[2018.3.4] x509.certificate_managed comparisons fail on py3

[OrangeDog]

After some debugging why it always replaced the certificate, I have identified two type differences between current_comp and new_comp.
https://github.com/saltstack/salt/blob/v2018.3.4/salt/states/x509.py#L526

In new_comp, "Public Key" is a str but in current_comp it is bytes.
In new comp, "X509v3 Extensions" is a dict but in current_comp it is OrderedDict

Probably related: #50680

[clinta]

I'm not seeing these type differences. I am seeing differences in the Subject Hash and Issuer Hash which show up only under python3.

[clinta]

I think the problem is the order of the subject elements. While this happened to always be in the same order in python2, it appears to be in a non-deterministic order in python3, which changes the subject hash.

[OrangeDog]

No, all the actual values (including those hashes) I get are the same.
Investigating with pdb shows these above type differences.

Salt Version:
           Salt: 2018.3.4

Dependency Versions:
       M2Crypto: 0.32.0
         Python: 3.6.7 (default, Oct 22 2018, 11:32:17)

/etc/{{ grains['host'] }}.crt:
  x509.certificate_managed:
    - ca_server: ca
    - signing_policy: www
    - public_key: /etc/{{ grains['host'] }}.key
    - days_remaining: 7
    - CN: {{ grains['fqdn'] }}
    - subjectAltName: 'DNS:{{ grains['fqdn'] }}, DNS:{{ grains['host'] }}'

x509_signing_policies:
  www:
    - signing_private_key: /etc/ca.key
    - signing_cert: /etc/ca.crt
    - days_valid: 90
    - O: ...
    - L: ...
    - ST: ...
    - C: ...
    - basicConstraints: 'critical, CA:false'
    - keyUsage: 'critical, digitalSignature, keyEncipherment'
    - subjectKeyIdentifier: 'hash'
    - authorityKeyIdentifier: 'keyid, issuer:always'

[clinta]

Interesting, I'm not seeing the same thing on 2019.2 Python 3.5.2.

[alxwr]

This seems to be a duplicate of #52026.

[OrangeDog]

If of interest, I fixed it locally with a custom state module.
Note that I removed some functionality I don't need in order to simplify the task.

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

If this issue is closed prematurely, please leave a comment and we will gladly reopen the issue.