letsencrypt - Create SSL certificates with Let’s Encrypt

• Synopsis
• Requirements (on host that executes module)
• Options
• Examples
• Return Values
• This is an Extras Module

Synopsis

Create and renew SSL certificates with Let’s Encrypt. Let’s Encrypt is a free, automated, and open certificate authority (CA), run for the public’s benefit. For details see https://letsencrypt.org. The current implementation supports the http-01, tls-sni-02 and dns-01 challenges. To use this module, it has to be executed at least twice. Either as two different tasks in the same run or during multiple runs. Between these two tasks you have to fulfill the required steps for the choosen challenge by whatever means necessary. For http-01 that means creating the necessary challenge file on the destination webserver. For dns-01 the necessary dns record has to be created. tls-sni-02 requires you to create a SSL certificate with the appropriate subjectAlternativeNames. It is not the responsibility of this module to perform these steps. For details on how to fulfill these challenges, you might have to read through https://tools.ietf.org/html/draft-ietf-acme-acme-02#section-7 Although the defaults are choosen so that the module can be used with the Let’s Encrypt CA, the module can be used with any service using the ACME protocol.

Requirements (on host that executes module)

• python >= 2.6
• openssl

Options

Examples

- letsencrypt:
    account_key: /etc/pki/cert/private/account.key
    csr: /etc/pki/cert/csr/sample.com.csr
    dest: /etc/httpd/ssl/sample.com.crt
  register: sample_com_challenge

# perform the necessary steps to fulfill the challenge
# for example:
#
# - copy:
#     dest: /var/www/html/{{ sample_com_http_challenge['challenge_data']['sample.com']['http-01']['resource'] }}
#     content: "{{ sample_com_http_challenge['challenge_data']['sample.com']['http-01']['resource_value'] }}"
#     when: sample_com_challenge|changed

- letsencrypt:
    account_key: /etc/pki/cert/private/account.key
    csr: /etc/pki/cert/csr/sample.com.csr
    dest: /etc/httpd/ssl/sample.com.crt
    data: "{{ sample_com_challenge }}"

Return Values

Common return values are documented here Common Return Values, the following are the fields unique to this module:

This is an Extras Module

For more information on what this means please read Extras Modules

For help in developing on modules, should you be so inclined, please read Community Information & Contributing, developing_test_pr and Developing Modules.