a>
+    - <a href="#minor-changes-28">Minor Changes</a>
+    - <a href="#deprecated-features-8">Deprecated Features</a>
+    - <a href="#removed-features-previously-deprecated-1">Removed Features \(previously deprecated\)</a>
+    - <a href="#bugfixes-43">Bugfixes</a>
+    - <a href="#new-modules-5">New Modules</a>
 
-<a id="v2-18-0"></a>
-## v2\.18\.0
+<a id="v2-19-0"></a>
+## v2\.19\.0
 
 <a id="release-summary"></a>
 ### Release Summary
@@ -221,16 +228,45 @@ Bugfix and feature release\.
 <a id="minor-changes"></a>
 ### Minor Changes
 
-* x509\_crl \- the new option <code>serial\_numbers</code> allow to configure in which format serial numbers can be provided to <code>revoked\_certificates\[\]\.serial\_number</code>\. The default is as integers \(<code>serial\_numbers\=integer</code>\) for backwards compatibility\; setting <code>serial\_numbers\=hex\-octets</code> allows to specify colon\-separated hex octet strings like <code>00\:11\:22\:FF</code> \([https\://github\.com/ansible\-collections/community\.crypto/issues/687](https\://github\.com/ansible\-collections/community\.crypto/issues/687)\, [https\://github\.com/ansible\-collections/community\.crypto/pull/715](https\://github\.com/ansible\-collections/community\.crypto/pull/715)\)\.
+* When using cryptography \>\= 42\.0\.0\, use offset\-aware <code>datetime\.datetime</code> objects \(with timezone UTC\) instead of offset\-naive UTC timestamps \([https\://github\.com/ansible\-collections/community\.crypto/issues/726](https\://github\.com/ansible\-collections/community\.crypto/issues/726)\, [https\://github\.com/ansible\-collections/community\.crypto/pull/727](https\://github\.com/ansible\-collections/community\.crypto/pull/727)\)\.
+* openssh\_cert \- avoid UTC functions deprecated in Python 3\.12 when using Python 3 \([https\://github\.com/ansible\-collections/community\.crypto/pull/727](https\://github\.com/ansible\-collections/community\.crypto/pull/727)\)\.
 
 <a id="deprecated-features"></a>
 ### Deprecated Features
 
-* openssl\_csr\_pipe\, openssl\_privatekey\_pipe\, x509\_certificate\_pipe \- the current behavior of check mode is deprecated and will change in community\.crypto 3\.0\.0\. The current behavior is similar to the modules without <code>\_pipe</code>\: if the object needs to be \(re\-\)generated\, only the <code>changed</code> status is set\, but the object is not updated\. From community\.crypto 3\.0\.0 on\, the modules will ignore check mode and always act as if check mode is not active\. This behavior can already achieved now by adding <code>check\_mode\: false</code> to the task\. If you think this breaks your use\-case of this module\, please [create an issue in the community\.crypto repository](https\://github\.com/ansible\-collections/community\.crypto/issues/new/choose) \([https\://github\.com/ansible\-collections/community\.crypto/issues/712](https\://github\.com/ansible\-collections/community\.crypto/issues/712)\, [https\://github\.com/ansible\-collections/community\.crypto/pull/714](https\://github\.com/ansible\-collections/community\.crypto/pull/714)\)\.
+* acme\.backends module utils \- from community\.crypto on\, all implementations of <code>CryptoBackend</code> must override <code>get\_ordered\_csr\_identifiers\(\)</code>\. The current default implementation\, which simply sorts the result of <code>get\_csr\_identifiers\(\)</code>\, will then be removed \([https\://github\.com/ansible\-collections/community\.crypto/pull/725](https\://github\.com/ansible\-collections/community\.crypto/pull/725)\)\.
 
 <a id="bugfixes"></a>
 ### Bugfixes
 
+* acme\_certificate \- respect the order of the CNAME and SAN identifiers that are passed on when creating an ACME order \([https\://github\.com/ansible\-collections/community\.crypto/issues/723](https\://github\.com/ansible\-collections/community\.crypto/issues/723)\, [https\://github\.com/ansible\-collections/community\.crypto/pull/725](https\://github\.com/ansible\-collections/community\.crypto/pull/725)\)\.
+
+<a id="new-modules"></a>
+### New Modules
+
+* x509\_certificate\_convert \- Convert X\.509 certificates
+
+<a id="v2-18-0"></a>
+## v2\.18\.0
+
+<a id="release-summary-1"></a>
+### Release Summary
+
+Bugfix and feature release\.
+
+<a id="minor-changes-1"></a>
+### Minor Changes
+
+* x509\_crl \- the new option <code>serial\_numbers</code> allow to configure in which format serial numbers can be provided to <code>revoked\_certificates\[\]\.serial\_number</code>\. The default is as integers \(<code>serial\_numbers\=integer</code>\) for backwards compatibility\; setting <code>serial\_numbers\=hex\-octets</code> allows to specify colon\-separated hex octet strings like <code>00\:11\:22\:FF</code> \([https\://github\.com/ansible\-collections/community\.crypto/issues/687](https\://github\.com/ansible\-collections/community\.crypto/issues/687)\, [https\://github\.com/ansible\-collections/community\.crypto/pull/715](https\://github\.com/ansible\-collections/community\.crypto/pull/715)\)\.
+
+<a id="deprecated-features-1"></a>
+### Deprecated Features
+
+* openssl\_csr\_pipe\, openssl\_privatekey\_pipe\, x509\_certificate\_pipe \- the current behavior of check mode is deprecated and will change in community\.crypto 3\.0\.0\. The current behavior is similar to the modules without <code>\_pipe</code>\: if the object needs to be \(re\-\)generated\, only the <code>changed</code> status is set\, but the object is not updated\. From community\.crypto 3\.0\.0 on\, the modules will ignore check mode and always act as if check mode is not active\. This behavior can already achieved now by adding <code>check\_mode\: false</code> to the task\. If you think this breaks your use\-case of this module\, please [create an issue in the community\.crypto repository](https\://github\.com/ansible\-collections/community\.crypto/issues/new/choose) \([https\://github\.com/ansible\-collections/community\.crypto/issues/712](https\://github\.com/ansible\-collections/community\.crypto/issues/712)\, [https\://github\.com/ansible\-collections/community\.crypto/pull/714](https\://github\.com/ansible\-collections/community\.crypto/pull/714)\)\.
+
+<a id="bugfixes-1"></a>
+### Bugfixes
+
 * luks\_device \- fixed module a bug that prevented using <code>remove\_keyslot</code> with the value <code>0</code> \([https\://github\.com/ansible\-collections/community\.crypto/pull/710](https\://github\.com/ansible\-collections/community\.crypto/pull/710)\)\.
 * luks\_device \- fixed module falsely outputting <code>changed\=false</code> when trying to add a new slot with a key that is already present in another slot\. The module now rejects adding keys that are already present in another slot \([https\://github\.com/ansible\-collections/community\.crypto/pull/710](https\://github\.com/ansible\-collections/community\.crypto/pull/710)\)\.
 * luks\_device \- fixed testing of LUKS passphrases in when specifying a keyslot for cryptsetup version 2\.0\.3\. The output of this cryptsetup version slightly differs from later versions \([https\://github\.com/ansible\-collections/community\.crypto/pull/710](https\://github\.com/ansible\-collections/community\.crypto/pull/710)\)\.
@@ -247,12 +283,12 @@ Bugfix and feature release\.
 <a id="v2-17-1"></a>
 ## v2\.17\.1
 
-<a id="release-summary-1"></a>
+<a id="release-summary-2"></a>
 ### Release Summary
 
 Bugfix release for compatibility with cryptography 42\.0\.0\.
 
-<a id="bugfixes-1"></a>
+<a id="bugfixes-2"></a>
 ### Bugfixes
 
 * openssl\_dhparam \- was using an internal function instead of the public API to load DH param files when using the <code>cryptography</code> backend\. The internal function was removed in cryptography 42\.0\.0\. The module now uses the public API\, which has been available since support for DH params was added to cryptography \([https\://github\.com/ansible\-collections/community\.crypto/pull/698](https\://github\.com/ansible\-collections/community\.crypto/pull/698)\)\.
@@ -262,12 +298,12 @@ Bugfix release for compatibility with cryptography 42\.0\.0\.
 <a id="v2-17-0"></a>
 ## v2\.17\.0
 
-<a id="release-summary-2"></a>
+<a id="release-summary-3"></a>
 ### Release Summary
 
 Feature release\.
 
-<a id="minor-changes-1"></a>
+<a id="minor-changes-2"></a>
 ### Minor Changes
 
 * luks\_device \- add allow discards option \([https\://github\.com/ansible\-collections/community\.crypto/pull/693](https\://github\.com/ansible\-collections/community\.crypto/pull/693)\)\.
@@ -275,12 +311,12 @@ Feature release\.
 <a id="v2-16-2"></a>
 ## v2\.16\.2
 
-<a id="release-summary-3"></a>
+<a id="release-summary-4"></a>
 ### Release Summary
 
 Bugfix release\.
 
-<a id="bugfixes-2"></a>
+<a id="bugfixes-3"></a>
 ### Bugfixes
 
 * acme\_\* modules \- directly react on bad return data for account creation/retrieval/updating requests \([https\://github\.com/ansible\-collections/community\.crypto/pull/682](https\://github\.com/ansible\-collections/community\.crypto/pull/682)\)\.
@@ -291,12 +327,12 @@ Bugfix release\.
 <a id="v2-16-1"></a>
 ## v2\.16\.1
 
-<a id="release-summary-4"></a>
+<a id="release-summary-5"></a>
 ### Release Summary
 
 Bugfix release\.
 
-<a id="bugfixes-3"></a>
+<a id="bugfixes-4"></a>
 ### Bugfixes
 
 * acme\_\* modules \- also retry requests in case of socket errors\, bad status lines\, and unknown connection errors\; improve error messages in these cases \([https\://github\.com/ansible\-collections/community\.crypto/issues/680](https\://github\.com/ansible\-collections/community\.crypto/issues/680)\)\.
@@ -304,17 +340,17 @@ Bugfix release\.
 <a id="v2-16-0"></a>
 ## v2\.16\.0
 
-<a id="release-summary-5"></a>
+<a id="release-summary-6"></a>
 ### Release Summary
 
 Bugfix release\.
 
-<a id="minor-changes-2"></a>
+<a id="minor-changes-3"></a>
 ### Minor Changes
 
 * luks\_devices \- add new options <code>keyslot</code>\, <code>new\_keyslot</code>\, and <code>remove\_keyslot</code> to allow adding/removing keys to/from specific keyslots \([https\://github\.com/ansible\-collections/community\.crypto/pull/664](https\://github\.com/ansible\-collections/community\.crypto/pull/664)\)\.
 
-<a id="bugfixes-4"></a>
+<a id="bugfixes-5"></a>
 ### Bugfixes
 
 * openssl\_pkcs12 \- modify autodetect to not detect pyOpenSSL \>\= 23\.3\.0\, which removed PKCS\#12 support \([https\://github\.com/ansible\-collections/community\.crypto/pull/666](https\://github\.com/ansible\-collections/community\.crypto/pull/666)\)\.
@@ -322,12 +358,12 @@ Bugfix release\.
 <a id="v2-15-1"></a>
 ## v2\.15\.1
 
-<a id="release-summary-6"></a>
+<a id="release-summary-7"></a>
 ### Release Summary
 
 Bugfix release\.
 
-<a id="bugfixes-5"></a>
+<a id="bugfixes-6"></a>
 ### Bugfixes
 
 * acme\_\* modules \- correctly handle error documents without <code>type</code> \([https\://github\.com/ansible\-collections/community\.crypto/issues/651](https\://github\.com/ansible\-collections/community\.crypto/issues/651)\, [https\://github\.com/ansible\-collections/community\.crypto/pull/652](https\://github\.com/ansible\-collections/community\.crypto/pull/652)\)\.
@@ -335,22 +371,22 @@ Bugfix release\.
 <a id="v2-15-0"></a>
 ## v2\.15\.0
 
-<a id="release-summary-7"></a>
+<a id="release-summary-8"></a>
 ### Release Summary
 
 Bugfix and feature release\.
 
-<a id="minor-changes-3"></a>
+<a id="minor-changes-4"></a>
 ### Minor Changes
 
 * openssh\_keypair \- fail when comment cannot be updated \([https\://github\.com/ansible\-collections/community\.crypto/pull/646](https\://github\.com/ansible\-collections/community\.crypto/pull/646)\)\.
 
-<a id="deprecated-features-1"></a>
+<a id="deprecated-features-2"></a>
 ### Deprecated Features
 
 * get\_certificate \- the default <code>false</code> of the <code>asn1\_base64</code> option is deprecated and will change to <code>true</code> in community\.crypto 3\.0\.0 \([https\://github\.com/ansible\-collections/community\.crypto/pull/600](https\://github\.com/ansible\-collections/community\.crypto/pull/600)\)\.
 
-<a id="bugfixes-6"></a>
+<a id="bugfixes-7"></a>
 ### Bugfixes
 
 * openssh\_cert\, openssh\_keypair \- the modules ignored return codes of <code>ssh</code> and <code>ssh\-keygen</code> in some cases \([https\://github\.com/ansible\-collections/community\.crypto/issues/645](https\://github\.com/ansible\-collections/community\.crypto/issues/645)\, [https\://github\.com/ansible\-collections/community\.crypto/pull/646](https\://github\.com/ansible\-collections/community\.crypto/pull/646)\)\.
@@ -372,7 +408,7 @@ Bugfix and feature release\.
 <a id="v2-14-1"></a>
 ## v2\.14\.1
 
-<a id="release-summary-8"></a>
+<a id="release-summary-9"></a>
 ### Release Summary
 
 Bugfix and maintenance release with updated documentation\.
@@ -385,7 +421,7 @@ ansible\-core 2\.15 or later to see it as it is intended\. Alternatively you can
 look at [the devel docsite](https\://docs\.ansible\.com/ansible/devel/collections/community/crypto/)
 for the rendered HTML version of the documentation of the latest release\.
 
-<a id="bugfixes-7"></a>
+<a id="bugfixes-8"></a>
 ### Bugfixes
 
 * Fix PEM detection/identification to also accept random other lines before the line starting with <code>\-\-\-\-\-BEGIN</code> \([https\://github\.com/ansible\-collections/community\.crypto/issues/627](https\://github\.com/ansible\-collections/community\.crypto/issues/627)\, [https\://github\.com/ansible\-collections/community\.crypto/pull/628](https\://github\.com/ansible\-collections/community\.crypto/pull/628)\)\.
@@ -398,12 +434,12 @@ for the rendered HTML version of the documentation of the latest release\.
 <a id="v2-14-0"></a>
 ## v2\.14\.0
 
-<a id="release-summary-9"></a>
+<a id="release-summary-10"></a>
 ### Release Summary
 
 Feature release\.
 
-<a id="minor-changes-4"></a>
+<a id="minor-changes-5"></a>
 ### Minor Changes
 
 * acme\_certificate \- allow to use no challenge by providing <code>no challenge</code> for the <code>challenge</code> option\. This is needed for ACME servers where validation is done without challenges \([https\://github\.com/ansible\-collections/community\.crypto/issues/613](https\://github\.com/ansible\-collections/community\.crypto/issues/613)\, [https\://github\.com/ansible\-collections/community\.crypto/pull/615](https\://github\.com/ansible\-collections/community\.crypto/pull/615)\)\.
@@ -413,12 +449,12 @@ Feature release\.
 <a id="v2-13-1"></a>
 ## v2\.13\.1
 
-<a id="release-summary-10"></a>
+<a id="release-summary-11"></a>
 ### Release Summary
 
 Bugfix release\.
 
-<a id="bugfixes-8"></a>
+<a id="bugfixes-9"></a>
 ### Bugfixes
 
 * execution environment definition \- fix installation of <code>python3\-pyOpenSSL</code> package on CentOS and RHEL \([https\://github\.com/ansible\-collections/community\.crypto/pull/606](https\://github\.com/ansible\-collections/community\.crypto/pull/606)\)\.
@@ -427,22 +463,22 @@ Bugfix release\.
 <a id="v2-13-0"></a>
 ## v2\.13\.0
 
-<a id="release-summary-11"></a>
+<a id="release-summary-12"></a>
 ### Release Summary
 
 Bugfix and maintenance release\.
 
-<a id="minor-changes-5"></a>
+<a id="minor-changes-6"></a>
 ### Minor Changes
 
 * x509\_crl \- the <code>crl\_mode</code> option has been added to replace the existing <code>mode</code> option \([https\://github\.com/ansible\-collections/community\.crypto/issues/596](https\://github\.com/ansible\-collections/community\.crypto/issues/596)\)\.
 
-<a id="deprecated-features-2"></a>
+<a id="deprecated-features-3"></a>
 ### Deprecated Features
 
 * x509\_crl \- the <code>mode</code> option is deprecated\; use <code>crl\_mode</code> instead\. The <code>mode</code> option will change its meaning in community\.crypto 3\.0\.0\, and will refer to the CRL file\'s mode instead \([https\://github\.com/ansible\-collections/community\.crypto/issues/596](https\://github\.com/ansible\-collections/community\.crypto/issues/596)\)\.
 
-<a id="bugfixes-9"></a>
+<a id="bugfixes-10"></a>
 ### Bugfixes
 
 * openssh\_keypair \- always generate a new key pair if the private key does not exist\. Previously\, the module would fail when <code>regenerate\=fail</code> without an existing key\, contradicting the documentation \([https\://github\.com/ansible\-collections/community\.crypto/pull/598](https\://github\.com/ansible\-collections/community\.crypto/pull/598)\)\.
@@ -451,12 +487,12 @@ Bugfix and maintenance release\.
 <a id="v2-12-0"></a>
 ## v2\.12\.0
 
-<a id="release-summary-12"></a>
+<a id="release-summary-13"></a>
 ### Release Summary
 
 Feature release\.
 
-<a id="minor-changes-6"></a>
+<a id="minor-changes-7"></a>
 ### Minor Changes
 
 * get\_certificate \- add <code>asn1\_base64</code> option to control whether the ASN\.1 included in the <code>extensions</code> return value is binary data or Base64 encoded \([https\://github\.com/ansible\-collections/community\.crypto/pull/592](https\://github\.com/ansible\-collections/community\.crypto/pull/592)\)\.
@@ -464,7 +500,7 @@ Feature release\.
 <a id="v2-11-1"></a>
 ## v2\.11\.1
 
-<a id="release-summary-13"></a>
+<a id="release-summary-14"></a>
 ### Release Summary
 
 Maintenance release with improved documentation\.
@@ -472,17 +508,17 @@ Maintenance release with improved documentation\.
 <a id="v2-11-0"></a>
 ## v2\.11\.0
 
-<a id="release-summary-14"></a>
+<a id="release-summary-15"></a>
 ### Release Summary
 
 Feature and bugfix release\.
 
-<a id="minor-changes-7"></a>
+<a id="minor-changes-8"></a>
 ### Minor Changes
 
 * get\_certificate \- adds <code>ciphers</code> option for custom cipher selection \([https\://github\.com/ansible\-collections/community\.crypto/pull/571](https\://github\.com/ansible\-collections/community\.crypto/pull/571)\)\.
 
-<a id="bugfixes-10"></a>
+<a id="bugfixes-11"></a>
 ### Bugfixes
 
 * action plugin helper \- fix handling of deprecations for ansible\-core 2\.14\.2 \([https\://github\.com/ansible\-collections/community\.crypto/pull/572](https\://github\.com/ansible\-collections/community\.crypto/pull/572)\)\.
@@ -492,12 +528,12 @@ Feature and bugfix release\.
 <a id="v2-10-0"></a>
 ## v2\.10\.0
 
-<a id="release-summary-15"></a>
+<a id="release-summary-16"></a>
 ### Release Summary
 
 Bugfix and feature release\.
 
-<a id="bugfixes-11"></a>
+<a id="bugfixes-12"></a>
 ### Bugfixes
 
 * openssl\_csr\, openssl\_csr\_pipe \- prevent invalid values for <code>crl\_distribution\_points</code> that do not have one of <code>full\_name</code>\, <code>relative\_name</code>\, and <code>crl\_issuer</code> \([https\://github\.com/ansible\-collections/community\.crypto/pull/560](https\://github\.com/ansible\-collections/community\.crypto/pull/560)\)\.
@@ -519,12 +555,12 @@ Bugfix and feature release\.
 <a id="v2-9-0"></a>
 ## v2\.9\.0
 
-<a id="release-summary-16"></a>
+<a id="release-summary-17"></a>
 ### Release Summary
 
 Regular feature release\.
 
-<a id="minor-changes-8"></a>
+<a id="minor-changes-9"></a>
 ### Minor Changes
 
 * x509\_certificate\_info \- adds <code>issuer\_uri</code> field in return value based on Authority Information Access data \([https\://github\.com/ansible\-collections/community\.crypto/pull/530](https\://github\.com/ansible\-collections/community\.crypto/pull/530)\)\.
@@ -532,7 +568,7 @@ Regular feature release\.
 <a id="v2-8-1"></a>
 ## v2\.8\.1
 
-<a id="release-summary-17"></a>
+<a id="release-summary-18"></a>
 ### Release Summary
 
 Maintenance release with improved documentation\.
@@ -540,12 +576,12 @@ Maintenance release with improved documentation\.
 <a id="v2-8-0"></a>
 ## v2\.8\.0
 
-<a id="release-summary-18"></a>
+<a id="release-summary-19"></a>
 ### Release Summary
 
 Feature release\.
 
-<a id="minor-changes-9"></a>
+<a id="minor-changes-10"></a>
 ### Minor Changes
 
 * acme\_\* modules \- handle more gracefully if CA\'s new nonce call does not return a nonce \([https\://github\.com/ansible\-collections/community\.crypto/pull/525](https\://github\.com/ansible\-collections/community\.crypto/pull/525)\)\.
@@ -555,12 +591,12 @@ Feature release\.
 <a id="v2-7-1"></a>
 ## v2\.7\.1
 
-<a id="release-summary-19"></a>
+<a id="release-summary-20"></a>
 ### Release Summary
 
 Maintenance release\.
 
-<a id="bugfixes-12"></a>
+<a id="bugfixes-13"></a>
 ### Bugfixes
 
 * acme\_\* modules \- improve feedback when importing <code>cryptography</code> does not work \([https\://github\.com/ansible\-collections/community\.crypto/issues/518](https\://github\.com/ansible\-collections/community\.crypto/issues/518)\, [https\://github\.com/ansible\-collections/community\.crypto/pull/519](https\://github\.com/ansible\-collections/community\.crypto/pull/519)\)\.
@@ -568,17 +604,17 @@ Maintenance release\.
 <a id="v2-7-0"></a>
 ## v2\.7\.0
 
-<a id="release-summary-20"></a>
+<a id="release-summary-21"></a>
 ### Release Summary
 
 Feature release\.
 
-<a id="minor-changes-10"></a>
+<a id="minor-changes-11"></a>
 ### Minor Changes
 
 * acme\* modules \- also support the HTTP 503 Service Unavailable and 408 Request Timeout response status for automatic retries \([https\://github\.com/ansible\-collections/community\.crypto/pull/513](https\://github\.com/ansible\-collections/community\.crypto/pull/513)\)\.
 
-<a id="bugfixes-13"></a>
+<a id="bugfixes-14"></a>
 ### Bugfixes
 
 * openssl\_privatekey\_pipe \- ensure compatibility with newer versions of ansible\-core \([https\://github\.com/ansible\-collections/community\.crypto/pull/515](https\://github\.com/ansible\-collections/community\.crypto/pull/515)\)\.
@@ -586,12 +622,12 @@ Feature release\.
 <a id="v2-6-0"></a>
 ## v2\.6\.0
 
-<a id="release-summary-21"></a>
+<a id="release-summary-22"></a>
 ### Release Summary
 
 Feature release\.
 
-<a id="minor-changes-11"></a>
+<a id="minor-changes-12"></a>
 ### Minor Changes
 
 * acme\* modules \- support the HTTP 429 Too Many Requests response status \([https\://github\.com/ansible\-collections/community\.crypto/pull/508](https\://github\.com/ansible\-collections/community\.crypto/pull/508)\)\.
@@ -600,12 +636,12 @@ Feature release\.
 <a id="v2-5-0"></a>
 ## v2\.5\.0
 
-<a id="release-summary-22"></a>
+<a id="release-summary-23"></a>
 ### Release Summary
 
 Maintenance release with improved licensing declaration and documentation fixes\.
 
-<a id="minor-changes-12"></a>
+<a id="minor-changes-13"></a>
 ### Minor Changes
 
 * All software licenses are now in the <code>LICENSES/</code> directory of the collection root\. Moreover\, <code>SPDX\-License\-Identifier\:</code> is used to declare the applicable license for every file that is not automatically generated \([https\://github\.com/ansible\-collections/community\.crypto/pull/491](https\://github\.com/ansible\-collections/community\.crypto/pull/491)\)\.
@@ -613,17 +649,17 @@ Maintenance release with improved licensing declaration and documentation fixes\
 <a id="v2-4-0"></a>
 ## v2\.4\.0
 
-<a id="release-summary-23"></a>
+<a id="release-summary-24"></a>
 ### Release Summary
 
 Deprecation and bugfix release\. No new features this time\.
 
-<a id="deprecated-features-3"></a>
+<a id="deprecated-features-4"></a>
 ### Deprecated Features
 
 * Support for Ansible 2\.9 and ansible\-base 2\.10 is deprecated\, and will be removed in the next major release \(community\.crypto 3\.0\.0\)\. Some modules might still work with these versions afterwards\, but we will no longer keep compatibility code that was needed to support them \([https\://github\.com/ansible\-collections/community\.crypto/pull/460](https\://github\.com/ansible\-collections/community\.crypto/pull/460)\)\.
 
-<a id="bugfixes-14"></a>
+<a id="bugfixes-15"></a>
 ### Bugfixes
 
 * openssl\_pkcs12 \- when using the pyOpenSSL backend\, do not crash when trying to read non\-existing other certificates \([https\://github\.com/ansible\-collections/community\.crypto/issues/486](https\://github\.com/ansible\-collections/community\.crypto/issues/486)\, [https\://github\.com/ansible\-collections/community\.crypto/pull/487](https\://github\.com/ansible\-collections/community\.crypto/pull/487)\)\.
@@ -631,7 +667,7 @@ Deprecation and bugfix release\. No new features this time\.
 <a id="v2-3-4"></a>
 ## v2\.3\.4
 
-<a id="release-summary-24"></a>
+<a id="release-summary-25"></a>
 ### Release Summary
 
 Re\-release of what was intended to be 2\.3\.3\.
@@ -647,12 +683,12 @@ has been added\.
 <a id="v2-3-3"></a>
 ## v2\.3\.3
 
-<a id="release-summary-25"></a>
+<a id="release-summary-26"></a>
 ### Release Summary
 
 Bugfix release\.
 
-<a id="bugfixes-15"></a>
+<a id="bugfixes-16"></a>
 ### Bugfixes
 
 * Include <code>Apache\-2\.0\.txt</code> file for <code>plugins/module\_utils/crypto/\_obj2txt\.py</code> and <code>plugins/module\_utils/crypto/\_objects\_data\.py</code>\.
@@ -662,12 +698,12 @@ Bugfix release\.
 <a id="v2-3-2"></a>
 ## v2\.3\.2
 
-<a id="release-summary-26"></a>
+<a id="release-summary-27"></a>
 ### Release Summary
 
 Maintenance and bugfix release\.
 
-<a id="bugfixes-16"></a>
+<a id="bugfixes-17"></a>
 ### Bugfixes
 
 * Include <code>simplified\_bsd\.txt</code> license file for the ECS module utils\.
@@ -676,12 +712,12 @@ Maintenance and bugfix release\.
 <a id="v2-3-1"></a>
 ## v2\.3\.1
 
-<a id="release-summary-27"></a>
+<a id="release-summary-28"></a>
 ### Release Summary
 
 Maintenance release\.
 
-<a id="bugfixes-17"></a>
+<a id="bugfixes-18"></a>
 ### Bugfixes
 
 * Include <code>PSF\-license\.txt</code> file for <code>plugins/module\_utils/\_version\.py</code>\.
@@ -689,12 +725,12 @@ Maintenance release\.
 <a id="v2-3-0"></a>
 ## v2\.3\.0
 
-<a id="release-summary-28"></a>
+<a id="release-summary-29"></a>
 ### Release Summary
 
 Feature and bugfix release\.
 
-<a id="minor-changes-13"></a>
+<a id="minor-changes-14"></a>
 ### Minor Changes
 
 * Prepare collection for inclusion in an Execution Environment by declaring its dependencies\. Please note that system packages are used for cryptography and PyOpenSSL\, which can be rather limited\. If you need features from newer cryptography versions\, you will have to manually force a newer version to be installed by pip by specifying something like <code>cryptography \>\= 37\.0\.0</code> in your Execution Environment\'s Python dependencies file \([https\://github\.com/ansible\-collections/community\.crypto/pull/440](https\://github\.com/ansible\-collections/community\.crypto/pull/440)\)\.
@@ -708,7 +744,7 @@ Feature and bugfix release\.
 * x509\_crl \- add <code>name\_encoding</code> option to control the encoding \(IDNA\, Unicode\) used to return domain names in general names \([https\://github\.com/ansible\-collections/community\.crypto/pull/436](https\://github\.com/ansible\-collections/community\.crypto/pull/436)\)\.
 * x509\_crl\_info \- add <code>name\_encoding</code> option to control the encoding \(IDNA\, Unicode\) used to return domain names in general names \([https\://github\.com/ansible\-collections/community\.crypto/pull/436](https\://github\.com/ansible\-collections/community\.crypto/pull/436)\)\.
 
-<a id="bugfixes-18"></a>
+<a id="bugfixes-19"></a>
 ### Bugfixes
 
 * Make collection more robust when PyOpenSSL is used with an incompatible cryptography version \([https\://github\.com/ansible\-collections/community\.crypto/pull/445](https\://github\.com/ansible\-collections/community\.crypto/pull/445)\)\.
@@ -717,12 +753,12 @@ Feature and bugfix release\.
 <a id="v2-2-4"></a>
 ## v2\.2\.4
 
-<a id="release-summary-29"></a>
+<a id="release-summary-30"></a>
 ### Release Summary
 
 Regular maintenance release\.
 
-<a id="bugfixes-19"></a>
+<a id="bugfixes-20"></a>
 ### Bugfixes
 
 * openssh\_\* modules \- fix exception handling to report traceback to users for enhanced traceability \([https\://github\.com/ansible\-collections/community\.crypto/pull/417](https\://github\.com/ansible\-collections/community\.crypto/pull/417)\)\.
@@ -730,12 +766,12 @@ Regular maintenance release\.
 <a id="v2-2-3"></a>
 ## v2\.2\.3
 
-<a id="release-summary-30"></a>
+<a id="release-summary-31"></a>
 ### Release Summary
 
 Regular bugfix release\.
 
-<a id="bugfixes-20"></a>
+<a id="bugfixes-21"></a>
 ### Bugfixes
 
 * luks\_device \- fix parsing of <code>lsblk</code> output when device name ends with <code>crypt</code> \([https\://github\.com/ansible\-collections/community\.crypto/issues/409](https\://github\.com/ansible\-collections/community\.crypto/issues/409)\, [https\://github\.com/ansible\-collections/community\.crypto/pull/410](https\://github\.com/ansible\-collections/community\.crypto/pull/410)\)\.
@@ -743,14 +779,14 @@ Regular bugfix release\.
 <a id="v2-2-2"></a>
 ## v2\.2\.2
 
-<a id="release-summary-31"></a>
+<a id="release-summary-32"></a>
 ### Release Summary
 
 Regular bugfix release\.
 
 In this release\, we extended the test matrix to include Alpine 3\, ArchLinux\, Debian Bullseye\, and CentOS Stream 8\. CentOS 8 was removed from the test matrix\.
 
-<a id="bugfixes-21"></a>
+<a id="bugfixes-22"></a>
 ### Bugfixes
 
 * certificate\_complete\_chain \- allow multiple potential intermediate certificates to have the same subject \([https\://github\.com/ansible\-collections/community\.crypto/issues/399](https\://github\.com/ansible\-collections/community\.crypto/issues/399)\, [https\://github\.com/ansible\-collections/community\.crypto/pull/403](https\://github\.com/ansible\-collections/community\.crypto/pull/403)\)\.
@@ -762,12 +798,12 @@ In this release\, we extended the test matrix to include Alpine 3\, ArchLinux\,
 <a id="v2-2-1"></a>
 ## v2\.2\.1
 
-<a id="release-summary-32"></a>
+<a id="release-summary-33"></a>
 ### Release Summary
 
 Bugfix release\.
 
-<a id="bugfixes-22"></a>
+<a id="bugfixes-23"></a>
 ### Bugfixes
 
 * openssh\_cert \- fixed false <code>changed</code> status for <code>host</code> certificates when using <code>full\_idempotence</code> \([https\://github\.com/ansible\-collections/community\.crypto/issues/395](https\://github\.com/ansible\-collections/community\.crypto/issues/395)\, [https\://github\.com/ansible\-collections/community\.crypto/pull/396](https\://github\.com/ansible\-collections/community\.crypto/pull/396)\)\.
@@ -775,17 +811,17 @@ Bugfix release\.
 <a id="v2-2-0"></a>
 ## v2\.2\.0
 
-<a id="release-summary-33"></a>
+<a id="release-summary-34"></a>
 ### Release Summary
 
 Regular bugfix and feature release\.
 
-<a id="minor-changes-14"></a>
+<a id="minor-changes-15"></a>
 ### Minor Changes
 
 * openssh\_cert \- added <code>ignore\_timestamps</code> parameter so it can be used semi\-idempotent with relative timestamps in <code>valid\_to</code>/<code>valid\_from</code> \([https\://github\.com/ansible\-collections/community\.crypto/issues/379](https\://github\.com/ansible\-collections/community\.crypto/issues/379)\)\.
 
-<a id="bugfixes-23"></a>
+<a id="bugfixes-24"></a>
 ### Bugfixes
 
 * luks\_devices \- set <code>LANG</code> and similar environment variables to avoid translated output\, which can break some of the module\'s functionality like key management \([https\://github\.com/ansible\-collections/community\.crypto/pull/388](https\://github\.com/ansible\-collections/community\.crypto/pull/388)\, [https\://github\.com/ansible\-collections/community\.crypto/issues/385](https\://github\.com/ansible\-collections/community\.crypto/issues/385)\)\.
@@ -793,24 +829,24 @@ Regular bugfix and feature release\.
 <a id="v2-1-0"></a>
 ## v2\.1\.0
 
-<a id="release-summary-34"></a>
+<a id="release-summary-35"></a>
 ### Release Summary
 
 Feature and bugfix release\.
 
-<a id="minor-changes-15"></a>
+<a id="minor-changes-16"></a>
 ### Minor Changes
 
 * Adjust error messages that indicate <code>cryptography</code> is not installed from <code>Can\'t</code> to <code>Cannot</code> \([https\://github\.com/ansible\-collections/community\.crypto/pull/374](https\://github\.com/ansible\-collections/community\.crypto/pull/374)\)\.
 
-<a id="bugfixes-24"></a>
+<a id="bugfixes-25"></a>
 ### Bugfixes
 
 * Various modules and plugins \- use vendored version of <code>distutils\.version</code> instead of the deprecated Python standard library <code>distutils</code> \([https\://github\.com/ansible\-collections/community\.crypto/pull/353](https\://github\.com/ansible\-collections/community\.crypto/pull/353)\)\.
 * certificate\_complete\_chain \- do not append root twice if the chain already ends with a root certificate \([https\://github\.com/ansible\-collections/community\.crypto/pull/360](https\://github\.com/ansible\-collections/community\.crypto/pull/360)\)\.
 * certificate\_complete\_chain \- do not hang when infinite loop is found \([https\://github\.com/ansible\-collections/community\.crypto/issues/355](https\://github\.com/ansible\-collections/community\.crypto/issues/355)\, [https\://github\.com/ansible\-collections/community\.crypto/pull/360](https\://github\.com/ansible\-collections/community\.crypto/pull/360)\)\.
 
-<a id="new-modules"></a>
+<a id="new-modules-1"></a>
 ### New Modules
 
 * crypto\_info \- Retrieve cryptographic capabilities
@@ -819,7 +855,7 @@ Feature and bugfix release\.
 <a id="v2-0-2"></a>
 ## v2\.0\.2
 
-<a id="release-summary-35"></a>
+<a id="release-summary-36"></a>
 ### Release Summary
 
 Documentation fix release\. No actual code changes\.
@@ -827,17 +863,17 @@ Documentation fix release\. No actual code changes\.
 <a id="v2-0-1"></a>
 ## v2\.0\.1
 
-<a id="release-summary-36"></a>
+<a id="release-summary-37"></a>
 ### Release Summary
 
 Bugfix release with extra forward compatibility for newer versions of cryptography\.
 
-<a id="minor-changes-16"></a>
+<a id="minor-changes-17"></a>
 ### Minor Changes
 
 * acme\_\* modules \- fix usage of <code>fetch\_url</code> with changes in latest ansible\-core <code>devel</code> branch \([https\://github\.com/ansible\-collections/community\.crypto/pull/339](https\://github\.com/ansible\-collections/community\.crypto/pull/339)\)\.
 
-<a id="bugfixes-25"></a>
+<a id="bugfixes-26"></a>
 ### Bugfixes
 
 * acme\_certificate \- avoid passing multiple certificates to <code>cryptography</code>\'s X\.509 certificate loader when <code>fullchain\_dest</code> is used \([https\://github\.com/ansible\-collections/community\.crypto/pull/324](https\://github\.com/ansible\-collections/community\.crypto/pull/324)\)\.
@@ -848,12 +884,12 @@ Bugfix release with extra forward compatibility for newer versions of cryptograp
 <a id="v2-0-0"></a>
 ## v2\.0\.0
 
-<a id="release-summary-37"></a>
+<a id="release-summary-38"></a>
 ### Release Summary
 
 A new major release of the <code>community\.crypto</code> collection\. The main changes are removal of the PyOpenSSL backends for almost all modules \(<code>openssl\_pkcs12</code> being the only exception\)\, and removal of the <code>assertonly</code> provider in the <code>x509\_certificate</code> provider\. There are also some other breaking changes which should improve the user interface/experience of this collection long\-term\.
 
-<a id="minor-changes-17"></a>
+<a id="minor-changes-18"></a>
 ### Minor Changes
 
 * acme\_certificate \- the <code>subject</code> and <code>issuer</code> fields in in the <code>select\_chain</code> entries are now more strictly validated \([https\://github\.com/ansible\-collections/community\.crypto/pull/316](https\://github\.com/ansible\-collections/community\.crypto/pull/316)\)\.
@@ -878,7 +914,7 @@ A new major release of the <code>community\.crypto</code> collection\. The main
 * openssl\_privatekey\_info \- by default consistency checks are not run\; they need to be explicitly requested by passing <code>check\_consistency\=true</code> \([https\://github\.com/ansible\-collections/community\.crypto/pull/309](https\://github\.com/ansible\-collections/community\.crypto/pull/309)\)\.
 * x509\_crl \- for idempotency checks\, the <code>issuer</code> order is ignored\. If order is important\, use the new <code>issuer\_ordered</code> option \([https\://github\.com/ansible\-collections/community\.crypto/pull/316](https\://github\.com/ansible\-collections/community\.crypto/pull/316)\)\.
 
-<a id="deprecated-features-4"></a>
+<a id="deprecated-features-5"></a>
 ### Deprecated Features
 
 * acme\_\* modules \- ACME version 1 is now deprecated and support for it will be removed in community\.crypto 2\.0\.0 \([https\://github\.com/ansible\-collections/community\.crypto/pull/288](https\://github\.com/ansible\-collections/community\.crypto/pull/288)\)\.
@@ -910,7 +946,7 @@ A new major release of the <code>community\.crypto</code> collection\. The main
 * x509\_certificate\_info \- removed the <code>pyopenssl</code> backend \([https\://github\.com/ansible\-collections/community\.crypto/pull/273](https\://github\.com/ansible\-collections/community\.crypto/pull/273)\)\.
 * x509\_certificate\_pipe \- removed the <code>pyopenssl</code> backend \([https\://github\.com/ansible\-collections/community\.crypto/pull/273](https\://github\.com/ansible\-collections/community\.crypto/pull/273)\)\.
 
-<a id="bugfixes-26"></a>
+<a id="bugfixes-27"></a>
 ### Bugfixes
 
 * cryptography backend \- improve Unicode handling for Python 2 \([https\://github\.com/ansible\-collections/community\.crypto/pull/313](https\://github\.com/ansible\-collections/community\.crypto/pull/313)\)\.
@@ -922,12 +958,12 @@ A new major release of the <code>community\.crypto</code> collection\. The main
 <a id="v1-9-4"></a>
 ## v1\.9\.4
 
-<a id="release-summary-38"></a>
+<a id="release-summary-39"></a>
 ### Release Summary
 
 Regular bugfix release\.
 
-<a id="bugfixes-27"></a>
+<a id="bugfixes-28"></a>
 ### Bugfixes
 
 * acme\_\* modules \- fix commands composed for OpenSSL backend to retrieve information on CSRs and certificates from stdin to use <code>/dev/stdin</code> instead of <code>\-</code>\. This is needed for OpenSSL 1\.0\.1 and 1\.0\.2\, apparently \([https\://github\.com/ansible\-collections/community\.crypto/pull/279](https\://github\.com/ansible\-collections/community\.crypto/pull/279)\)\.
@@ -936,12 +972,12 @@ Regular bugfix release\.
 <a id="v1-9-3"></a>
 ## v1\.9\.3
 
-<a id="release-summary-39"></a>
+<a id="release-summary-40"></a>
 ### Release Summary
 
 Regular bugfix release\.
 
-<a id="bugfixes-28"></a>
+<a id="bugfixes-29"></a>
 ### Bugfixes
 
 * openssl\_csr and openssl\_csr\_pipe \- make sure that Unicode strings are used to compare strings with the cryptography backend\. This fixes idempotency problems with non\-ASCII letters on Python 2 \([https\://github\.com/ansible\-collections/community\.crypto/issues/270](https\://github\.com/ansible\-collections/community\.crypto/issues/270)\, [https\://github\.com/ansible\-collections/community\.crypto/pull/271](https\://github\.com/ansible\-collections/community\.crypto/pull/271)\)\.
@@ -949,7 +985,7 @@ Regular bugfix release\.
 <a id="v1-9-2"></a>
 ## v1\.9\.2
 
-<a id="release-summary-40"></a>
+<a id="release-summary-41"></a>
 ### Release Summary
 
 Bugfix release to fix the changelog\. No other change compared to 1\.9\.0\.
@@ -957,7 +993,7 @@ Bugfix release to fix the changelog\. No other change compared to 1\.9\.0\.
 <a id="v1-9-1"></a>
 ## v1\.9\.1
 
-<a id="release-summary-41"></a>
+<a id="release-summary-42"></a>
 ### Release Summary
 
 Accidental 1\.9\.1 release\. Identical to 1\.9\.0\.
@@ -965,18 +1001,18 @@ Accidental 1\.9\.1 release\. Identical to 1\.9\.0\.
 <a id="v1-9-0"></a>
 ## v1\.9\.0
 
-<a id="release-summary-42"></a>
+<a id="release-summary-43"></a>
 ### Release Summary
 
 Regular feature release\.
 
-<a id="minor-changes-18"></a>
+<a id="minor-changes-19"></a>
 ### Minor Changes
 
 * get\_certificate \- added <code>starttls</code> option to retrieve certificates from servers which require clients to request an encrypted connection \([https\://github\.com/ansible\-collections/community\.crypto/pull/264](https\://github\.com/ansible\-collections/community\.crypto/pull/264)\)\.
 * openssh\_keypair \- added <code>diff</code> support \([https\://github\.com/ansible\-collections/community\.crypto/pull/260](https\://github\.com/ansible\-collections/community\.crypto/pull/260)\)\.
 
-<a id="bugfixes-29"></a>
+<a id="bugfixes-30"></a>
 ### Bugfixes
 
 * keypair\_backend module utils \- simplify code to pass sanity tests \([https\://github\.com/ansible\-collections/community\.crypto/pull/263](https\://github\.com/ansible\-collections/community\.crypto/pull/263)\)\.
@@ -987,12 +1023,12 @@ Regular feature release\.
 <a id="v1-8-0"></a>
 ## v1\.8\.0
 
-<a id="release-summary-43"></a>
+<a id="release-summary-44"></a>
 ### Release Summary
 
 Regular bugfix and feature release\.
 
-<a id="minor-changes-19"></a>
+<a id="minor-changes-20"></a>
 ### Minor Changes
 
 * Avoid internal ansible\-core module\_utils in favor of equivalent public API available since at least Ansible 2\.9 \([https\://github\.com/ansible\-collections/community\.crypto/pull/253](https\://github\.com/ansible\-collections/community\.crypto/pull/253)\)\.
@@ -1000,7 +1036,7 @@ Regular bugfix and feature release\.
 * openssh\_cert \- added <code>regenerate</code> option to validate additional certificate parameters which trigger regeneration of an existing certificate \([https\://github\.com/ansible\-collections/community\.crypto/pull/256](https\://github\.com/ansible\-collections/community\.crypto/pull/256)\)\.
 * openssh\_cert \- adding <code>diff</code> support \([https\://github\.com/ansible\-collections/community\.crypto/pull/255](https\://github\.com/ansible\-collections/community\.crypto/pull/255)\)\.
 
-<a id="bugfixes-30"></a>
+<a id="bugfixes-31"></a>
 ### Bugfixes
 
 * openssh\_cert \- fixed certificate generation to restore original certificate if an error is encountered \([https\://github\.com/ansible\-collections/community\.crypto/pull/255](https\://github\.com/ansible\-collections/community\.crypto/pull/255)\)\.
@@ -1009,12 +1045,12 @@ Regular bugfix and feature release\.
 <a id="v1-7-1"></a>
 ## v1\.7\.1
 
-<a id="release-summary-44"></a>
+<a id="release-summary-45"></a>
 ### Release Summary
 
 Bugfix release\.
 
-<a id="bugfixes-31"></a>
+<a id="bugfixes-32"></a>
 ### Bugfixes
 
 * openssl\_pkcs12 \- fix crash when loading passphrase\-protected PKCS\#12 files with <code>cryptography</code> backend \([https\://github\.com/ansible\-collections/community\.crypto/issues/247](https\://github\.com/ansible\-collections/community\.crypto/issues/247)\, [https\://github\.com/ansible\-collections/community\.crypto/pull/248](https\://github\.com/ansible\-collections/community\.crypto/pull/248)\)\.
@@ -1022,12 +1058,12 @@ Bugfix release\.
 <a id="v1-7-0"></a>
 ## v1\.7\.0
 
-<a id="release-summary-45"></a>
+<a id="release-summary-46"></a>
 ### Release Summary
 
 Regular feature and bugfix release\.
 
-<a id="minor-changes-20"></a>
+<a id="minor-changes-21"></a>
 ### Minor Changes
 
 * cryptography\_openssh module utils \- new module\_utils for managing asymmetric keypairs and OpenSSH formatted/encoded asymmetric keypairs \([https\://github\.com/ansible\-collections/community\.crypto/pull/213](https\://github\.com/ansible\-collections/community\.crypto/pull/213)\)\.
@@ -1050,14 +1086,14 @@ Regular feature and bugfix release\.
 * x509\_crl\_info \- add <code>list\_revoked\_certificates</code> option to avoid enumerating all revoked certificates \([https\://github\.com/ansible\-collections/community\.crypto/pull/232](https\://github\.com/ansible\-collections/community\.crypto/pull/232)\)\.
 * x509\_crl\_info \- refactor module to allow code reuse for diff mode \([https\://github\.com/ansible\-collections/community\.crypto/pull/203](https\://github\.com/ansible\-collections/community\.crypto/pull/203)\)\.
 
-<a id="bugfixes-32"></a>
+<a id="bugfixes-33"></a>
 ### Bugfixes
 
 * openssh\_keypair \- fix <code>check\_mode</code> to populate return values for existing keypairs \([https\://github\.com/ansible\-collections/community\.crypto/issues/113](https\://github\.com/ansible\-collections/community\.crypto/issues/113)\, [https\://github\.com/ansible\-collections/community\.crypto/pull/230](https\://github\.com/ansible\-collections/community\.crypto/pull/230)\)\.
 * various modules \- prevent crashes when modules try to set attributes on not yet existing files in check mode\. This will be fixed in ansible\-core 2\.12\, but it is not backported to every Ansible version we support \([https\://github\.com/ansible\-collections/community\.crypto/issue/242](https\://github\.com/ansible\-collections/community\.crypto/issue/242)\, [https\://github\.com/ansible\-collections/community\.crypto/pull/243](https\://github\.com/ansible\-collections/community\.crypto/pull/243)\)\.
 * x509\_certificate \- fix crash when <code>assertonly</code> provider is used and some error conditions should be reported \([https\://github\.com/ansible\-collections/community\.crypto/issues/240](https\://github\.com/ansible\-collections/community\.crypto/issues/240)\, [https\://github\.com/ansible\-collections/community\.crypto/pull/241](https\://github\.com/ansible\-collections/community\.crypto/pull/241)\)\.
 
-<a id="new-modules-1"></a>
+<a id="new-modules-2"></a>
 ### New Modules
 
 * openssl\_publickey\_info \- Provide information for OpenSSL public keys
@@ -1065,12 +1101,12 @@ Regular feature and bugfix release\.
 <a id="v1-6-2"></a>
 ## v1\.6\.2
 
-<a id="release-summary-46"></a>
+<a id="release-summary-47"></a>
 ### Release Summary
 
 Bugfix release\. Fixes compatibility issue of ACME modules with step\-ca\.
 
-<a id="bugfixes-33"></a>
+<a id="bugfixes-34"></a>
 ### Bugfixes
 
 * acme\_\* modules \- avoid crashing for ACME servers where the <code>meta</code> directory key is not present \([https\://github\.com/ansible\-collections/community\.crypto/issues/220](https\://github\.com/ansible\-collections/community\.crypto/issues/220)\, [https\://github\.com/ansible\-collections/community\.crypto/pull/221](https\://github\.com/ansible\-collections/community\.crypto/pull/221)\)\.
@@ -1078,12 +1114,12 @@ Bugfix release\. Fixes compatibility issue of ACME modules with step\-ca\.
 <a id="v1-6-1"></a>
 ## v1\.6\.1
 
-<a id="release-summary-47"></a>
+<a id="release-summary-48"></a>
 ### Release Summary
 
 Bugfix release\.
 
-<a id="bugfixes-34"></a>
+<a id="bugfixes-35"></a>
 ### Bugfixes
 
 * acme\_\* modules \- fix wrong usages of <code>ACMEProtocolException</code> \([https\://github\.com/ansible\-collections/community\.crypto/pull/216](https\://github\.com/ansible\-collections/community\.crypto/pull/216)\, [https\://github\.com/ansible\-collections/community\.crypto/pull/217](https\://github\.com/ansible\-collections/community\.crypto/pull/217)\)\.
@@ -1091,12 +1127,12 @@ Bugfix release\.
 <a id="v1-6-0"></a>
 ## v1\.6\.0
 
-<a id="release-summary-48"></a>
+<a id="release-summary-49"></a>
 ### Release Summary
 
 Fixes compatibility issues with the latest ansible\-core 2\.11 beta\, and contains a lot of internal refactoring for the ACME modules and support for private key passphrases for them\.
 
-<a id="minor-changes-21"></a>
+<a id="minor-changes-22"></a>
 ### Minor Changes
 
 * acme module\_utils \- the <code>acme</code> module\_utils has been split up into several Python modules \([https\://github\.com/ansible\-collections/community\.crypto/pull/184](https\://github\.com/ansible\-collections/community\.crypto/pull/184)\)\.
@@ -1105,12 +1141,12 @@ Fixes compatibility issues with the latest ansible\-core 2\.11 beta\, and contai
 * acme\_certificate\_revoke \- support revoking by private keys that are passphrase protected for <code>cryptography</code> backend \([https\://github\.com/ansible\-collections/community\.crypto/pull/207](https\://github\.com/ansible\-collections/community\.crypto/pull/207)\)\.
 * acme\_challenge\_cert\_helper \- add <code>private\_key\_passphrase</code> parameter \([https\://github\.com/ansible\-collections/community\.crypto/pull/207](https\://github\.com/ansible\-collections/community\.crypto/pull/207)\)\.
 
-<a id="deprecated-features-5"></a>
+<a id="deprecated-features-6"></a>
 ### Deprecated Features
 
 * acme module\_utils \- the <code>acme</code> module\_utils \(<code>ansible\_collections\.community\.crypto\.plugins\.module\_utils\.acme</code>\) is deprecated and will be removed in community\.crypto 2\.0\.0\. Use the new Python modules in the <code>acme</code> package instead \(<code>ansible\_collections\.community\.crypto\.plugins\.module\_utils\.acme\.xxx</code>\) \([https\://github\.com/ansible\-collections/community\.crypto/pull/184](https\://github\.com/ansible\-collections/community\.crypto/pull/184)\)\.
 
-<a id="bugfixes-35"></a>
+<a id="bugfixes-36"></a>
 ### Bugfixes
 
 * action\_module plugin helper \- make compatible with latest changes in ansible\-core 2\.11\.0b3 \([https\://github\.com/ansible\-collections/community\.crypto/pull/202](https\://github\.com/ansible\-collections/community\.crypto/pull/202)\)\.
@@ -1119,23 +1155,23 @@ Fixes compatibility issues with the latest ansible\-core 2\.11 beta\, and contai
 <a id="v1-5-0"></a>
 ## v1\.5\.0
 
-<a id="release-summary-49"></a>
+<a id="release-summary-50"></a>
 ### Release Summary
 
 Regular feature and bugfix release\. Deprecates a return value\.
 
-<a id="minor-changes-22"></a>
+<a id="minor-changes-23"></a>
 ### Minor Changes
 
 * acme\_account\_info \- when <code>retrieve\_orders</code> is not <code>ignore</code> and the ACME server allows to query orders\, the new return value <code>order\_uris</code> is always populated with a list of URIs \([https\://github\.com/ansible\-collections/community\.crypto/pull/178](https\://github\.com/ansible\-collections/community\.crypto/pull/178)\)\.
 * luks\_device \- allow to specify sector size for LUKS2 containers with new <code>sector\_size</code> parameter \([https\://github\.com/ansible\-collections/community\.crypto/pull/193](https\://github\.com/ansible\-collections/community\.crypto/pull/193)\)\.
 
-<a id="deprecated-features-6"></a>
+<a id="deprecated-features-7"></a>
 ### Deprecated Features
 
 * acme\_account\_info \- when <code>retrieve\_orders\=url\_list</code>\, <code>orders</code> will no longer be returned in community\.crypto 2\.0\.0\. Use <code>order\_uris</code> instead \([https\://github\.com/ansible\-collections/community\.crypto/pull/178](https\://github\.com/ansible\-collections/community\.crypto/pull/178)\)\.
 
-<a id="bugfixes-36"></a>
+<a id="bugfixes-37"></a>
 ### Bugfixes
 
 * openssl\_csr \- no longer fails when comparing CSR without basic constraint when <code>basic\_constraints</code> is specified \([https\://github\.com/ansible\-collections/community\.crypto/issues/179](https\://github\.com/ansible\-collections/community\.crypto/issues/179)\, [https\://github\.com/ansible\-collections/community\.crypto/pull/180](https\://github\.com/ansible\-collections/community\.crypto/pull/180)\)\.
@@ -1143,12 +1179,12 @@ Regular feature and bugfix release\. Deprecates a return value\.
 <a id="v1-4-0"></a>
 ## v1\.4\.0
 
-<a id="release-summary-50"></a>
+<a id="release-summary-51"></a>
 ### Release Summary
 
 Release with several new features and bugfixes\.
 
-<a id="minor-changes-23"></a>
+<a id="minor-changes-24"></a>
 ### Minor Changes
 
 * The ACME module\_utils has been relicensed back from the Simplified BSD License \([https\://opensource\.org/licenses/BSD\-2\-Clause](https\://opensource\.org/licenses/BSD\-2\-Clause)\) to the GPLv3\+ \(same license used by most other code in this collection\)\. This undoes a licensing change when the original GPLv3\+ licensed code was moved to module\_utils in [https\://github\.com/ansible/ansible/pull/40697](https\://github\.com/ansible/ansible/pull/40697) \([https\://github\.com/ansible\-collections/community\.crypto/pull/165](https\://github\.com/ansible\-collections/community\.crypto/pull/165)\)\.
@@ -1158,7 +1194,7 @@ Release with several new features and bugfixes\.
 * openssl\_csr\, openssl\_csr\_pipe \- allow to specify CRL distribution endpoints with <code>crl\_distribution\_points</code> \([https\://github\.com/ansible\-collections/community\.crypto/issues/147](https\://github\.com/ansible\-collections/community\.crypto/issues/147)\, [https\://github\.com/ansible\-collections/community\.crypto/pull/167](https\://github\.com/ansible\-collections/community\.crypto/pull/167)\)\.
 * openssl\_pkcs12 \- allow to specify certificate bundles in <code>other\_certificates</code> by using new option <code>other\_certificates\_parse\_all</code> \([https\://github\.com/ansible\-collections/community\.crypto/issues/149](https\://github\.com/ansible\-collections/community\.crypto/issues/149)\, [https\://github\.com/ansible\-collections/community\.crypto/pull/166](https\://github\.com/ansible\-collections/community\.crypto/pull/166)\)\.
 
-<a id="bugfixes-37"></a>
+<a id="bugfixes-38"></a>
 ### Bugfixes
 
 * acme\_certificate \- error when requested challenge type is not found for non\-valid challenges\, instead of hanging on step 2 \([https\://github\.com/ansible\-collections/community\.crypto/issues/171](https\://github\.com/ansible\-collections/community\.crypto/issues/171)\, [https\://github\.com/ansible\-collections/community\.crypto/pull/173](https\://github\.com/ansible\-collections/community\.crypto/pull/173)\)\.
@@ -1166,12 +1202,12 @@ Release with several new features and bugfixes\.
 <a id="v1-3-0"></a>
 ## v1\.3\.0
 
-<a id="release-summary-51"></a>
+<a id="release-summary-52"></a>
 ### Release Summary
 
 Contains new modules <code>openssl\_privatekey\_pipe</code>\, <code>openssl\_csr\_pipe</code> and <code>x509\_certificate\_pipe</code> which allow to create or update private keys\, CSRs and X\.509 certificates without having to write them to disk\.
 
-<a id="minor-changes-24"></a>
+<a id="minor-changes-25"></a>
 ### Minor Changes
 
 * openssh\_cert \- add module parameter <code>use\_agent</code> to enable using signing keys stored in ssh\-agent \([https\://github\.com/ansible\-collections/community\.crypto/issues/116](https\://github\.com/ansible\-collections/community\.crypto/issues/116)\)\.
@@ -1181,14 +1217,14 @@ Contains new modules <code>openssl\_privatekey\_pipe</code>\, <code>openssl\_csr
 * x509\_certificate \- for the <code>selfsigned</code> provider\, a CSR is not required anymore\. If no CSR is provided\, the module behaves as if a minimal CSR which only contains the public key has been provided \([https\://github\.com/ansible\-collections/community\.crypto/issues/32](https\://github\.com/ansible\-collections/community\.crypto/issues/32)\, [https\://github\.com/ansible\-collections/community\.crypto/pull/129](https\://github\.com/ansible\-collections/community\.crypto/pull/129)\)\.
 * x509\_certificate \- refactor module to allow code reuse by x509\_certificate\_pipe \([https\://github\.com/ansible\-collections/community\.crypto/pull/135](https\://github\.com/ansible\-collections/community\.crypto/pull/135)\)\.
 
-<a id="bugfixes-38"></a>
+<a id="bugfixes-39"></a>
 ### Bugfixes
 
 * openssl\_pkcs12 \- report the correct state when <code>action</code> is <code>parse</code> \([https\://github\.com/ansible\-collections/community\.crypto/issues/143](https\://github\.com/ansible\-collections/community\.crypto/issues/143)\)\.
 * support code \- improve handling of certificate and certificate signing request \(CSR\) loading with the <code>cryptography</code> backend when errors occur \([https\://github\.com/ansible\-collections/community\.crypto/issues/138](https\://github\.com/ansible\-collections/community\.crypto/issues/138)\, [https\://github\.com/ansible\-collections/community\.crypto/pull/139](https\://github\.com/ansible\-collections/community\.crypto/pull/139)\)\.
 * x509\_certificate \- fix <code>entrust</code> provider\, which was broken since community\.crypto 0\.1\.0 due to a feature added before the collection move \([https\://github\.com/ansible\-collections/community\.crypto/pull/135](https\://github\.com/ansible\-collections/community\.crypto/pull/135)\)\.
 
-<a id="new-modules-2"></a>
+<a id="new-modules-3"></a>
 ### New Modules
 
 * openssl\_csr\_pipe \- Generate OpenSSL Certificate Signing Request \(CSR\)
@@ -1198,12 +1234,12 @@ Contains new modules <code>openssl\_privatekey\_pipe</code>\, <code>openssl\_csr
 <a id="v1-2-0"></a>
 ## v1\.2\.0
 
-<a id="release-summary-52"></a>
+<a id="release-summary-53"></a>
 ### Release Summary
 
 Please note that this release fixes a security issue \(CVE\-2020\-25646\)\.
 
-<a id="minor-changes-25"></a>
+<a id="minor-changes-26"></a>
 ### Minor Changes
 
 * acme\_certificate \- allow to pass CSR file as content with new option <code>csr\_content</code> \([https\://github\.com/ansible\-collections/community\.crypto/pull/115](https\://github\.com/ansible\-collections/community\.crypto/pull/115)\)\.
@@ -1219,7 +1255,7 @@ Please note that this release fixes a security issue \(CVE\-2020\-25646\)\.
 * x509\_certificate \- the options <code>privatekey\_content</code> and <code>ownca\_privatekey\_content</code> were not marked as <code>no\_log</code>\, resulting in it being dumped into the system log by default\, and returned in the registered results in the <code>invocation</code> field \(CVE\-2020\-25646\, [https\://github\.com/ansible\-collections/community\.crypto/pull/125](https\://github\.com/ansible\-collections/community\.crypto/pull/125)\)\.
 * x509\_crl \- the option <code>privatekey\_content</code> was not marked as <code>no\_log</code>\, resulting in it being dumped into the system log by default\, and returned in the registered results in the <code>invocation</code> field \(CVE\-2020\-25646\, [https\://github\.com/ansible\-collections/community\.crypto/pull/125](https\://github\.com/ansible\-collections/community\.crypto/pull/125)\)\.
 
-<a id="bugfixes-39"></a>
+<a id="bugfixes-40"></a>
 ### Bugfixes
 
 * openssl\_pkcs12 \- do not crash when reading PKCS\#12 file which has no private key and/or no main certificate \([https\://github\.com/ansible\-collections/community\.crypto/issues/103](https\://github\.com/ansible\-collections/community\.crypto/issues/103)\)\.
@@ -1227,12 +1263,12 @@ Please note that this release fixes a security issue \(CVE\-2020\-25646\)\.
 <a id="v1-1-1"></a>
 ## v1\.1\.1
 
-<a id="release-summary-53"></a>
+<a id="release-summary-54"></a>
 ### Release Summary
 
 Bugfixes for Ansible 2\.10\.0\.
 
-<a id="bugfixes-40"></a>
+<a id="bugfixes-41"></a>
 ### Bugfixes
 
 * meta/runtime\.yml \- convert Ansible version numbers for old names of modules to collection version numbers \([https\://github\.com/ansible\-collections/community\.crypto/pull/108](https\://github\.com/ansible\-collections/community\.crypto/pull/108)\)\.
@@ -1241,12 +1277,12 @@ Bugfixes for Ansible 2\.10\.0\.
 <a id="v1-1-0"></a>
 ## v1\.1\.0
 
-<a id="release-summary-54"></a>
+<a id="release-summary-55"></a>
 ### Release Summary
 
 Release for Ansible 2\.10\.0\.
 
-<a id="minor-changes-26"></a>
+<a id="minor-changes-27"></a>
 ### Minor Changes
 
 * acme\_account \- add <code>external\_account\_binding</code> option to allow creation of ACME accounts with External Account Binding \([https\://github\.com/ansible\-collections/community\.crypto/issues/89](https\://github\.com/ansible\-collections/community\.crypto/issues/89)\)\.
@@ -1259,14 +1295,14 @@ Release for Ansible 2\.10\.0\.
 * openssl\_csr \- add support for name constraints extension \([https\://github\.com/ansible\-collections/community\.crypto/issues/46](https\://github\.com/ansible\-collections/community\.crypto/issues/46)\)\.
 * openssl\_csr\_info \- add support for name constraints extension \([https\://github\.com/ansible\-collections/community\.crypto/issues/46](https\://github\.com/ansible\-collections/community\.crypto/issues/46)\)\.
 
-<a id="bugfixes-41"></a>
+<a id="bugfixes-42"></a>
 ### Bugfixes
 
 * acme\_inspect \- fix problem with Python 3\.5 that JSON was not decoded \([https\://github\.com/ansible\-collections/community\.crypto/issues/86](https\://github\.com/ansible\-collections/community\.crypto/issues/86)\)\.
 * get\_certificate \- fix <code>ca\_cert</code> option handling when <code>proxy\_host</code> is used \([https\://github\.com/ansible\-collections/community\.crypto/pull/84](https\://github\.com/ansible\-collections/community\.crypto/pull/84)\)\.
 * openssl\_\*\, x509\_\* modules \- fix handling of general names which refer to IP networks and not IP addresses \([https\://github\.com/ansible\-collections/community\.crypto/pull/92](https\://github\.com/ansible\-collections/community\.crypto/pull/92)\)\.
 
-<a id="new-modules-3"></a>
+<a id="new-modules-4"></a>
 ### New Modules
 
 * openssl\_signature \- Sign data with openssl
@@ -1275,12 +1311,12 @@ Release for Ansible 2\.10\.0\.
 <a id="v1-0-0"></a>
 ## v1\.0\.0
 
-<a id="release-summary-55"></a>
+<a id="release-summary-56"></a>
 ### Release Summary
 
 This is the first proper release of the <code>community\.crypto</code> collection\. This changelog contains all changes to the modules in this collection that were added after the release of Ansible 2\.9\.0\.
 
-<a id="minor-changes-27"></a>
+<a id="minor-changes-28"></a>
 ### Minor Changes
 
 * luks\_device \- accept <code>passphrase</code>\, <code>new\_passphrase</code> and <code>remove\_passphrase</code>\.
@@ -1309,7 +1345,7 @@ This is the first proper release of the <code>community\.crypto</code> collectio
 * openssl\_publickey \- allow to provide private key content via <code>private\_key\_content</code> option\.
 * openssl\_publickey \- allow to return the existing/generated public key directly as <code>publickey</code> by setting <code>return\_content</code> to <code>yes</code>\.
 
-<a id="deprecated-features-7"></a>
+<a id="deprecated-features-8"></a>
 ### Deprecated Features
 
 * openssl\_csr \- all values for the <code>version</code> option except <code>1</code> are deprecated\. The value 1 denotes the current only standardized CSR version\.
@@ -1319,7 +1355,7 @@ This is the first proper release of the <code>community\.crypto</code> collectio
 
 * The <code>letsencrypt</code> module has been removed\. Use <code>acme\_certificate</code> instead\.
 
-<a id="bugfixes-42"></a>
+<a id="bugfixes-43"></a>
 ### Bugfixes
 
 * ACME modules\: fix bug in ACME v1 account update code
@@ -1342,7 +1378,7 @@ This is the first proper release of the <code>community\.crypto</code> collectio
 * openssl\_csr \- the module will now enforce that <code>privatekey\_path</code> is specified when <code>state\=present</code>\.
 * openssl\_publickey \- fix a module crash caused when pyOpenSSL is not installed \([https\://github\.com/ansible/ansible/issues/67035](https\://github\.com/ansible/ansible/issues/67035)\)\.
 
-<a id="new-modules-4"></a>
+<a id="new-modules-5"></a>
 ### New Modules
 
 * ecs\_domain \- Request validation of a domain with the Entrust Certificate Services \(ECS\) API
diff --git a/ansible_collections/community/crypto/CHANGELOG.rst b/ansible_collections/community/crypto/CHANGELOG.rst
index 320169717..b2dca8e3f 100644
--- a/ansible_collections/community/crypto/CHANGELOG.rst
+++ b/ansible_collections/community/crypto/CHANGELOG.rst
@@ -4,6 +4,35 @@ Community Crypto Release Notes
 
 .. contents:: Topics
 
+v2.19.0
+=======
+
+Release Summary
+---------------
+
+Bugfix and feature release.
+
+Minor Changes
+-------------
+
+- When using cryptography >= 42.0.0, use offset-aware ``datetime.datetime`` objects (with timezone UTC) instead of offset-naive UTC timestamps (https://github.com/ansible-collections/community.crypto/issues/726, https://github.com/ansible-collections/community.crypto/pull/727).
+- openssh_cert - avoid UTC functions deprecated in Python 3.12 when using Python 3 (https://github.com/ansible-collections/community.crypto/pull/727).
+
+Deprecated Features
+-------------------
+
+- acme.backends module utils - from community.crypto on, all implementations of ``CryptoBackend`` must override ``get_ordered_csr_identifiers()``. The current default implementation, which simply sorts the result of ``get_csr_identifiers()``, will then be removed (https://github.com/ansible-collections/community.crypto/pull/725).
+
+Bugfixes
+--------
+
+- acme_certificate - respect the order of the CNAME and SAN identifiers that are passed on when creating an ACME order (https://github.com/ansible-collections/community.crypto/issues/723, https://github.com/ansible-collections/community.crypto/pull/725).
+
+New Modules
+-----------
+
+- x509_certificate_convert - Convert X.509 certificates
+
 v2.18.0
 =======
 
diff --git a/ansible_collections/community/crypto/FILES.json b/ansible_collections/community/crypto/FILES.json
index 249caaa96..e98f9499c 100644
--- a/ansible_collections/community/crypto/FILES.json
+++ b/ansible_collections/community/crypto/FILES.json
@@ -109,7 +109,7 @@
    "name": ".azure-pipelines/azure-pipelines.yml",
    "ftype": "file",
    "chksum_type": "sha256",
-   "chksum_sha256": "82056264d02238b30cfe7740554b4dcde7ec173c7a5de5e494f2fad309462455",
+   "chksum_sha256": "6e277188c1cbc0030cb55f73f6ebde233c77c66e2aa0d19476f9b7bae729d345",
    "format": 1
   },
   {
@@ -130,7 +130,7 @@
    "name": ".github/workflows/ansible-test.yml",
    "ftype": "file",
    "chksum_type": "sha256",
-   "chksum_sha256": "aac90c499964bd9233fc13565169248e29e9eda7cf97a2d4db56f6fdba9558ed",
+   "chksum_sha256": "4250c0cd843d1a134c3d806ef9030b55f9a1b949902d1a746ccd19edb9f51a95",
    "format": 1
   },
   {
@@ -165,7 +165,7 @@
    "name": ".github/workflows/reuse.yml",
    "ftype": "file",
    "chksum_type": "sha256",
-   "chksum_sha256": "907950e209820f04e0122e100c86690cf5ac0f4a15cb950cce4d2af6eaaddb37",
+   "chksum_sha256": "5d7f877d94901193f7273865244e67010c8196234debbacf6be5f27ec51f417c",
    "format": 1
   },
   {
@@ -263,7 +263,7 @@
    "name": "changelogs/changelog.yaml",
    "ftype": "file",
    "chksum_type": "sha256",
-   "chksum_sha256": "e03726652f634d6ff4b51599ec42f48c6ff77aaec7d59c186770af2c599b2d3f",
+   "chksum_sha256": "7dcaea3df82e79d7b11bb628e95889ccfb31077902d6ddaee8655a83f577b418",
    "format": 1
   },
   {
@@ -316,6 +316,13 @@
    "format": 1
   },
   {
+   "name": "docs/docsite/config.yml",
+   "ftype": "file",
+   "chksum_type": "sha256",
+   "chksum_sha256": "0c5ec9ff76cf4db33b5d3f771419ef50d448e5d510cb7a98fc07dd9ecee69c4e",
+   "format": 1
+  },
+  {
    "name": "docs/docsite/extra-docs.yml",
    "ftype": "file",
    "chksum_type": "sha256",
@@ -564,21 +571,21 @@
    "name": "plugins/module_utils/acme/backend_cryptography.py",
    "ftype": "file",
    "chksum_type": "sha256",
-   "chksum_sha256": "4b8f578400e6bd0762ba44c0784c6a8e4fc442e436243836ace40317eb936b61",
+   "chksum_sha256": "5bccf4747fa4ef5853858db1683bfa4d31951fc1da78341c36063617eb4b2719",
    "format": 1
   },
   {
    "name": "plugins/module_utils/acme/backend_openssl_cli.py",
    "ftype": "file",
    "chksum_type": "sha256",
-   "chksum_sha256": "5e5e5127e8eb261168dfe60dcd1e1fd63ad1196ca5947a1845c3f7481dcaf431",
+   "chksum_sha256": "7a722bedddbc63e4d6e66b10659f63531c2675e19740ccc3381b70f6ed3fdba4",
    "format": 1
   },
   {
    "name": "plugins/module_utils/acme/backends.py",
    "ftype": "file",
    "chksum_type": "sha256",
-   "chksum_sha256": "cf618865eb9f569e5d775d0539463ce6f7abd3cd593f4528a83f3f1bfb2885e5",
+   "chksum_sha256": "e2c50aaec5b7404e7a8437d34f8246adcb6a7390dff505ce772d04b9a9530177",
    "format": 1
   },
   {
@@ -641,7 +648,7 @@
    "name": "plugins/module_utils/crypto/module_backends/certificate.py",
    "ftype": "file",
    "chksum_type": "sha256",
-   "chksum_sha256": "707b1e0abbd35ffb76d00744ee35b4f5521b7184de04d587f34cc256aa1a7728",
+   "chksum_sha256": "c8858dddd2447413319f622af45c004f3b64eb6038e3e288454b76418d28d0f2",
    "format": 1
   },
   {
@@ -655,28 +662,28 @@
    "name": "plugins/module_utils/crypto/module_backends/certificate_entrust.py",
    "ftype": "file",
    "chksum_type": "sha256",
-   "chksum_sha256": "0046918bf9e870753fb5a24815ada1dcc42077f2ba62e950942f26c36a298b62",
+   "chksum_sha256": "79486afc80b485e4c4c930b59f44c8320e5ece7eb63408bf5f5ac2bc66c3eeed",
    "format": 1
   },
   {
    "name": "plugins/module_utils/crypto/module_backends/certificate_info.py",
    "ftype": "file",
    "chksum_type": "sha256",
-   "chksum_sha256": "20a96ca9b95f652564f49dce0e477a314da3f6cc1e6f51e3ae75992e6f54da5b",
+   "chksum_sha256": "cd9c993f1c224036eba267820de7e21cec8a06a138d943b776541be214f1d14f",
    "format": 1
   },
   {
    "name": "plugins/module_utils/crypto/module_backends/certificate_ownca.py",
    "ftype": "file",
    "chksum_type": "sha256",
-   "chksum_sha256": "8491949f4ed06374834f8ba4cd67edac9bbbeae47247b0e978c92220aaf3cb50",
+   "chksum_sha256": "6c58c55efbdec1869fc10fe63785242aee81f2dc8fff03397de5b75303ed724d",
    "format": 1
   },
   {
    "name": "plugins/module_utils/crypto/module_backends/certificate_selfsigned.py",
    "ftype": "file",
    "chksum_type": "sha256",
-   "chksum_sha256": "c535db42e5267798cb1d12c1329ed3e526ede4afae8dcef10d619e779535ecf6",
+   "chksum_sha256": "d46e3f53d82fe161efdc94f337126f66fcfb8e49647367c08a68ee2232ca6e8c",
    "format": 1
   },
   {
@@ -774,14 +781,14 @@
    "name": "plugins/module_utils/crypto/cryptography_crl.py",
    "ftype": "file",
    "chksum_type": "sha256",
-   "chksum_sha256": "070fbd85edef9007d52574252b31f189dabc6256b828251075d506e6f1186082",
+   "chksum_sha256": "ad9a5bdd95492d516dc390346b968b0191a8901d7682382e978a7f67e681878a",
    "format": 1
   },
   {
    "name": "plugins/module_utils/crypto/cryptography_support.py",
    "ftype": "file",
    "chksum_type": "sha256",
-   "chksum_sha256": "429ae5d529c41a60c0cf15e55b745cbd9adfd569ea315adf693527ba72499451",
+   "chksum_sha256": "3839218fd95217f9fbb44cb01ac33ec87837021d90fe92dac2ac1509a29f5564",
    "format": 1
   },
   {
@@ -802,14 +809,14 @@
    "name": "plugins/module_utils/crypto/pem.py",
    "ftype": "file",
    "chksum_type": "sha256",
-   "chksum_sha256": "9045d933bdb216615500049e5773323f005b2355868f2628c9775cf88e524ae3",
+   "chksum_sha256": "8a37877e3d15f35f92bb5a28698db59b6c8c605f99d89cf42554418378d7738b",
    "format": 1
   },
   {
    "name": "plugins/module_utils/crypto/support.py",
    "ftype": "file",
    "chksum_type": "sha256",
-   "chksum_sha256": "af8b7e736a0383370681a6a9017a9e9f3c9bbcf324c3b6c2bc99e5031bef3183",
+   "chksum_sha256": "7d27f0bf007ccdb80a8d144381545f6406abad02396dbd39def186147a6efa91",
    "format": 1
   },
   {
@@ -872,7 +879,7 @@
    "name": "plugins/module_utils/openssh/certificate.py",
    "ftype": "file",
    "chksum_type": "sha256",
-   "chksum_sha256": "3edc83078c5dee008ccb961123d202b4ea2340772f28137dcef60e945604464c",
+   "chksum_sha256": "2febea40e9db5c2f560a0e399603812f520b575b00cec33bfae2e536962d24c7",
    "format": 1
   },
   {
@@ -942,7 +949,7 @@
    "name": "plugins/modules/acme_certificate.py",
    "ftype": "file",
    "chksum_type": "sha256",
-   "chksum_sha256": "c3f29dfd43f862717692b9ea8a48a186f3bf48f73cbe400ded858aa1286662ac",
+   "chksum_sha256": "5f0f0039f146654c43e4a2a44e7be9becfc9a1d0566e11bef39ad591b472725d",
    "format": 1
   },
   {
@@ -956,7 +963,7 @@
    "name": "plugins/modules/acme_challenge_cert_helper.py",
    "ftype": "file",
    "chksum_type": "sha256",
-   "chksum_sha256": "073bd164227b3dfd709e76288c1d3185474556274257e793e77f7acbd2220904",
+   "chksum_sha256": "8484e4dc9508cffab80145f63ebabf0e88e6d203a3e466f2c000ca3e465596cb",
    "format": 1
   },
   {
@@ -998,7 +1005,7 @@
    "name": "plugins/modules/get_certificate.py",
    "ftype": "file",
    "chksum_type": "sha256",
-   "chksum_sha256": "316e351393face995abc0334f38736f3eb27bd73a9faece5206c061f37122ab0",
+   "chksum_sha256": "3ea3b665adf3bbc3c2dc8e92cf9efd6c7b273aec0c8f1ef29e6414b0a9c50dd9",
    "format": 1
   },
   {
@@ -1121,10 +1128,17 @@
    "format": 1
   },
   {
+   "name": "plugins/modules/x509_certificate_convert.py",
+   "ftype": "file",
+   "chksum_type": "sha256",
+   "chksum_sha256": "b41327e91bb4111c6b9e4293684a2ad6d4cfa566101303ac4b38507a71c18716",
+   "format": 1
+  },
+  {
    "name": "plugins/modules/x509_certificate_info.py",
    "ftype": "file",
    "chksum_type": "sha256",
-   "chksum_sha256": "9cdcd6e9d4d11182ff9bf203c1432b0d96d74f31548f8eb34ae5b7beb48d57fc",
+   "chksum_sha256": "e39c0d16a89cc7cac74d2c81e0406c9e5c1ebe8da0dd9c9c5ef9c26a78d5eae0",
    "format": 1
   },
   {
@@ -1138,7 +1152,7 @@
    "name": "plugins/modules/x509_crl.py",
    "ftype": "file",
    "chksum_type": "sha256",
-   "chksum_sha256": "bc95c541cd09e5d61f437b7c701e3c3370821618a271f98d4746de8480e9084f",
+   "chksum_sha256": "eb2dfed3b7ec2739444923eb22812533901e9f6e7b6f19e127db7d34b3f6c6aa",
    "format": 1
   },
   {
@@ -4579,6 +4593,55 @@
    "format": 1
   },
   {
+   "name": "tests/integration/targets/x509_certificate_convert",
+   "ftype": "dir",
+   "chksum_type": null,
+   "chksum_sha256": null,
+   "format": 1
+  },
+  {
+   "name": "tests/integration/targets/x509_certificate_convert/meta",
+   "ftype": "dir",
+   "chksum_type": null,
+   "chksum_sha256": null,
+   "format": 1
+  },
+  {
+   "name": "tests/integration/targets/x509_certificate_convert/meta/main.yml",
+   "ftype": "file",
+   "chksum_type": "sha256",
+   "chksum_sha256": "e550791b9b9cf709c4dbec99b2fd8603263883e7eab8c8d99805c2aa4bcaa8a2",
+   "format": 1
+  },
+  {
+   "name": "tests/integration/targets/x509_certificate_convert/tasks",
+   "ftype": "dir",
+   "chksum_type": null,
+   "chksum_sha256": null,
+   "format": 1
+  },
+  {
+   "name": "tests/integration/targets/x509_certificate_convert/tasks/impl.yml",
+   "ftype": "file",
+   "chksum_type": "sha256",
+   "chksum_sha256": "c41118537236b6020f57408e488caac150d7f68d5e5c2a1a5b576441d467d710",
+   "format": 1
+  },
+  {
+   "name": "tests/integration/targets/x509_certificate_convert/tasks/main.yml",
+   "ftype": "file",
+   "chksum_type": "sha256",
+   "chksum_sha256": "89871cb736941b87c796ec88bd5bb119dc7adf62b9379ecebd1ae620156f939a",
+   "format": 1
+  },
+  {
+   "name": "tests/integration/targets/x509_certificate_convert/aliases",
+   "ftype": "file",
+   "chksum_type": "sha256",
+   "chksum_sha256": "efd331a62ed0b05469a451ee76dfab1231fee154835999a0cda0473e9bfe30f8",
+   "format": 1
+  },
+  {
    "name": "tests/integration/targets/x509_certificate_info",
    "ftype": "dir",
    "chksum_type": null,
@@ -4848,7 +4911,7 @@
    "name": "tests/sanity/ignore-2.10.txt",
    "ftype": "file",
    "chksum_type": "sha256",
-   "chksum_sha256": "9c564907d4db67b2eab6b7387740cbf6146bb2f236db4eac52fc320fa2e0eefb",
+   "chksum_sha256": "0cfffbe82096f8efdba1b354fad867dd681faac5a4029419261c228ca128c97f",
    "format": 1
   },
   {
@@ -4862,7 +4925,7 @@
    "name": "tests/sanity/ignore-2.11.txt",
    "ftype": "file",
    "chksum_type": "sha256",
-   "chksum_sha256": "1b44914e1e87736a09ebfdabf48dae543323720b6864fb9064052e874d96847d",
+   "chksum_sha256": "409ff4ad0805b8ac9d20d7c7ae2e76f35ac8ed6c14ea124d75f768e4299af964",
    "format": 1
   },
   {
@@ -4876,7 +4939,7 @@
    "name": "tests/sanity/ignore-2.12.txt",
    "ftype": "file",
    "chksum_type": "sha256",
-   "chksum_sha256": "a4c87a60391639fdf51e7be2088785d7d1950580d27cbc348d45c2bad0887a4a",
+   "chksum_sha256": "69653fb8464973ead8ebbdadf67ec37adc5222978de6033fa8c76fe90292fb54",
    "format": 1
   },
   {
@@ -4890,7 +4953,7 @@
    "name": "tests/sanity/ignore-2.13.txt",
    "ftype": "file",
    "chksum_type": "sha256",
-   "chksum_sha256": "38df4b447aa4f0fa4b168df195dff78362f955ed3c4117266c320045be6d00a7",
+   "chksum_sha256": "9d1eec057555e6cfcd9757bead5d91d32069ecdb786eebca25c253e85e5e9f47",
    "format": 1
   },
   {
@@ -4904,7 +4967,7 @@
    "name": "tests/sanity/ignore-2.14.txt",
    "ftype": "file",
    "chksum_type": "sha256",
-   "chksum_sha256": "38df4b447aa4f0fa4b168df195dff78362f955ed3c4117266c320045be6d00a7",
+   "chksum_sha256": "9d1eec057555e6cfcd9757bead5d91d32069ecdb786eebca25c253e85e5e9f47",
    "format": 1
   },
   {
@@ -4957,10 +5020,24 @@
    "format": 1
   },
   {
+   "name": "tests/sanity/ignore-2.18.txt",
+   "ftype": "file",
+   "chksum_type": "sha256",
+   "chksum_sha256": "88f167104e425a472b8fd111b8b2e9d7b2e1135ace2d5130cef81ca38aeba161",
+   "format": 1
+  },
+  {
+   "name": "tests/sanity/ignore-2.18.txt.license",
+   "ftype": "file",
+   "chksum_type": "sha256",
+   "chksum_sha256": "6eb915239f9f35407fa68fdc41ed6522f1fdcce11badbdcd6057548023179ac1",
+   "format": 1
+  },
+  {
    "name": "tests/sanity/ignore-2.9.txt",
    "ftype": "file",
    "chksum_type": "sha256",
-   "chksum_sha256": "dad1b754c46149195a1a26af8e56bb1aa449d4acec41532bfaf45a8254b11050",
+   "chksum_sha256": "0ebc63c03bea984b7363e6e7ac6b1cf2ef1a866637ab8564cbad5061a62dc1e8",
    "format": 1
   },
   {
@@ -5429,7 +5506,7 @@
    "name": "CHANGELOG.md",
    "ftype": "file",
    "chksum_type": "sha256",
-   "chksum_sha256": "5430eaa014f0f010ed69848fea7d36d8dbb9fe9a8d7612887dd52c73389dfef1",
+   "chksum_sha256": "ca2c6e6efdcfdb7ee6ee1b3bbb095989678081d32fa9aca67b65f57e96a37026",
    "format": 1
   },
   {
@@ -5443,7 +5520,7 @@
    "name": "CHANGELOG.rst",
    "ftype": "file",
    "chksum_type": "sha256",
-   "chksum_sha256": "124c1a02abb35f4b3e98c6449bd07d7a606a80e34f297b60be1ed43673955bba",
+   "chksum_sha256": "6ba9093a33e39e50b4a9436cbfdb36c2591a15c0aeadc8e7072b980df760ee6d",
    "format": 1
   },
   {
@@ -5464,7 +5541,7 @@
    "name": "README.md",
    "ftype": "file",
    "chksum_type": "sha256",
-   "chksum_sha256": "dd847490669a8106ad134aa8c1d21e9620891badee9173763ca0643187e7e735",
+   "chksum_sha256": "704b9171377cd1c819ac83f7603438188432dfc6296bb7c6bfa7291c85d3b8b6",
    "format": 1
   }
  ],
diff --git a/ansible_collections/community/crypto/MANIFEST.json b/ansible_collections/community/crypto/MANIFEST.json
index 2e16020a1..40dbbd275 100644
--- a/ansible_collections/community/crypto/MANIFEST.json
+++ b/ansible_collections/community/crypto/MANIFEST.json
@@ -2,7 +2,7 @@
  "collection_info": {
   "namespace": "community",
   "name": "crypto",
-  "version": "2.18.0",
+  "version": "2.19.0",
   "authors": [
    "Ansible (github.com/ansible)"
   ],
@@ -41,7 +41,7 @@
   "name": "FILES.json",
   "ftype": "file",
   "chksum_type": "sha256",
-  "chksum_sha256": "fc4c33abc854162fe45421f98db891d66b0d614f3c5ddfcb8d14f308db7e9df2",
+  "chksum_sha256": "b8a70c677576d6f7bda75b45d97af355a4f371b9269a791bdef8976361b39f75",
   "format": 1
  },
  "format": 1
diff --git a/ansible_collections/community/crypto/README.md b/ansible_collections/community/crypto/README.md
index 64ffd4eae..99c6a4f62 100644
--- a/ansible_collections/community/crypto/README.md
+++ b/ansible_collections/community/crypto/README.md
@@ -18,7 +18,7 @@ Please note that this collection does **not** support Windows targets.
 
 ## Tested with Ansible
 
-Tested with the current Ansible 2.9, ansible-base 2.10, ansible-core 2.11, ansible-core 2.12, ansible-core 2.13, ansible-core 2.14, ansible-core 2.15, and ansible-core-2.16 releases and the current development version of ansible-core. Ansible versions before 2.9.10 are not supported.
+Tested with the current Ansible 2.9, ansible-base 2.10, ansible-core 2.11, ansible-core 2.12, ansible-core 2.13, ansible-core 2.14, ansible-core 2.15, ansible-core 2.16, and ansible-core-2.17 releases and the current development version of ansible-core. Ansible versions before 2.9.10 are not supported.
 
 ## External requirements
 
@@ -54,6 +54,7 @@ If you use the Ansible package and do not update collections independently, use
   - openssl_signature_info module
   - openssl_signature module
   - split_pem filter
+  - x509_certificate_convert module
   - x509_certificate_info module and filter
   - x509_certificate_pipe module
   - x509_certificate module
diff --git a/ansible_collections/community/crypto/changelogs/changelog.yaml b/ansible_collections/community/crypto/changelogs/changelog.yaml
index 044bd81a8..856a965ec 100644
--- a/ansible_collections/community/crypto/changelogs/changelog.yaml
+++ b/ansible_collections/community/crypto/changelogs/changelog.yaml
@@ -1052,6 +1052,33 @@ releases:
         name: to_serial
         namespace: null
     release_date: '2024-02-25'
+  2.19.0:
+    changes:
+      bugfixes:
+      - acme_certificate - respect the order of the CNAME and SAN identifiers that
+        are passed on when creating an ACME order (https://github.com/ansible-collections/community.crypto/issues/723,
+        https://github.com/ansible-collections/community.crypto/pull/725).
+      deprecated_features:
+      - acme.backends module utils - from community.crypto on, all implementations
+        of ``CryptoBackend`` must override ``get_ordered_csr_identifiers()``. The
+        current default implementation, which simply sorts the result of ``get_csr_identifiers()``,
+        will then be removed (https://github.com/ansible-collections/community.crypto/pull/725).
+      minor_changes:
+      - When using cryptography >= 42.0.0, use offset-aware ``datetime.datetime``
+        objects (with timezone UTC) instead of offset-naive UTC timestamps (https://github.com/ansible-collections/community.crypto/issues/726,
+        https://github.com/ansible-collections/community.crypto/pull/727).
+      - openssh_cert - avoid UTC functions deprecated in Python 3.12 when using Python
+        3 (https://github.com/ansible-collections/community.crypto/pull/727).
+      release_summary: Bugfix and feature release.
+    fragments:
+    - 2.19.0.yml
+    - 725-acme_certificate-order.yml
+    - 727-cryptography-utc.yml
+    modules:
+    - description: Convert X.509 certificates
+      name: x509_certificate_convert
+      namespace: ''
+    release_date: '2024-04-20'
   2.2.0:
     changes:
       bugfixes:
diff --git a/ansible_collections/community/crypto/docs/docsite/config.yml b/ansible_collections/community/crypto/docs/docsite/config.yml
new file mode 100644
index 000000000..1d6cf8554
--- /dev/null
+++ b/ansible_collections/community/crypto/docs/docsite/config.yml
@@ -0,0 +1,7 @@
+---
+# Copyright (c) Ansible Project
+# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+changelog:
+  write_changelog: true
diff --git a/ansible_collections/community/crypto/plugins/module_utils/acme/backend_cryptography.py b/ansible_collections/community/crypto/plugins/module_utils/acme/backend_cryptography.py
index 2e388980a..0722c1f99 100644
--- a/ansible_collections/community/crypto/plugins/module_utils/acme/backend_cryptography.py
+++ b/ansible_collections/community/crypto/plugins/module_utils/acme/backend_cryptography.py
@@ -11,7 +11,6 @@ __metaclass__ = type
 
 import base64
 import binascii
-import datetime
 import os
 import traceback
 
@@ -42,11 +41,15 @@ from ansible_collections.community.crypto.plugins.module_utils.crypto.math impor
 )
 
 from ansible_collections.community.crypto.plugins.module_utils.crypto.support import (
+    get_now_datetime,
+    ensure_utc_timezone,
     parse_name_field,
 )
 
 from ansible_collections.community.crypto.plugins.module_utils.crypto.cryptography_support import (
+    CRYPTOGRAPHY_TIMEZONE,
     cryptography_name_to_oid,
+    get_not_valid_after,
 )
 
 from ansible_collections.community.crypto.plugins.module_utils.crypto.pem import (
@@ -298,31 +301,51 @@ class CryptographyBackend(CryptoBackend):
             },
         }
 
-    def get_csr_identifiers(self, csr_filename=None, csr_content=None):
+    def get_ordered_csr_identifiers(self, csr_filename=None, csr_content=None):
         '''
-        Return a set of requested identifiers (CN and SANs) for the CSR.
+        Return a list of requested identifiers (CN and SANs) for the CSR.
         Each identifier is a pair (type, identifier), where type is either
         'dns' or 'ip'.
+
+        The list is deduplicated, and if a CNAME is present, it will be returned
+        as the first element in the result.
         '''
-        identifiers = set([])
         if csr_content is None:
             csr_content = read_file(csr_filename)
         else:
             csr_content = to_bytes(csr_content)
         csr = cryptography.x509.load_pem_x509_csr(csr_content, _cryptography_backend)
+
+        identifiers = set()
+        result = []
+
+        def add_identifier(identifier):
+            if identifier in identifiers:
+                return
+            identifiers.add(identifier)
+            result.append(identifier)
+
         for sub in csr.subject:
             if sub.oid == cryptography.x509.oid.NameOID.COMMON_NAME:
-                identifiers.add(('dns', sub.value))
+                add_identifier(('dns', sub.value))
         for extension in csr.extensions:
             if extension.oid == cryptography.x509.oid.ExtensionOID.SUBJECT_ALTERNATIVE_NAME:
                 for name in extension.value:
                     if isinstance(name, cryptography.x509.DNSName):
-                        identifiers.add(('dns', name.value))
+                        add_identifier(('dns', name.value))
                     elif isinstance(name, cryptography.x509.IPAddress):
-                        identifiers.add(('ip', name.value.compressed))
+                        add_identifier(('ip', name.value.compressed))
                     else:
                         raise BackendException('Found unsupported SAN identifier {0}'.format(name))
-        return identifiers
+        return result
+
+    def get_csr_identifiers(self, csr_filename=None, csr_content=None):
+        '''
+        Return a set of requested identifiers (CN and SANs) for the CSR.
+        Each identifier is a pair (type, identifier), where type is either
+        'dns' or 'ip'.
+        '''
+        return set(self.get_ordered_csr_identifiers(csr_filename=csr_filename, csr_content=csr_content))
 
     def get_cert_days(self, cert_filename=None, cert_content=None, now=None):
         '''
@@ -353,8 +376,10 @@ class CryptographyBackend(CryptoBackend):
             raise BackendException('Cannot parse certificate {0}: {1}'.format(cert_filename, e))
 
         if now is None:
-            now = datetime.datetime.now()
-        return (cert.not_valid_after - now).days
+            now = get_now_datetime(with_timezone=CRYPTOGRAPHY_TIMEZONE)
+        elif CRYPTOGRAPHY_TIMEZONE:
+            now = ensure_utc_timezone(now)
+        return (get_not_valid_after(cert) - now).days
 
     def create_chain_matcher(self, criterium):
         '''
diff --git a/ansible_collections/community/crypto/plugins/module_utils/acme/backend_openssl_cli.py b/ansible_collections/community/crypto/plugins/module_utils/acme/backend_openssl_cli.py
index dabcbdb3b..9a1ed1f5a 100644
--- a/ansible_collections/community/crypto/plugins/module_utils/acme/backend_openssl_cli.py
+++ b/ansible_collections/community/crypto/plugins/module_utils/acme/backend_openssl_cli.py
@@ -225,11 +225,14 @@ class OpenSSLCLIBackend(CryptoBackend):
             # We do not want to error out on something IPAddress() cannot parse
             return ip
 
-    def get_csr_identifiers(self, csr_filename=None, csr_content=None):
+    def get_ordered_csr_identifiers(self, csr_filename=None, csr_content=None):
         '''
-        Return a set of requested identifiers (CN and SANs) for the CSR.
+        Return a list of requested identifiers (CN and SANs) for the CSR.
         Each identifier is a pair (type, identifier), where type is either
         'dns' or 'ip'.
+
+        The list is deduplicated, and if a CNAME is present, it will be returned
+        as the first element in the result.
         '''
         filename = csr_filename
         data = None
@@ -241,24 +244,40 @@ class OpenSSLCLIBackend(CryptoBackend):
         dummy, out, dummy = self.module.run_command(
             openssl_csr_cmd, data=data, check_rc=True, binary_data=True, environ_update=_OPENSSL_ENVIRONMENT_UPDATE)
 
-        identifiers = set([])
+        identifiers = set()
+        result = []
+
+        def add_identifier(identifier):
+            if identifier in identifiers:
+                return
+            identifiers.add(identifier)
+            result.append(identifier)
+
         common_name = re.search(r"Subject:.* CN\s?=\s?([^\s,;/]+)", to_text(out, errors='surrogate_or_strict'))
         if common_name is not None:
-            identifiers.add(('dns', common_name.group(1)))
+            add_identifier(('dns', common_name.group(1)))
         subject_alt_names = re.search(
             r"X509v3 Subject Alternative Name: (?:critical)?\n +([^\n]+)\n",
             to_text(out, errors='surrogate_or_strict'), re.MULTILINE | re.DOTALL)
         if subject_alt_names is not None:
             for san in subject_alt_names.group(1).split(", "):
                 if san.lower().startswith("dns:"):
-                    identifiers.add(('dns', san[4:]))
+                    add_identifier(('dns', san[4:]))
                 elif san.lower().startswith("ip:"):
-                    identifiers.add(('ip', self._normalize_ip(san[3:])))
+                    add_identifier(('ip', self._normalize_ip(san[3:])))
                 elif san.lower().startswith("ip address:"):
-                    identifiers.add(('ip', self._normalize_ip(san[11:])))
+                    add_identifier(('ip', self._normalize_ip(san[11:])))
                 else:
                     raise BackendException('Found unsupported SAN identifier "{0}"'.format(san))
-        return identifiers
+        return result
+
+    def get_csr_identifiers(self, csr_filename=None, csr_content=None):
+        '''
+        Return a set of requested identifiers (CN and SANs) for the CSR.
+        Each identifier is a pair (type, identifier), where type is either
+        'dns' or 'ip'.
+        '''
+        return set(self.get_ordered_csr_identifiers(csr_filename=csr_filename, csr_content=csr_content))
 
     def get_cert_days(self, cert_filename=None, cert_content=None, now=None):
         '''
diff --git a/ansible_collections/community/crypto/plugins/module_utils/acme/backends.py b/ansible_collections/community/crypto/plugins/module_utils/acme/backends.py
index 5c48e1a74..2d95a3ee3 100644
--- a/ansible_collections/community/crypto/plugins/module_utils/acme/backends.py
+++ b/ansible_collections/community/crypto/plugins/module_utils/acme/backends.py
@@ -34,6 +34,23 @@ class CryptoBackend(object):
     def create_mac_key(self, alg, key):
         '''Create a MAC key.'''
 
+    def get_ordered_csr_identifiers(self, csr_filename=None, csr_content=None):
+        '''
+        Return a list of requested identifiers (CN and SANs) for the CSR.
+        Each identifier is a pair (type, identifier), where type is either
+        'dns' or 'ip'.
+
+        The list is deduplicated, and if a CNAME is present, it will be returned
+        as the first element in the result.
+        '''
+        self.module.deprecate(
+            "Every backend must override the get_ordered_csr_identifiers() method."
+            " The default implementation will be removed in 3.0.0 and this method will be marked as `abstractmethod` by then.",
+            version='3.0.0',
+            collection_name='community.crypto',
+        )
+        return sorted(self.get_csr_identifiers(csr_filename=csr_filename, csr_content=csr_content))
+
     @abc.abstractmethod
     def get_csr_identifiers(self, csr_filename=None, csr_content=None):
         '''
diff --git a/ansible_collections/community/crypto/plugins/module_utils/crypto/cryptography_crl.py b/ansible_collections/community/crypto/plugins/module_utils/crypto/cryptography_crl.py
index 62499e08b..8ef0d65da 100644
--- a/ansible_collections/community/crypto/plugins/module_utils/crypto/cryptography_crl.py
+++ b/ansible_collections/community/crypto/plugins/module_utils/crypto/cryptography_crl.py
@@ -19,6 +19,7 @@ from .basic import (
 )
 
 from .cryptography_support import (
+    CRYPTOGRAPHY_TIMEZONE,
     cryptography_decode_name,
 )
 
@@ -27,6 +28,11 @@ from ._obj2txt import (
 )
 
 
+# TODO: once cryptography has a _utc variant of InvalidityDate.invalidity_date, set this
+#       to True and adjust get_invalidity_date() accordingly.
+#       (https://github.com/pyca/cryptography/issues/10818)
+CRYPTOGRAPHY_TIMEZONE_INVALIDITY_DATE = False
+
 TIMESTAMP_FORMAT = "%Y%m%d%H%M%SZ"
 
 
@@ -55,7 +61,7 @@ else:
 def cryptography_decode_revoked_certificate(cert):
     result = {
         'serial_number': cert.serial_number,
-        'revocation_date': cert.revocation_date,
+        'revocation_date': get_revocation_date(cert),
         'issuer': None,
         'issuer_critical': False,
         'reason': None,
@@ -77,7 +83,7 @@ def cryptography_decode_revoked_certificate(cert):
         pass
     try:
         ext = cert.extensions.get_extension_for_class(x509.InvalidityDate)
-        result['invalidity_date'] = ext.value.invalidity_date
+        result['invalidity_date'] = get_invalidity_date(ext.value)
         result['invalidity_date_critical'] = ext.critical
     except x509.ExtensionNotFound:
         pass
@@ -112,3 +118,38 @@ def cryptography_get_signature_algorithm_oid_from_crl(crl):
             crl._x509_crl.sig_alg.algorithm
         )
         return x509.oid.ObjectIdentifier(dotted)
+
+
+def get_next_update(obj):
+    if CRYPTOGRAPHY_TIMEZONE:
+        return obj.next_update_utc
+    return obj.next_update
+
+
+def get_last_update(obj):
+    if CRYPTOGRAPHY_TIMEZONE:
+        return obj.last_update_utc
+    return obj.last_update
+
+
+def get_revocation_date(obj):
+    if CRYPTOGRAPHY_TIMEZONE:
+        return obj.revocation_date_utc
+    return obj.revocation_date
+
+
+def get_invalidity_date(obj):
+    # TODO: special handling if CRYPTOGRAPHY_TIMEZONE_INVALIDITY_DATE is True
+    return obj.invalidity_date
+
+
+def set_next_update(builder, value):
+    return builder.next_update(value)
+
+
+def set_last_update(builder, value):
+    return builder.last_update(value)
+
+
+def set_revocation_date(builder, value):
+    return builder.revocation_date(value)
diff --git a/ansible_collections/community/crypto/plugins/module_utils/crypto/cryptography_support.py b/ansible_collections/community/crypto/plugins/module_utils/crypto/cryptography_support.py
index b767d3417..3d07b35b1 100644
--- a/ansible_collections/community/crypto/plugins/module_utils/crypto/cryptography_support.py
+++ b/ansible_collections/community/crypto/plugins/module_utils/crypto/cryptography_support.py
@@ -29,7 +29,9 @@ try:
     from cryptography.hazmat.primitives import serialization
     from cryptography.hazmat.primitives.asymmetric import padding
     import ipaddress
+    _HAS_CRYPTOGRAPHY = True
 except ImportError:
+    _HAS_CRYPTOGRAPHY = False
     # Error handled in the calling module.
     pass
 
@@ -106,6 +108,11 @@ from ._objects import (
 from ._obj2txt import obj2txt
 
 
+CRYPTOGRAPHY_TIMEZONE = False
+if _HAS_CRYPTOGRAPHY:
+    CRYPTOGRAPHY_TIMEZONE = LooseVersion(cryptography.__version__) >= LooseVersion('42.0.0')
+
+
 DOTTED_OID = re.compile(r'^\d+(?:\.\d+)+$')
 
 
@@ -807,3 +814,23 @@ def cryptography_verify_certificate_signature(certificate, signer_public_key):
         certificate.signature_hash_algorithm,
         signer_public_key
     )
+
+
+def get_not_valid_after(obj):
+    if CRYPTOGRAPHY_TIMEZONE:
+        return obj.not_valid_after_utc
+    return obj.not_valid_after
+
+
+def get_not_valid_before(obj):
+    if CRYPTOGRAPHY_TIMEZONE:
+        return obj.not_valid_before_utc
+    return obj.not_valid_before
+
+
+def set_not_valid_after(builder, value):
+    return builder.not_valid_after(value)
+
+
+def set_not_valid_before(builder, value):
+    return builder.not_valid_before(value)
diff --git a/ansible_collections/community/crypto/plugins/module_utils/crypto/module_backends/certificate.py b/ansible_collections/community/crypto/plugins/module_utils/crypto/module_backends/certificate.py
index 7a56d7e9d..7bc93d934 100644
--- a/ansible_collections/community/crypto/plugins/module_utils/crypto/module_backends/certificate.py
+++ b/ansible_collections/community/crypto/plugins/module_utils/crypto/module_backends/certificate.py
@@ -32,6 +32,8 @@ from ansible_collections.community.crypto.plugins.module_utils.crypto.support im
 
 from ansible_collections.community.crypto.plugins.module_utils.crypto.cryptography_support import (
     cryptography_compare_public_keys,
+    get_not_valid_after,
+    get_not_valid_before,
 )
 
 from ansible_collections.community.crypto.plugins.module_utils.crypto.module_backends.certificate_info import (
@@ -251,12 +253,12 @@ class CertificateBackend(object):
 
         # Check not before
         if not_before is not None and not self.ignore_timestamps:
-            if self.existing_certificate.not_valid_before != not_before:
+            if get_not_valid_before(self.existing_certificate) != not_before:
                 return True
 
         # Check not after
         if not_after is not None and not self.ignore_timestamps:
-            if self.existing_certificate.not_valid_after != not_after:
+            if get_not_valid_after(self.existing_certificate) != not_after:
                 return True
         return False
 
diff --git a/ansible_collections/community/crypto/plugins/module_utils/crypto/module_backends/certificate_entrust.py b/ansible_collections/community/crypto/plugins/module_utils/crypto/module_backends/certificate_entrust.py
index baf53f5de..7dc4641e1 100644
--- a/ansible_collections/community/crypto/plugins/module_utils/crypto/module_backends/certificate_entrust.py
+++ b/ansible_collections/community/crypto/plugins/module_utils/crypto/module_backends/certificate_entrust.py
@@ -10,7 +10,6 @@ __metaclass__ = type
 
 
 import datetime
-import time
 import os
 
 from ansible.module_utils.common.text.converters import to_native, to_bytes
@@ -19,11 +18,14 @@ from ansible_collections.community.crypto.plugins.module_utils.ecs.api import EC
 
 from ansible_collections.community.crypto.plugins.module_utils.crypto.support import (
     load_certificate,
+    get_now_datetime,
     get_relative_time_option,
 )
 
 from ansible_collections.community.crypto.plugins.module_utils.crypto.cryptography_support import (
+    CRYPTOGRAPHY_TIMEZONE,
     cryptography_serial_number_of_cert,
+    get_not_valid_after,
 )
 
 from ansible_collections.community.crypto.plugins.module_utils.crypto.module_backends.certificate import (
@@ -99,7 +101,7 @@ class EntrustCertificateBackend(CertificateBackend):
         # Handle expiration (30 days if not specified)
         expiry = self.notAfter
         if not expiry:
-            gmt_now = datetime.datetime.fromtimestamp(time.mktime(time.gmtime()))
+            gmt_now = get_now_datetime(with_timezone=CRYPTOGRAPHY_TIMEZONE)
             expiry = gmt_now + datetime.timedelta(days=365)
 
         expiry_iso3339 = expiry.strftime("%Y-%m-%dT%H:%M:%S.00Z")
@@ -154,7 +156,7 @@ class EntrustCertificateBackend(CertificateBackend):
             expiry = None
             if self.backend == 'cryptography':
                 serial_number = "{0:X}".format(cryptography_serial_number_of_cert(self.existing_certificate))
-                expiry = self.existing_certificate.not_valid_after
+                expiry = get_not_valid_after(self.existing_certificate)
 
             # get some information about the expiry of this certificate
             expiry_iso3339 = expiry.strftime("%Y-%m-%dT%H:%M:%S.00Z")
diff --git a/ansible_collections/community/crypto/plugins/module_utils/crypto/module_backends/certificate_info.py b/ansible_collections/community/crypto/plugins/module_utils/crypto/module_backends/certificate_info.py
index b10733ceb..5db6c3586 100644
--- a/ansible_collections/community/crypto/plugins/module_utils/crypto/module_backends/certificate_info.py
+++ b/ansible_collections/community/crypto/plugins/module_utils/crypto/module_backends/certificate_info.py
@@ -12,7 +12,6 @@ __metaclass__ = type
 
 import abc
 import binascii
-import datetime
 import traceback
 
 from ansible.module_utils import six
@@ -24,13 +23,17 @@ from ansible_collections.community.crypto.plugins.module_utils.version import Lo
 from ansible_collections.community.crypto.plugins.module_utils.crypto.support import (
     load_certificate,
     get_fingerprint_of_bytes,
+    get_now_datetime,
 )
 
 from ansible_collections.community.crypto.plugins.module_utils.crypto.cryptography_support import (
+    CRYPTOGRAPHY_TIMEZONE,
     cryptography_decode_name,
     cryptography_get_extensions_from_cert,
     cryptography_oid_to_name,
     cryptography_serial_number_of_cert,
+    get_not_valid_after,
+    get_not_valid_before,
 )
 
 from ansible_collections.community.crypto.plugins.module_utils.crypto.module_backends.publickey_info import (
@@ -169,7 +172,7 @@ class CertificateInfoRetrieval(object):
         not_after = self.get_not_after()
         result['not_before'] = not_before.strftime(TIMESTAMP_FORMAT)
         result['not_after'] = not_after.strftime(TIMESTAMP_FORMAT)
-        result['expired'] = not_after < datetime.datetime.utcnow()
+        result['expired'] = not_after < get_now_datetime(with_timezone=CRYPTOGRAPHY_TIMEZONE)
 
         result['public_key'] = to_native(self._get_public_key_pem())
 
@@ -322,10 +325,10 @@ class CertificateInfoRetrievalCryptography(CertificateInfoRetrieval):
             return None, False
 
     def get_not_before(self):
-        return self.cert.not_valid_before
+        return get_not_valid_before(self.cert)
 
     def get_not_after(self):
-        return self.cert.not_valid_after
+        return get_not_valid_after(self.cert)
 
     def _get_public_key_pem(self):
         return self.cert.public_key().public_bytes(
diff --git a/ansible_collections/community/crypto/plugins/module_utils/crypto/module_backends/certificate_ownca.py b/ansible_collections/community/crypto/plugins/module_utils/crypto/module_backends/certificate_ownca.py
index ac1cf845a..4d312e6b7 100644
--- a/ansible_collections/community/crypto/plugins/module_utils/crypto/module_backends/certificate_ownca.py
+++ b/ansible_collections/community/crypto/plugins/module_utils/crypto/module_backends/certificate_ownca.py
@@ -31,6 +31,10 @@ from ansible_collections.community.crypto.plugins.module_utils.crypto.cryptograp
     cryptography_key_needs_digest_for_signing,
     cryptography_serial_number_of_cert,
     cryptography_verify_certificate_signature,
+    get_not_valid_after,
+    get_not_valid_before,
+    set_not_valid_after,
+    set_not_valid_before,
 )
 
 from ansible_collections.community.crypto.plugins.module_utils.crypto.module_backends.certificate import (
@@ -120,8 +124,8 @@ class OwnCACertificateBackendCryptography(CertificateBackend):
         cert_builder = cert_builder.subject_name(self.csr.subject)
         cert_builder = cert_builder.issuer_name(self.ca_cert.subject)
         cert_builder = cert_builder.serial_number(self.serial_number)
-        cert_builder = cert_builder.not_valid_before(self.notBefore)
-        cert_builder = cert_builder.not_valid_after(self.notAfter)
+        cert_builder = set_not_valid_before(cert_builder, self.notBefore)
+        cert_builder = set_not_valid_after(cert_builder, self.notAfter)
         cert_builder = cert_builder.public_key(self.csr.public_key())
         has_ski = False
         for extension in self.csr.extensions:
@@ -220,8 +224,8 @@ class OwnCACertificateBackendCryptography(CertificateBackend):
             if self.cert is None:
                 self.cert = self.existing_certificate
             result.update({
-                'notBefore': self.cert.not_valid_before.strftime("%Y%m%d%H%M%SZ"),
-                'notAfter': self.cert.not_valid_after.strftime("%Y%m%d%H%M%SZ"),
+                'notBefore': get_not_valid_before(self.cert).strftime("%Y%m%d%H%M%SZ"),
+                'notAfter': get_not_valid_after(self.cert).strftime("%Y%m%d%H%M%SZ"),
                 'serial_number': cryptography_serial_number_of_cert(self.cert),
             })
 
diff --git a/ansible_collections/community/crypto/plugins/module_utils/crypto/module_backends/certificate_selfsigned.py b/ansible_collections/community/crypto/plugins/module_utils/crypto/module_backends/certificate_selfsigned.py
index 8695d43ee..edd8d8d77 100644
--- a/ansible_collections/community/crypto/plugins/module_utils/crypto/module_backends/certificate_selfsigned.py
+++ b/ansible_collections/community/crypto/plugins/module_utils/crypto/module_backends/certificate_selfsigned.py
@@ -22,6 +22,10 @@ from ansible_collections.community.crypto.plugins.module_utils.crypto.cryptograp
     cryptography_key_needs_digest_for_signing,
     cryptography_serial_number_of_cert,
     cryptography_verify_certificate_signature,
+    get_not_valid_after,
+    get_not_valid_before,
+    set_not_valid_after,
+    set_not_valid_before,
 )
 
 from ansible_collections.community.crypto.plugins.module_utils.crypto.module_backends.certificate import (
@@ -95,8 +99,8 @@ class SelfSignedCertificateBackendCryptography(CertificateBackend):
             cert_builder = cert_builder.subject_name(self.csr.subject)
             cert_builder = cert_builder.issuer_name(self.csr.subject)
             cert_builder = cert_builder.serial_number(self.serial_number)
-            cert_builder = cert_builder.not_valid_before(self.notBefore)
-            cert_builder = cert_builder.not_valid_after(self.notAfter)
+            cert_builder = set_not_valid_before(cert_builder, self.notBefore)
+            cert_builder = set_not_valid_after(cert_builder, self.notAfter)
             cert_builder = cert_builder.public_key(self.privatekey.public_key())
             has_ski = False
             for extension in self.csr.extensions:
@@ -154,8 +158,8 @@ class SelfSignedCertificateBackendCryptography(CertificateBackend):
             if self.cert is None:
                 self.cert = self.existing_certificate
             result.update({
-                'notBefore': self.cert.not_valid_before.strftime("%Y%m%d%H%M%SZ"),
-                'notAfter': self.cert.not_valid_after.strftime("%Y%m%d%H%M%SZ"),
+                'notBefore': get_not_valid_before(self.cert).strftime("%Y%m%d%H%M%SZ"),
+                'notAfter': get_not_valid_after(self.cert).strftime("%Y%m%d%H%M%SZ"),
                 'serial_number': cryptography_serial_number_of_cert(self.cert),
             })
 
diff --git a/ansible_collections/community/crypto/plugins/module_utils/crypto/pem.py b/ansible_collections/community/crypto/plugins/module_utils/crypto/pem.py
index da46548c7..5e6571fe0 100644
--- a/ansible_collections/community/crypto/plugins/module_utils/crypto/pem.py
+++ b/ansible_collections/community/crypto/plugins/module_utils/crypto/pem.py
@@ -9,6 +9,7 @@ __metaclass__ = type
 
 
 PEM_START = '-----BEGIN '
+PEM_END_START = '-----END '
 PEM_END = '-----'
 PKCS8_PRIVATEKEY_NAMES = ('PRIVATE KEY', 'ENCRYPTED PRIVATE KEY')
 PKCS1_PRIVATEKEY_SUFFIX = ' PRIVATE KEY'
@@ -77,3 +78,31 @@ def extract_first_pem(text):
     if not all_pems:
         return None
     return all_pems[0]
+
+
+def _extract_type(line, start=PEM_START):
+    if not line.startswith(start):
+        return None
+    if not line.endswith(PEM_END):
+        return None
+    return line[len(start):-len(PEM_END)]
+
+
+def extract_pem(content, strict=False):
+    lines = content.splitlines()
+    if len(lines) < 3:
+        raise ValueError('PEM must have at least 3 lines, have only {count}'.format(count=len(lines)))
+    header_type = _extract_type(lines[0])
+    if header_type is None:
+        raise ValueError('First line is not of format {start}...{end}: {line!r}'.format(start=PEM_START, end=PEM_END, line=lines[0]))
+    footer_type = _extract_type(lines[-1], start=PEM_END_START)
+    if strict:
+        if header_type != footer_type:
+            raise ValueError('Header type ({header}) is different from footer type ({footer})'.format(header=header_type, footer=footer_type))
+        for idx, line in enumerate(lines[1:-2]):
+            if len(line) != 64:
+                raise ValueError('Line {idx} has length {len} instead of 64'.format(idx=idx, len=len(line)))
+        if not (0 < len(lines[-2]) <= 64):
+            raise ValueError('Last line has length {len}, should be in (0, 64]'.format(len=len(lines[-2])))
+    content = lines[1:-1]
+    return header_type, ''.join(content)
diff --git a/ansible_collections/community/crypto/plugins/module_utils/crypto/support.py b/ansible_collections/community/crypto/plugins/module_utils/crypto/support.py
index 473246b1b..8b59a3b70 100644
--- a/ansible_collections/community/crypto/plugins/module_utils/crypto/support.py
+++ b/ansible_collections/community/crypto/plugins/module_utils/crypto/support.py
@@ -279,7 +279,19 @@ def parse_ordered_name_field(input_list, name_field_name):
     return result
 
 
-def convert_relative_to_datetime(relative_time_string):
+def get_now_datetime(with_timezone):
+    if with_timezone:
+        return datetime.datetime.now(tz=datetime.timezone.utc)
+    return datetime.datetime.utcnow()
+
+
+def ensure_utc_timezone(timestamp):
+    if timestamp.tzinfo is not None:
+        return timestamp
+    return timestamp.astimezone(datetime.timezone.utc)
+
+
+def convert_relative_to_datetime(relative_time_string, with_timezone=False):
     """Get a datetime.datetime or None from a string in the time format described in sshd_config(5)"""
 
     parsed_result = re.match(
@@ -304,13 +316,14 @@ def convert_relative_to_datetime(relative_time_string):
         offset += datetime.timedelta(
             seconds=int(parsed_result.group("seconds")))
 
+    now = get_now_datetime(with_timezone=with_timezone)
     if parsed_result.group("prefix") == "+":
-        return datetime.datetime.utcnow() + offset
+        return now + offset
     else:
-        return datetime.datetime.utcnow() - offset
+        return now - offset
 
 
-def get_relative_time_option(input_string, input_name, backend='cryptography'):
+def get_relative_time_option(input_string, input_name, backend='cryptography', with_timezone=False):
     """Return an absolute timespec if a relative timespec or an ASN1 formatted
        string is provided.
 
@@ -323,7 +336,7 @@ def get_relative_time_option(input_string, input_name, backend='cryptography'):
             input_string, input_name)
     # Relative time
     if result.startswith("+") or result.startswith("-"):
-        result_datetime = convert_relative_to_datetime(result)
+        result_datetime = convert_relative_to_datetime(result, with_timezone=with_timezone)
         if backend == 'pyopenssl':
             return result_datetime.strftime("%Y%m%d%H%M%SZ")
         elif backend == 'cryptography':
@@ -332,9 +345,13 @@ def get_relative_time_option(input_string, input_name, backend='cryptography'):
     if backend == 'cryptography':
         for date_fmt in ['%Y%m%d%H%M%SZ', '%Y%m%d%H%MZ', '%Y%m%d%H%M%S%z', '%Y%m%d%H%M%z']:
             try:
-                return datetime.datetime.strptime(result, date_fmt)
+                res = datetime.datetime.strptime(result, date_fmt)
             except ValueError:
                 pass
+            else:
+                if with_timezone:
+                    res = res.astimezone(datetime.timezone.utc)
+                return res
 
         raise OpenSSLObjectError(
             'The time spec "%s" for %s is invalid' %
diff --git a/ansible_collections/community/crypto/plugins/module_utils/openssh/certificate.py b/ansible_collections/community/crypto/plugins/module_utils/openssh/certificate.py
index 54d1b1ec5..f59766651 100644
--- a/ansible_collections/community/crypto/plugins/module_utils/openssh/certificate.py
+++ b/ansible_collections/community/crypto/plugins/module_utils/openssh/certificate.py
@@ -22,7 +22,9 @@ __metaclass__ = type
 
 import abc
 import binascii
+import datetime as _datetime
 import os
+import sys
 from base64 import b64encode
 from datetime import datetime
 from hashlib import sha256
@@ -61,8 +63,17 @@ _ECDSA_CURVE_IDENTIFIERS_LOOKUP = {
     b'nistp521': 'ecdsa-nistp521',
 }
 
-_ALWAYS = datetime(1970, 1, 1)
-_FOREVER = datetime.max
+_USE_TIMEZONE = sys.version_info >= (3, 6)
+
+
+def _ensure_utc_timezone_if_use_timezone(value):
+    if not _USE_TIMEZONE or value.tzinfo is not None:
+        return value
+    return value.astimezone(_datetime.timezone.utc)
+
+
+_ALWAYS = _ensure_utc_timezone_if_use_timezone(datetime(1970, 1, 1))
+_FOREVER = datetime(9999, 12, 31, 23, 59, 59, 999999, _datetime.timezone.utc) if _USE_TIMEZONE else datetime.max
 
 _CRITICAL_OPTIONS = (
     'force-command',
@@ -136,7 +147,7 @@ class OpensshCertificateTimeParameters(object):
             elif dt == _FOREVER:
                 result = 'forever'
             else:
-                result = dt.isoformat() if date_format == 'human_readable' else dt.strftime("%Y%m%d%H%M%S")
+                result = dt.isoformat().replace('+00:00', '') if date_format == 'human_readable' else dt.strftime("%Y%m%d%H%M%S")
         elif date_format == 'timestamp':
             td = dt - _ALWAYS
             result = int((td.microseconds + (td.seconds + td.days * 24 * 3600) * 10 ** 6) / 10 ** 6)
@@ -167,7 +178,10 @@ class OpensshCertificateTimeParameters(object):
             result = _FOREVER
         else:
             try:
-                result = datetime.utcfromtimestamp(timestamp)
+                if _USE_TIMEZONE:
+                    result = datetime.fromtimestamp(timestamp, tz=_datetime.timezone.utc)
+                else:
+                    result = datetime.utcfromtimestamp(timestamp)
             except OverflowError as e:
                 raise ValueError
         return result
@@ -180,11 +194,11 @@ class OpensshCertificateTimeParameters(object):
         elif time_string == 'forever':
             result = _FOREVER
         elif is_relative_time_string(time_string):
-            result = convert_relative_to_datetime(time_string)
+            result = convert_relative_to_datetime(time_string, with_timezone=_USE_TIMEZONE)
         else:
             for time_format in ("%Y-%m-%d", "%Y-%m-%d %H:%M:%S", "%Y-%m-%dT%H:%M:%S"):
                 try:
-                    result = datetime.strptime(time_string, time_format)
+                    result = _ensure_utc_timezone_if_use_timezone(datetime.strptime(time_string, time_format))
                 except ValueError:
                     pass
             if result is None:
diff --git a/ansible_collections/community/crypto/plugins/modules/acme_certificate.py b/ansible_collections/community/crypto/plugins/modules/acme_certificate.py
index 9c0b349c4..21a6d6ae9 100644
--- a/ansible_collections/community/crypto/plugins/modules/acme_certificate.py
+++ b/ansible_collections/community/crypto/plugins/modules/acme_certificate.py
@@ -661,7 +661,7 @@ class ACMECertificateClient(object):
             raise ModuleFailException("CSR %s not found" % (self.csr))
 
         # Extract list of identifiers from CSR
-        self.identifiers = self.client.backend.get_csr_identifiers(csr_filename=self.csr, csr_content=self.csr_content)
+        self.identifiers = self.client.backend.get_ordered_csr_identifiers(csr_filename=self.csr, csr_content=self.csr_content)
 
     def is_first_step(self):
         '''
diff --git a/ansible_collections/community/crypto/plugins/modules/acme_challenge_cert_helper.py b/ansible_collections/community/crypto/plugins/modules/acme_challenge_cert_helper.py
index 9740cd16d..48b65f998 100644
--- a/ansible_collections/community/crypto/plugins/modules/acme_challenge_cert_helper.py
+++ b/ansible_collections/community/crypto/plugins/modules/acme_challenge_cert_helper.py
@@ -165,6 +165,16 @@ from ansible_collections.community.crypto.plugins.module_utils.acme.io import (
     read_file,
 )
 
+from ansible_collections.community.crypto.plugins.module_utils.crypto.support import (
+    get_now_datetime,
+)
+
+from ansible_collections.community.crypto.plugins.module_utils.crypto.cryptography_support import (
+    CRYPTOGRAPHY_TIMEZONE,
+    set_not_valid_after,
+    set_not_valid_before,
+)
+
 CRYPTOGRAPHY_IMP_ERR = None
 try:
     import cryptography
@@ -244,8 +254,9 @@ def main():
         domain = to_text(challenge_data['resource'])
         identifier_type, identifier = to_text(challenge_data.get('resource_original', 'dns:' + challenge_data['resource'])).split(':', 1)
         subject = issuer = cryptography.x509.Name([])
-        not_valid_before = datetime.datetime.utcnow()
-        not_valid_after = datetime.datetime.utcnow() + datetime.timedelta(days=10)
+        now = get_now_datetime(with_timezone=CRYPTOGRAPHY_TIMEZONE)
+        not_valid_before = now
+        not_valid_after = now + datetime.timedelta(days=10)
         if identifier_type == 'dns':
             san = cryptography.x509.DNSName(identifier)
         elif identifier_type == 'ip':
@@ -254,7 +265,7 @@ def main():
             raise ModuleFailException('Unsupported identifier type "{0}"'.format(identifier_type))
 
         # Generate regular self-signed certificate
-        regular_certificate = cryptography.x509.CertificateBuilder().subject_name(
+        cert_builder = cryptography.x509.CertificateBuilder().subject_name(
             subject
         ).issuer_name(
             issuer
@@ -262,14 +273,13 @@ def main():
             private_key.public_key()
         ).serial_number(
             cryptography.x509.random_serial_number()
-        ).not_valid_before(
-            not_valid_before
-        ).not_valid_after(
-            not_valid_after
         ).add_extension(
             cryptography.x509.SubjectAlternativeName([san]),
             critical=False,
-        ).sign(
+        )
+        cert_builder = set_not_valid_before(cert_builder, not_valid_before)
+        cert_builder = set_not_valid_after(cert_builder, not_valid_after)
+        regular_certificate = cert_builder.sign(
             private_key,
             cryptography.hazmat.primitives.hashes.SHA256(),
             _cryptography_backend
@@ -278,7 +288,7 @@ def main():
         # Process challenge
         if challenge == 'tls-alpn-01':
             value = base64.b64decode(challenge_data['resource_value'])
-            challenge_certificate = cryptography.x509.CertificateBuilder().subject_name(
+            cert_builder = cryptography.x509.CertificateBuilder().subject_name(
                 subject
             ).issuer_name(
                 issuer
@@ -286,10 +296,6 @@ def main():
                 private_key.public_key()
             ).serial_number(
                 cryptography.x509.random_serial_number()
-            ).not_valid_before(
-                not_valid_before
-            ).not_valid_after(
-                not_valid_after
             ).add_extension(
                 cryptography.x509.SubjectAlternativeName([san]),
                 critical=False,
@@ -299,7 +305,10 @@ def main():
                     encode_octet_string(value),
                 ),
                 critical=True,
-            ).sign(
+            )
+            cert_builder = set_not_valid_before(cert_builder, not_valid_before)
+            cert_builder = set_not_valid_after(cert_builder, not_valid_after)
+            challenge_certificate = cert_builder.sign(
                 private_key,
                 cryptography.hazmat.primitives.hashes.SHA256(),
                 _cryptography_backend
diff --git a/ansible_collections/community/crypto/plugins/modules/get_certificate.py b/ansible_collections/community/crypto/plugins/modules/get_certificate.py
index 0f8abc90a..6ae9439d3 100644
--- a/ansible_collections/community/crypto/plugins/modules/get_certificate.py
+++ b/ansible_collections/community/crypto/plugins/modules/get_certificate.py
@@ -209,7 +209,6 @@ EXAMPLES = '''
 
 import atexit
 import base64
-import datetime
 import traceback
 
 from os.path import isfile
@@ -221,9 +220,16 @@ from ansible.module_utils.common.text.converters import to_bytes
 
 from ansible_collections.community.crypto.plugins.module_utils.version import LooseVersion
 
+from ansible_collections.community.crypto.plugins.module_utils.crypto.support import (
+    get_now_datetime,
+)
+
 from ansible_collections.community.crypto.plugins.module_utils.crypto.cryptography_support import (
+    CRYPTOGRAPHY_TIMEZONE,
     cryptography_oid_to_name,
     cryptography_get_extensions_from_cert,
+    get_not_valid_after,
+    get_not_valid_before,
 )
 
 MINIMAL_CRYPTOGRAPHY_VERSION = '1.6'
@@ -392,7 +398,7 @@ def main():
         for attribute in x509.subject:
             result['subject'][cryptography_oid_to_name(attribute.oid, short=True)] = attribute.value
 
-        result['expired'] = x509.not_valid_after < datetime.datetime.utcnow()
+        result['expired'] = get_not_valid_after(x509) < get_now_datetime(with_timezone=CRYPTOGRAPHY_TIMEZONE)
 
         result['extensions'] = []
         for dotted_number, entry in cryptography_get_extensions_from_cert(x509).items():
@@ -410,8 +416,8 @@ def main():
         for attribute in x509.issuer:
             result['issuer'][cryptography_oid_to_name(attribute.oid, short=True)] = attribute.value
 
-        result['not_after'] = x509.not_valid_after.strftime('%Y%m%d%H%M%SZ')
-        result['not_before'] = x509.not_valid_before.strftime('%Y%m%d%H%M%SZ')
+        result['not_after'] = get_not_valid_after(x509).strftime('%Y%m%d%H%M%SZ')
+        result['not_before'] = get_not_valid_before(x509).strftime('%Y%m%d%H%M%SZ')
 
         result['serial_number'] = x509.serial_number
         result['signature_algorithm'] = cryptography_oid_to_name(x509.signature_algorithm_oid)
diff --git a/ansible_collections/community/crypto/plugins/modules/x509_certificate_convert.py b/ansible_collections/community/crypto/plugins/modules/x509_certificate_convert.py
new file mode 100644
index 000000000..d3e39dc11
--- /dev/null
+++ b/ansible_collections/community/crypto/plugins/modules/x509_certificate_convert.py
@@ -0,0 +1,280 @@
+#!/usr/bin/python
+# -*- coding: utf-8 -*-
+
+# Copyright (c) 2024, Felix Fontein <felix@fontein.de>
+# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+from __future__ import absolute_import, division, print_function
+__metaclass__ = type
+
+
+DOCUMENTATION = r'''
+---
+module: x509_certificate_convert
+short_description: Convert X.509 certificates
+version_added: 2.19.0
+description:
+    - This module allows to convert X.509 certificates between different formats.
+author:
+    - Felix Fontein (@felixfontein)
+extends_documentation_fragment:
+    - ansible.builtin.files
+    - community.crypto.attributes
+    - community.crypto.attributes.files
+attributes:
+    check_mode:
+        support: full
+    diff_mode:
+        support: none
+    safe_file_operations:
+        support: full
+options:
+    src_path:
+        description:
+            - Name of the file containing the X.509 certificate to convert.
+            - Exactly one of O(src_path) or O(src_content) must be specified.
+        type: path
+    src_content:
+        description:
+            - The content of the file containing the X.509 certificate to convert.
+            - This must be text. If you are not sure that the input file is PEM, you must Base64 encode
+              the value and set O(src_content_base64=true). You can use the
+              P(ansible.builtin.b64encode#filter) filter plugin for this.
+            - Exactly one of O(src_path) or O(src_content) must be specified.
+        type: str
+    src_content_base64:
+        description:
+            - If set to V(true) when O(src_content) is provided, the module assumes that the value
+              of O(src_content) is Base64 encoded.
+        type: bool
+        default: false
+    format:
+        description:
+            - Determines which format the destination X.509 certificate should be written in.
+            - Please note that not every key can be exported in any format, and that not every
+              format supports encryption.
+        type: str
+        choices:
+            - pem
+            - der
+        required: true
+    strict:
+        description:
+            - If the input is a PEM file, ensure that it contains a single PEM object, that
+              the header and footer match, and are of type C(CERTIFICATE) or C(X509 CERTIFICATE).
+        type: bool
+        default: false
+    dest_path:
+        description:
+            - Name of the file in which the generated TLS/SSL X.509 certificate will be written.
+        type: path
+        required: true
+    backup:
+        description:
+            - Create a backup file including a timestamp so you can get
+              the original X.509 certificate back if you overwrote it with a new one by accident.
+        type: bool
+        default: false
+seealso:
+    - plugin: ansible.builtin.b64encode
+      plugin_type: filter
+    - module: community.crypto.x509_certificate
+    - module: community.crypto.x509_certificate_pipe
+    - module: community.crypto.x509_certificate_info
+'''
+
+EXAMPLES = r'''
+- name: Convert PEM X.509 certificate to DER format
+  community.crypto.x509_certificate_convert:
+    src_path: /etc/ssl/cert/ansible.com.pem
+    dest_path: /etc/ssl/cert/ansible.com.der
+    format: der
+'''
+
+RETURN = r'''
+backup_file:
+    description: Name of backup file created.
+    returned: changed and if O(backup) is V(true)
+    type: str
+    sample: /path/to/cert.pem.2019-03-09@11:22~
+'''
+
+import base64
+import os
+
+from ansible.module_utils.basic import AnsibleModule
+from ansible.module_utils.common.text.converters import to_native, to_bytes, to_text
+
+from ansible_collections.community.crypto.plugins.module_utils.io import (
+    load_file_if_exists,
+    write_file,
+)
+
+from ansible_collections.community.crypto.plugins.module_utils.crypto.basic import (
+    OpenSSLObjectError,
+)
+
+from ansible_collections.community.crypto.plugins.module_utils.crypto.pem import (
+    PEM_START,
+    PEM_END_START,
+    PEM_END,
+    identify_pem_format,
+    split_pem_list,
+    extract_pem,
+)
+
+from ansible_collections.community.crypto.plugins.module_utils.crypto.support import (
+    OpenSSLObject,
+)
+
+
+def parse_certificate(input, strict=False):
+    input_format = 'pem' if identify_pem_format(input) else 'der'
+    if input_format == 'pem':
+        pems = split_pem_list(to_text(input))
+        if len(pems) > 1 and strict:
+            raise ValueError('The input contains {count} PEM objects, expecting only one since strict=true'.format(count=len(pems)))
+        pem_header_type, content = extract_pem(pems[0], strict=strict)
+        if strict and pem_header_type not in ('CERTIFICATE', 'X509 CERTIFICATE'):
+            raise ValueError('type is {type!r}, expecting CERTIFICATE or X509 CERTIFICATE'.format(type=pem_header_type))
+        input = base64.b64decode(content)
+    else:
+        pem_header_type = None
+    return input, input_format, pem_header_type
+
+
+class X509CertificateConvertModule(OpenSSLObject):
+    def __init__(self, module):
+        super(X509CertificateConvertModule, self).__init__(
+            module.params['dest_path'],
+            'present',
+            False,
+            module.check_mode,
+        )
+
+        self.src_path = module.params['src_path']
+        self.src_content = module.params['src_content']
+        self.src_content_base64 = module.params['src_content_base64']
+        if self.src_content is not None:
+            self.input = to_bytes(self.src_content)
+            if self.src_content_base64:
+                try:
+                    self.input = base64.b64decode(self.input)
+                except Exception as exc:
+                    module.fail_json(msg='Cannot Base64 decode src_content: {exc}'.format(exc=exc))
+        else:
+            try:
+                with open(self.src_path, 'rb') as f:
+                    self.input = f.read()
+            except Exception as exc:
+                module.fail_json(msg='Failure while reading file {fn}: {exc}'.format(fn=self.src_path, exc=exc))
+
+        self.format = module.params['format']
+        self.strict = module.params['strict']
+        self.wanted_pem_type = 'CERTIFICATE'
+
+        try:
+            self.input, self.input_format, dummy = parse_certificate(self.input, strict=self.strict)
+        except Exception as exc:
+            module.fail_json(msg='Error while parsing PEM: {exc}'.format(exc=exc))
+
+        self.backup = module.params['backup']
+        self.backup_file = None
+
+        module.params['path'] = self.path
+
+        self.dest_content = load_file_if_exists(self.path, module)
+        self.dest_content_format = None
+        self.dest_content_pem_type = None
+        if self.dest_content is not None:
+            try:
+                self.dest_content, self.dest_content_format, self.dest_content_pem_type = parse_certificate(
+                    self.dest_content, strict=True)
+            except Exception:
+                pass
+
+    def needs_conversion(self):
+        if self.dest_content is None or self.dest_content_format is None:
+            return True
+        if self.dest_content_format != self.format:
+            return True
+        if self.input != self.dest_content:
+            return True
+        if self.format == 'pem' and self.dest_content_pem_type != self.wanted_pem_type:
+            return True
+        return False
+
+    def get_dest_certificate(self):
+        if self.format == 'der':
+            return self.input
+        data = to_bytes(base64.b64encode(self.input))
+        lines = [to_bytes('{0}{1}{2}'.format(PEM_START, self.wanted_pem_type, PEM_END))]
+        lines += [data[i:i + 64] for i in range(0, len(data), 64)]
+        lines.append(to_bytes('{0}{1}{2}\n'.format(PEM_END_START, self.wanted_pem_type, PEM_END)))
+        return b'\n'.join(lines)
+
+    def generate(self, module):
+        """Do conversion."""
+        if self.needs_conversion():
+            # Convert
+            cert_data = self.get_dest_certificate()
+            if not self.check_mode:
+                if self.backup:
+                    self.backup_file = module.backup_local(self.path)
+                write_file(module, cert_data)
+            self.changed = True
+
+        file_args = module.load_file_common_arguments(module.params)
+        if module.check_file_absent_if_check_mode(file_args['path']):
+            self.changed = True
+        else:
+            self.changed = module.set_fs_attributes_if_different(file_args, self.changed)
+
+    def dump(self):
+        """Serialize the object into a dictionary."""
+        result = dict(
+            changed=self.changed,
+        )
+        if self.backup_file:
+            result['backup_file'] = self.backup_file
+
+        return result
+
+
+def main():
+    argument_spec = dict(
+        src_path=dict(type='path'),
+        src_content=dict(type='str'),
+        src_content_base64=dict(type='bool', default=False),
+        format=dict(type='str', required=True, choices=['pem', 'der']),
+        strict=dict(type='bool', default=False),
+        dest_path=dict(type='path', required=True),
+        backup=dict(type='bool', default=False),
+    )
+    module = AnsibleModule(
+        argument_spec,
+        supports_check_mode=True,
+        add_file_common_args=True,
+        required_one_of=[('src_path', 'src_content')],
+        mutually_exclusive=[('src_path', 'src_content')],
+    )
+
+    base_dir = os.path.dirname(module.params['dest_path']) or '.'
+    if not os.path.isdir(base_dir):
+        module.fail_json(
+            name=base_dir,
+            msg='The directory %s does not exist or the file is not a directory' % base_dir
+        )
+
+    try:
+        cert = X509CertificateConvertModule(module)
+        cert.generate(module)
+        result = cert.dump()
+        module.exit_json(**result)
+    except OpenSSLObjectError as exc:
+        module.fail_json(msg=to_native(exc))
+
+
+if __name__ == '__main__':
+    main()
diff --git a/ansible_collections/community/crypto/plugins/modules/x509_certificate_info.py b/ansible_collections/community/crypto/plugins/modules/x509_certificate_info.py
index d89f610c5..8379937f7 100644
--- a/ansible_collections/community/crypto/plugins/modules/x509_certificate_info.py
+++ b/ansible_collections/community/crypto/plugins/modules/x509_certificate_info.py
@@ -410,6 +410,10 @@ from ansible_collections.community.crypto.plugins.module_utils.crypto.support im
     get_relative_time_option,
 )
 
+from ansible_collections.community.crypto.plugins.module_utils.crypto.cryptography_support import (
+    CRYPTOGRAPHY_TIMEZONE,
+)
+
 from ansible_collections.community.crypto.plugins.module_utils.crypto.module_backends.certificate_info import (
     select_backend,
 )
@@ -451,7 +455,7 @@ def main():
                 module.fail_json(
                     msg='The value for valid_at.{0} must be of type string (got {1})'.format(k, type(v))
                 )
-            valid_at[k] = get_relative_time_option(v, 'valid_at.{0}'.format(k))
+            valid_at[k] = get_relative_time_option(v, 'valid_at.{0}'.format(k), with_timezone=CRYPTOGRAPHY_TIMEZONE)
 
     try:
         result = module_backend.get_info(der_support_enabled=module.params['content'] is None)
diff --git a/ansible_collections/community/crypto/plugins/modules/x509_crl.py b/ansible_collections/community/crypto/plugins/modules/x509_crl.py
index 1ac97005a..527975b88 100644
--- a/ansible_collections/community/crypto/plugins/modules/x509_crl.py
+++ b/ansible_collections/community/crypto/plugins/modules/x509_crl.py
@@ -475,6 +475,7 @@ from ansible_collections.community.crypto.plugins.module_utils.crypto.support im
 )
 
 from ansible_collections.community.crypto.plugins.module_utils.crypto.cryptography_support import (
+    CRYPTOGRAPHY_TIMEZONE,
     cryptography_decode_name,
     cryptography_get_name,
     cryptography_key_needs_digest_for_signing,
@@ -484,11 +485,17 @@ from ansible_collections.community.crypto.plugins.module_utils.crypto.cryptograp
 )
 
 from ansible_collections.community.crypto.plugins.module_utils.crypto.cryptography_crl import (
+    CRYPTOGRAPHY_TIMEZONE_INVALIDITY_DATE,
     REVOCATION_REASON_MAP,
     TIMESTAMP_FORMAT,
     cryptography_decode_revoked_certificate,
     cryptography_dump_revoked,
     cryptography_get_signature_algorithm_oid_from_crl,
+    get_next_update,
+    get_last_update,
+    set_next_update,
+    set_last_update,
+    set_revocation_date,
 )
 
 from ansible_collections.community.crypto.plugins.module_utils.crypto.pem import (
@@ -560,8 +567,8 @@ class CRL(OpenSSLObject):
         except (TypeError, ValueError) as exc:
             module.fail_json(msg=to_native(exc))
 
-        self.last_update = get_relative_time_option(module.params['last_update'], 'last_update')
-        self.next_update = get_relative_time_option(module.params['next_update'], 'next_update')
+        self.last_update = get_relative_time_option(module.params['last_update'], 'last_update', with_timezone=CRYPTOGRAPHY_TIMEZONE)
+        self.next_update = get_relative_time_option(module.params['next_update'], 'next_update', with_timezone=CRYPTOGRAPHY_TIMEZONE)
 
         self.digest = select_message_digest(module.params['digest'])
         if self.digest is None:
@@ -607,7 +614,8 @@ class CRL(OpenSSLObject):
                 result['issuer_critical'] = rc['issuer_critical']
             result['revocation_date'] = get_relative_time_option(
                 rc['revocation_date'],
-                path_prefix + 'revocation_date'
+                path_prefix + 'revocation_date',
+                with_timezone=CRYPTOGRAPHY_TIMEZONE,
             )
             if rc['reason']:
                 result['reason'] = REVOCATION_REASON_MAP[rc['reason']]
@@ -615,7 +623,8 @@ class CRL(OpenSSLObject):
             if rc['invalidity_date']:
                 result['invalidity_date'] = get_relative_time_option(
                     rc['invalidity_date'],
-                    path_prefix + 'invalidity_date'
+                    path_prefix + 'invalidity_date',
+                    with_timezone=CRYPTOGRAPHY_TIMEZONE_INVALIDITY_DATE,
                 )
                 result['invalidity_date_critical'] = rc['invalidity_date_critical']
             self.revoked_certificates.append(result)
@@ -731,9 +740,9 @@ class CRL(OpenSSLObject):
         if self.crl is None:
             return False
 
-        if self.last_update != self.crl.last_update and not self.ignore_timestamps:
+        if self.last_update != get_last_update(self.crl) and not self.ignore_timestamps:
             return False
-        if self.next_update != self.crl.next_update and not self.ignore_timestamps:
+        if self.next_update != get_next_update(self.crl) and not self.ignore_timestamps:
             return False
         if cryptography_key_needs_digest_for_signing(self.privatekey):
             if self.crl.signature_hash_algorithm is None or self.digest.name != self.crl.signature_hash_algorithm.name:
@@ -780,8 +789,8 @@ class CRL(OpenSSLObject):
         except ValueError as e:
             raise CRLError(e)
 
-        crl = crl.last_update(self.last_update)
-        crl = crl.next_update(self.next_update)
+        crl = set_last_update(crl, self.last_update)
+        crl = set_next_update(crl, self.next_update)
 
         if self.update and self.crl:
             new_entries = set([self._compress_entry(entry) for entry in self.revoked_certificates])
@@ -792,7 +801,7 @@ class CRL(OpenSSLObject):
         for entry in self.revoked_certificates:
             revoked_cert = RevokedCertificateBuilder()
             revoked_cert = revoked_cert.serial_number(entry['serial_number'])
-            revoked_cert = revoked_cert.revocation_date(entry['revocation_date'])
+            revoked_cert = set_revocation_date(revoked_cert, entry['revocation_date'])
             if entry['issuer'] is not None:
                 revoked_cert = revoked_cert.add_extension(
                     x509.CertificateIssuer(entry['issuer']),
@@ -876,8 +885,8 @@ class CRL(OpenSSLObject):
             for entry in self.revoked_certificates:
                 result['revoked_certificates'].append(cryptography_dump_revoked(entry, idn_rewrite=self.name_encoding))
         elif self.crl:
-            result['last_update'] = self.crl.last_update.strftime(TIMESTAMP_FORMAT)
-            result['next_update'] = self.crl.next_update.strftime(TIMESTAMP_FORMAT)
+            result['last_update'] = get_last_update(self.crl).strftime(TIMESTAMP_FORMAT)
+            result['next_update'] = get_next_update(self.crl).strftime(TIMESTAMP_FORMAT)
             result['digest'] = cryptography_oid_to_name(cryptography_get_signature_algorithm_oid_from_crl(self.crl))
             issuer = []
             for attribute in self.crl.issuer:
diff --git a/ansible_collections/community/crypto/tests/integration/targets/x509_certificate_convert/aliases b/ansible_collections/community/crypto/tests/integration/targets/x509_certificate_convert/aliases
new file mode 100644
index 000000000..4602f1185
--- /dev/null
+++ b/ansible_collections/community/crypto/tests/integration/targets/x509_certificate_convert/aliases
@@ -0,0 +1,7 @@
+# Copyright (c) Ansible Project
+# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+azp/generic/2
+azp/posix/2
+destructive
diff --git a/ansible_collections/community/crypto/tests/integration/targets/x509_certificate_convert/meta/main.yml b/ansible_collections/community/crypto/tests/integration/targets/x509_certificate_convert/meta/main.yml
new file mode 100644
index 000000000..7c2b42405
--- /dev/null
+++ b/ansible_collections/community/crypto/tests/integration/targets/x509_certificate_convert/meta/main.yml
@@ -0,0 +1,9 @@
+---
+# Copyright (c) Ansible Project
+# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+dependencies:
+  - setup_openssl
+  - setup_remote_tmp_dir
+  - prepare_jinja2_compat
diff --git a/ansible_collections/community/crypto/tests/integration/targets/x509_certificate_convert/tasks/impl.yml b/ansible_collections/community/crypto/tests/integration/targets/x509_certificate_convert/tasks/impl.yml
new file mode 100644
index 000000000..e0c438937
--- /dev/null
+++ b/ansible_collections/community/crypto/tests/integration/targets/x509_certificate_convert/tasks/impl.yml
@@ -0,0 +1,212 @@
+---
+# Copyright (c) Ansible Project
+# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+- name: Read PEM cert
+  slurp:
+    src: '{{ remote_tmp_dir }}/cert_2.pem'
+  register: slurp_pem
+
+- name: Read DER cert
+  slurp:
+    src: '{{ remote_tmp_dir }}/cert_2.der'
+  register: slurp_der
+
+- name: Convert PEM cert (check mode)
+  x509_certificate_convert:
+    src_path: '{{ remote_tmp_dir }}/cert_1.pem'
+    format: pem
+    strict: true
+    dest_path: '{{ remote_tmp_dir }}/out_1.pem'
+  register: result_1
+  check_mode: true
+
+- name: Convert PEM cert
+  x509_certificate_convert:
+    src_path: '{{ remote_tmp_dir }}/cert_1.pem'
+    format: pem
+    strict: true
+    dest_path: '{{ remote_tmp_dir }}/out_1.pem'
+  register: result_2
+
+- name: Convert PEM cert (idempotent, check mode)
+  x509_certificate_convert:
+    src_path: '{{ remote_tmp_dir }}/cert_1.pem'
+    format: pem
+    strict: true
+    dest_path: '{{ remote_tmp_dir }}/out_1.pem'
+  register: result_3
+  check_mode: true
+
+- name: Convert PEM cert (idempotent)
+  x509_certificate_convert:
+    src_path: '{{ remote_tmp_dir }}/cert_1.pem'
+    format: pem
+    strict: true
+    dest_path: '{{ remote_tmp_dir }}/out_1.pem'
+  register: result_4
+
+- name: Convert PEM cert (overwrite, check mode)
+  x509_certificate_convert:
+    src_path: '{{ remote_tmp_dir }}/cert_2.pem'
+    format: pem
+    strict: true
+    dest_path: '{{ remote_tmp_dir }}/out_1.pem'
+  register: result_5
+  check_mode: true
+
+- name: Convert PEM cert (overwrite)
+  x509_certificate_convert:
+    src_path: '{{ remote_tmp_dir }}/cert_2.pem'
+    format: pem
+    strict: true
+    dest_path: '{{ remote_tmp_dir }}/out_1.pem'
+  register: result_6
+
+- name: Convert PEM cert (idempotent, content)
+  x509_certificate_convert:
+    src_content: '{{ slurp_pem.content | b64decode }}'
+    format: pem
+    strict: true
+    dest_path: '{{ remote_tmp_dir }}/out_1.pem'
+  register: result_7
+
+- name: Convert PEM cert (idempotent, content, base64)
+  x509_certificate_convert:
+    src_content: '{{ slurp_pem.content }}'
+    src_content_base64: true
+    format: pem
+    strict: true
+    dest_path: '{{ remote_tmp_dir }}/out_1.pem'
+  register: result_8
+
+- name: Convert PEM cert (idempotent, content, base64, from DER)
+  x509_certificate_convert:
+    src_content: '{{ slurp_der.content }}'
+    src_content_base64: true
+    format: pem
+    strict: true
+    dest_path: '{{ remote_tmp_dir }}/out_1.pem'
+  register: result_9
+
+- name: Convert PEM cert (idempotent, from DER)
+  x509_certificate_convert:
+    src_path: '{{ remote_tmp_dir }}/cert_2.der'
+    format: pem
+    strict: true
+    dest_path: '{{ remote_tmp_dir }}/out_1.pem'
+  register: result_10
+
+- name: Check conditions
+  assert:
+    that:
+      - result_1 is changed
+      - result_2 is changed
+      - result_3 is not changed
+      - result_4 is not changed
+      - result_5 is changed
+      - result_6 is changed
+      - result_7 is not changed
+      - result_8 is not changed
+      - result_9 is not changed
+      - result_10 is not changed
+
+- name: Convert DER cert (check mode)
+  x509_certificate_convert:
+    src_path: '{{ remote_tmp_dir }}/cert_1.der'
+    format: der
+    strict: true
+    dest_path: '{{ remote_tmp_dir }}/out_1.der'
+  register: result_1
+  check_mode: true
+
+- name: Convert DER cert
+  x509_certificate_convert:
+    src_path: '{{ remote_tmp_dir }}/cert_1.der'
+    format: der
+    strict: true
+    dest_path: '{{ remote_tmp_dir }}/out_1.der'
+  register: result_2
+
+- name: Convert DER cert (idempotent, check mode)
+  x509_certificate_convert:
+    src_path: '{{ remote_tmp_dir }}/cert_1.der'
+    format: der
+    strict: true
+    dest_path: '{{ remote_tmp_dir }}/out_1.der'
+  register: result_3
+  check_mode: true
+
+- name: Convert DER cert (idempotent)
+  x509_certificate_convert:
+    src_path: '{{ remote_tmp_dir }}/cert_1.der'
+    format: der
+    strict: true
+    dest_path: '{{ remote_tmp_dir }}/out_1.der'
+  register: result_4
+
+- name: Convert DER cert (overwrite, check mode)
+  x509_certificate_convert:
+    src_path: '{{ remote_tmp_dir }}/cert_2.der'
+    format: der
+    strict: true
+    dest_path: '{{ remote_tmp_dir }}/out_1.der'
+  register: result_5
+  check_mode: true
+
+- name: Convert DER cert (overwrite)
+  x509_certificate_convert:
+    src_path: '{{ remote_tmp_dir }}/cert_2.der'
+    format: der
+    strict: true
+    dest_path: '{{ remote_tmp_dir }}/out_1.der'
+  register: result_6
+
+- name: Convert DER cert (idempotent, content, base64)
+  x509_certificate_convert:
+    src_content: '{{ slurp_der.content }}'
+    src_content_base64: true
+    format: der
+    strict: true
+    dest_path: '{{ remote_tmp_dir }}/out_1.der'
+  register: result_7
+
+- name: Convert DER cert (idempotent, content, from PEM)
+  x509_certificate_convert:
+    src_content: '{{ slurp_pem.content | b64decode }}'
+    format: der
+    strict: true
+    dest_path: '{{ remote_tmp_dir }}/out_1.der'
+  register: result_8
+
+- name: Convert DER cert (idempotent, content, base64, from PEM)
+  x509_certificate_convert:
+    src_content: '{{ slurp_pem.content }}'
+    src_content_base64: true
+    format: der
+    strict: true
+    dest_path: '{{ remote_tmp_dir }}/out_1.der'
+  register: result_9
+
+- name: Convert DER cert (idempotent, from PEM)
+  x509_certificate_convert:
+    src_path: '{{ remote_tmp_dir }}/cert_2.pem'
+    format: der
+    strict: true
+    dest_path: '{{ remote_tmp_dir }}/out_1.der'
+  register: result_10
+
+- name: Check conditions
+  assert:
+    that:
+      - result_1 is changed
+      - result_2 is changed
+      - result_3 is not changed
+      - result_4 is not changed
+      - result_5 is changed
+      - result_6 is changed
+      - result_7 is not changed
+      - result_8 is not changed
+      - result_9 is not changed
+      - result_10 is not changed
diff --git a/ansible_collections/community/crypto/tests/integration/targets/x509_certificate_convert/tasks/main.yml b/ansible_collections/community/crypto/tests/integration/targets/x509_certificate_convert/tasks/main.yml
new file mode 100644
index 000000000..291572f1d
--- /dev/null
+++ b/ansible_collections/community/crypto/tests/integration/targets/x509_certificate_convert/tasks/main.yml
@@ -0,0 +1,136 @@
+---
+# Copyright (c) Ansible Project
+# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+####################################################################
+# WARNING: These are designed specifically for Ansible tests       #
+# and should not be used as examples of how to write Ansible roles #
+####################################################################
+
+- name: Generate privatekey
+  openssl_privatekey:
+    path: '{{ remote_tmp_dir }}/privatekey.pem'
+    size: '{{ default_rsa_key_size_certifiates }}'
+
+- name: Generate CSR 1
+  openssl_csr:
+    path: '{{ remote_tmp_dir }}/csr_1.csr'
+    privatekey_path: '{{ remote_tmp_dir }}/privatekey.pem'
+    subject:
+      commonName: www.example.com
+      C: de
+      L: Somewhere
+      ST: Zurich
+      streetAddress: Welcome Street
+      O: Ansible
+      organizationalUnitName:
+        - Crypto Department
+        - ACME Department
+      serialNumber: "1234"
+      SN: Last Name
+      GN: First Name
+      title: Chief
+      pseudonym: test
+      UID: asdf
+      emailAddress: test@example.com
+      postalAddress: 1234 Somewhere
+      postalCode: "1234"
+    useCommonNameForSAN: false
+    key_usage:
+      - digitalSignature
+      - keyAgreement
+      - Non Repudiation
+      - Key Encipherment
+      - dataEncipherment
+      - Certificate Sign
+      - cRLSign
+      - Encipher Only
+      - decipherOnly
+    key_usage_critical: true
+    extended_key_usage:
+      - serverAuth  # the same as "TLS Web Server Authentication"
+      - TLS Web Server Authentication
+      - TLS Web Client Authentication
+      - Code Signing
+      - E-mail Protection
+      - timeStamping
+      - OCSPSigning
+      - Any Extended Key Usage
+      - qcStatements
+      - DVCS
+      - IPSec User
+      - biometricInfo
+    subject_alt_name:
+      - "DNS:www.ansible.com"
+      - "DNS:öç.com"
+      # cryptography < 2.1 cannot handle certain Unicode characters
+      - "DNS:{{ 'www.öç' if cryptography_version.stdout is version('2.1', '<') else '☺' }}.com"
+      - "IP:1.2.3.4"
+      - "IP:::1"
+      - "email:test@example.org"
+      - "URI:https://example.org/test/index.html"
+    basic_constraints:
+      - "CA:TRUE"
+      - "pathlen:23"
+    basic_constraints_critical: true
+    ocsp_must_staple: true
+    subject_key_identifier: '{{ "00:11:22:33" if cryptography_version.stdout is version("1.3", ">=") else omit }}'
+    authority_key_identifier: '{{ "44:55:66:77" if cryptography_version.stdout is version("1.3", ">=") else omit }}'
+    authority_cert_issuer: '{{ value_for_authority_cert_issuer if cryptography_version.stdout is version("1.3", ">=") else omit }}'
+    authority_cert_serial_number: '{{ 12345 if cryptography_version.stdout is version("1.3", ">=") else omit }}'
+  vars:
+    value_for_authority_cert_issuer:
+      - "DNS:ca.example.org"
+      - "IP:1.2.3.4"
+
+- name: Generate CSR 2
+  openssl_csr:
+    path: '{{ remote_tmp_dir }}/csr_2.csr'
+    privatekey_path: '{{ remote_tmp_dir }}/privatekey.pem'
+    useCommonNameForSAN: false
+    basic_constraints:
+      - "CA:TRUE"
+
+- name: Generate CSR 3
+  openssl_csr:
+    path: '{{ remote_tmp_dir }}/csr_3.csr'
+    privatekey_path: '{{ remote_tmp_dir }}/privatekey.pem'
+    useCommonNameForSAN: false
+    subject_alt_name:
+      - "DNS:*.ansible.com"
+      - "DNS:*.example.org"
+      - "IP:DEAD:BEEF::1"
+    basic_constraints:
+      - "CA:FALSE"
+    authority_cert_issuer: '{{ value_for_authority_cert_issuer if cryptography_version.stdout is version("1.3", ">=") else omit }}'
+    authority_cert_serial_number: '{{ 12345 if cryptography_version.stdout is version("1.3", ">=") else omit }}'
+  vars:
+    value_for_authority_cert_issuer:
+      - "DNS:ca.example.org"
+      - "IP:1.2.3.4"
+
+- name: Generate selfsigned certificates
+  x509_certificate:
+    path: '{{ remote_tmp_dir }}/cert_{{ item }}.pem'
+    csr_path: '{{ remote_tmp_dir }}/csr_{{ item }}.csr'
+    privatekey_path: '{{ remote_tmp_dir }}/privatekey.pem'
+    provider: selfsigned
+    selfsigned_digest: sha256
+    selfsigned_not_after: "+10d"
+    selfsigned_not_before: "-3d"
+  loop:
+  - 1
+  - 2
+  - 3
+
+- name: Convert PEM files to DER
+  command:
+    cmd: openssl x509 -inform PEM -outform DER -in {{ remote_tmp_dir }}/cert_{{ item }}.pem -out {{ remote_tmp_dir }}/cert_{{ item }}.der
+  loop:
+  - 1
+  - 2
+  - 3
+
+- name: Running tests
+  include_tasks: impl.yml
diff --git a/ansible_collections/community/crypto/tests/sanity/ignore-2.10.txt b/ansible_collections/community/crypto/tests/sanity/ignore-2.10.txt
index 81d34f186..a2980b921 100644
--- a/ansible_collections/community/crypto/tests/sanity/ignore-2.10.txt
+++ b/ansible_collections/community/crypto/tests/sanity/ignore-2.10.txt
@@ -15,6 +15,7 @@ plugins/modules/openssl_csr_info.py validate-modules:invalid-documentation
 plugins/modules/openssl_csr_pipe.py validate-modules:invalid-documentation
 plugins/modules/openssl_privatekey_info.py validate-modules:invalid-documentation
 plugins/modules/openssl_publickey_info.py validate-modules:invalid-documentation
+plugins/modules/x509_certificate_convert.py validate-modules:invalid-documentation
 plugins/modules/x509_certificate_info.py validate-modules:invalid-documentation
 plugins/modules/x509_crl.py validate-modules:invalid-documentation
 plugins/modules/x509_crl.py validate-modules:return-syntax-error
diff --git a/ansible_collections/community/crypto/tests/sanity/ignore-2.11.txt b/ansible_collections/community/crypto/tests/sanity/ignore-2.11.txt
index 2677551db..07a994f88 100644
--- a/ansible_collections/community/crypto/tests/sanity/ignore-2.11.txt
+++ b/ansible_collections/community/crypto/tests/sanity/ignore-2.11.txt
@@ -14,6 +14,7 @@ plugins/modules/openssl_csr_info.py validate-modules:invalid-documentation
 plugins/modules/openssl_csr_pipe.py validate-modules:invalid-documentation
 plugins/modules/openssl_privatekey_info.py validate-modules:invalid-documentation
 plugins/modules/openssl_publickey_info.py validate-modules:invalid-documentation
+plugins/modules/x509_certificate_convert.py validate-modules:invalid-documentation
 plugins/modules/x509_certificate_info.py validate-modules:invalid-documentation
 plugins/modules/x509_crl.py validate-modules:invalid-documentation
 plugins/modules/x509_crl.py validate-modules:return-syntax-error
diff --git a/ansible_collections/community/crypto/tests/sanity/ignore-2.12.txt b/ansible_collections/community/crypto/tests/sanity/ignore-2.12.txt
index 26e5b6864..54b6198ba 100644
--- a/ansible_collections/community/crypto/tests/sanity/ignore-2.12.txt
+++ b/ansible_collections/community/crypto/tests/sanity/ignore-2.12.txt
@@ -9,6 +9,7 @@ plugins/modules/openssl_csr_info.py validate-modules:invalid-documentation
 plugins/modules/openssl_csr_pipe.py validate-modules:invalid-documentation
 plugins/modules/openssl_privatekey_info.py validate-modules:invalid-documentation
 plugins/modules/openssl_publickey_info.py validate-modules:invalid-documentation
+plugins/modules/x509_certificate_convert.py validate-modules:invalid-documentation
 plugins/modules/x509_certificate_info.py validate-modules:invalid-documentation
 plugins/modules/x509_crl.py validate-modules:invalid-documentation
 plugins/modules/x509_crl.py validate-modules:return-syntax-error
diff --git a/ansible_collections/community/crypto/tests/sanity/ignore-2.13.txt b/ansible_collections/community/crypto/tests/sanity/ignore-2.13.txt
index 74ca94712..389b3f533 100644
--- a/ansible_collections/community/crypto/tests/sanity/ignore-2.13.txt
+++ b/ansible_collections/community/crypto/tests/sanity/ignore-2.13.txt
@@ -8,6 +8,7 @@ plugins/modules/openssl_csr_info.py validate-modules:invalid-documentation
 plugins/modules/openssl_csr_pipe.py validate-modules:invalid-documentation
 plugins/modules/openssl_privatekey_info.py validate-modules:invalid-documentation
 plugins/modules/openssl_publickey_info.py validate-modules:invalid-documentation
+plugins/modules/x509_certificate_convert.py validate-modules:invalid-documentation
 plugins/modules/x509_certificate_info.py validate-modules:invalid-documentation
 plugins/modules/x509_crl.py validate-modules:invalid-documentation
 plugins/modules/x509_crl_info.py validate-modules:invalid-documentation
diff --git a/ansible_collections/community/crypto/tests/sanity/ignore-2.14.txt b/ansible_collections/community/crypto/tests/sanity/ignore-2.14.txt
index 74ca94712..389b3f533 100644
--- a/ansible_collections/community/crypto/tests/sanity/ignore-2.14.txt
+++ b/ansible_collections/community/crypto/tests/sanity/ignore-2.14.txt
@@ -8,6 +8,7 @@ plugins/modules/openssl_csr_info.py validate-modules:invalid-documentation
 plugins/modules/openssl_csr_pipe.py validate-modules:invalid-documentation
 plugins/modules/openssl_privatekey_info.py validate-modules:invalid-documentation
 plugins/modules/openssl_publickey_info.py validate-modules:invalid-documentation
+plugins/modules/x509_certificate_convert.py validate-modules:invalid-documentation
 plugins/modules/x509_certificate_info.py validate-modules:invalid-documentation
 plugins/modules/x509_crl.py validate-modules:invalid-documentation
 plugins/modules/x509_crl_info.py validate-modules:invalid-documentation
diff --git a/ansible_collections/community/crypto/tests/sanity/ignore-2.18.txt b/ansible_collections/community/crypto/tests/sanity/ignore-2.18.txt
new file mode 100644
index 000000000..9ffe1e998
--- /dev/null
+++ b/ansible_collections/community/crypto/tests/sanity/ignore-2.18.txt
@@ -0,0 +1,2 @@
+tests/ee/roles/smoke/library/smoke_ipaddress.py shebang
+tests/ee/roles/smoke/library/smoke_pyyaml.py shebang
diff --git a/ansible_collections/community/crypto/tests/sanity/ignore-2.18.txt.license b/ansible_collections/community/crypto/tests/sanity/ignore-2.18.txt.license
new file mode 100644
index 000000000..edff8c768
--- /dev/null
+++ b/ansible_collections/community/crypto/tests/sanity/ignore-2.18.txt.license
@@ -0,0 +1,3 @@
+GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
+SPDX-License-Identifier: GPL-3.0-or-later
+SPDX-FileCopyrightText: Ansible Project
diff --git a/ansible_collections/community/crypto/tests/sanity/ignore-2.9.txt b/ansible_collections/community/crypto/tests/sanity/ignore-2.9.txt
index e20c4e5f3..c5b2bb0bf 100644
--- a/ansible_collections/community/crypto/tests/sanity/ignore-2.9.txt
+++ b/ansible_collections/community/crypto/tests/sanity/ignore-2.9.txt
@@ -14,6 +14,7 @@ plugins/modules/openssl_csr_info.py validate-modules:invalid-documentation
 plugins/modules/openssl_csr_pipe.py validate-modules:invalid-documentation
 plugins/modules/openssl_privatekey_info.py validate-modules:invalid-documentation
 plugins/modules/openssl_publickey_info.py validate-modules:invalid-documentation
+plugins/modules/x509_certificate_convert.py validate-modules:invalid-documentation
 plugins/modules/x509_certificate_info.py validate-modules:invalid-documentation
 plugins/modules/x509_crl.py validate-modules:invalid-documentation
 plugins/modules/x509_crl.py validate-modules:return-syntax-error