<p>I have been writing a few playbooks and roles to automate the installation of servers in my network, but the initial request for a certificate from LE has always proven cumbersome. E.g. For a dns-01 challenge, your dns configuration must have been propagated upstream or certbot will fail.</p>

<p>I am now considering to use the native acme_* modules to acquire the initial certificate(s) and then generate services on the host (using more generic ansible modules) to let certbot manage the renewal.</p>

<p>Implementation of additional functionality such as force-renewal (which I didn't consider before the 29 Feb 2020 bug in LE) and revocation of certificates is not yet very clear to me, but I'm leaning towards the native module.</p>

CC BY-SA 4.0
2020-03-05T16:04:03.347Z
As soon as you've some something published, please post links here. :)
colan
CC BY-SA 4.0
2021-06-14T08:40:32.257Z
+1 for colan... under ansible its a right pain to use DNS-01, but dns-01 is also the easiest to manually do if you are on a staging box or something that isn't visible to the interwebs..
baradhili
CC BY-SA 4.0
2020-03-05T05:18:21.830Z
2020-03-05T05:18:21.830Z
zenlord
<p>Others have pointed it out already; Certbot makes it easy to handle certificates
while <code>acme_certificate</code> module is more flexible and transparent.</p>

<h2>Acquire Certificate</h2>

<p>To request the ssl certificate with <code>acme_certificate</code>, there are good examples
on <a href="https://www.digitalocean.com/community/tutorials/how-to-acquire-a-let-s-encrypt-certificate-using-ansible-on-ubuntu-18-04" rel="nofollow noreferrer">DigitalOcean</a>
or on <a href="https://www.reddit.com/r/ansible/comments/9eyyug/is_there_a_way_to_fully_automate_setting_up_ssl/" rel="nofollow noreferrer">Reddit</a>.
These examples boil down to following tasks:</p>

<ol>
<li>Ensure you have a private key for your acme account. (module <code>openssl_privatekey</code>)</li>
<li>Ensure you have a private key for your certificate. (module <code>openssl_privatekey</code>)</li>
<li>Ensure you have a certificate signing request. (module <code>openssl_csr</code>)</li>
<li>Then a challenge is requested from letsencrypt. (module `acme_certificate')</li>
<li>One of the challenges <code>dns-01</code>, <code>http-01</code> or <code>tls-alpn-01</code> is implemented.</li>
<li>The certficate from letsencrypt is requested. (module `acme_certificate')</li>
<li>(optional) The challenge implementation is removed.</li>
<li>The server configuration is updated with the ssl certificates.</li>
</ol>

<p>With Certbot you can have all these steps in one handy command. They provide
<a href="https://certbot.eff.org/instructions" rel="nofollow noreferrer">instructions for any platform</a>.</p>

<pre><code>sudo certbot --nginx
</code></pre>

<p>Module <code>acme_certificate</code> is Ansible native and a playbook with all these steps 
is only written once. The tasks in the playbook are transparent and you have
the certificates and keys for your server configuration at hand. With Certbot
you have to know the directory <code>/etc/letsencrypt/live/my.domain.com</code> wherein
those artifacts are generated.</p>

<h2>Renew Certificate</h2>

<p>A crucial point is the responsibility for certificate renewal. Above Certbot
command has already created a cron job which checks the validity of the
certificate and renews it if required. If the certificate is managed with
Ansible you have to run an Ansible playbook for renewal.</p>

<p><a href="https://letsencrypt.org/2015/11/09/why-90-days.html" rel="nofollow noreferrer">Letsencrypt certificates are valid for 90 days, so the renewal process gets automated.</a>
For the renewal, above Ansible playbook works, it does the renewal as well.
However, it is advised to create a new csr (3) and certificate key (2) when a certificate
is renewed. Handling this properly, the playbook will grow quite a bit.</p>

<p>On Ubuntu, above certbot command has already created a cron job which handles certificate
renewal, so nothing else needs to be done.</p>

<h2>Conclusion</h2>

<p>There are roles in <a href="https://galaxy.ansible.com/" rel="nofollow noreferrer">Ansible Galaxy</a> for Certbot and
<code>acme_certificate</code> module. Personally, I like <code>acme_certificate</code> module for its transparency and because it's an Ansible native solution. However, I run Ansible from my personal notebook
and do not want to remember running a playbook for certificate renewal.
Therefore, I have installed Certbot which runs on the host and does the renewal without an external trigger.</p>

CC BY-SA 4.0
2020-01-04T08:41:06.747Z
2020-01-06T00:45:02.570Z
2020-01-06T00:45:02.570Z
conspicillatus
<p>Thanks for linking your question. Here's the github thread for reference: <a href="https://github.com/geerlingguy/ansible-role-certbot/issues/87" rel="noreferrer">https://github.com/geerlingguy/ansible-role-certbot/issues/87</a></p>

<p>There are many different ways to get certs from a CA. certbot (what this repo uses) is just one of the ways which uses letsencrypt as a certificate authority. acme_certificate is more generic and if you can't use letsencrypt then it might be a good tool to check out for http-01, dns-01 and tls-alpn-01 challenges.</p>

<p>Certbot is a great way to manage certs from letsencrypt, so if you're needs are fairly standard this is a good choice. It's a higher level package and will also handle auto renewal (assuming you enable it).</p>

<p>it is possible to do renewals with acme_certificate. You could do something similar with letsencrypt <a href="https://docs.ansible.com/ansible/2.5/modules/letsencrypt_module.html" rel="noreferrer">https://docs.ansible.com/ansible/2.5/modules/letsencrypt_module.html</a> . certbot just handles a lot of this for you, specifically for letsencrypt.</p>

<p>Personally I think using certbot to help manage certificates is simpler, but that's up to you. certbot is an application that handles the verification process for with the certificate authority, which is very handy. With acme_certificate you'll essentially be doing that yourself. It also automatically can set up automatic renewals which is very nice.</p>

CC BY-SA 4.0
2019-07-30T10:31:07.523Z
Good clean explanation, have my upvote.
Bruce Becker
CC BY-SA 4.0
2019-07-30T14:37:08.447Z
Agreed.  How about the question, though? ;)
colan
CC BY-SA 4.0
2019-08-26T16:28:31.347Z
This is exactly the reason I mostly use the role. The module, IMO, is a good demo of how to use the ACME protocol itself in automation... but it's kind of like rewriting part of certbot in your own playbooks. Instead, I like keeping my automation code trim and letting libraries and applications do the heavy lifting. Thus, certbot :)
geerlingguy
CC BY-SA 4.0
2019-07-30T09:39:01.873Z
2019-07-30T09:39:01.873Z
Nick Brady
<p>To get Let's Encrypt HTTPS certificates for their Web sites, I'm aware of quite a few folks using <a href="https://galaxy.ansible.com/geerlingguy/certbot" rel="nofollow noreferrer">a particular role, which wraps Certbot</a>, a standalone application not native to Ansible.</p>

<p>There is, however, a native Ansible module called <a href="https://docs.ansible.com/ansible/latest/modules/acme_certificate_module.html" rel="nofollow noreferrer">acme_certificate</a>, and <a href="https://galaxy.ansible.com/felixfontein/acme_certificate" rel="nofollow noreferrer">at least one accompanying role that wraps it</a>.</p>

<p>It seems to me that it would make sense to native Ansible modules whenever possible, but are there reasons for not doing so in this particular case?</p>

<ansible><certbot>
What are some reasons for using an Ansible role for Certbot vs. Ansible's native `acme_certificate` module?
colan
# What are some reasons for using an Ansible role for Certbot vs. Ansible's native `acme_certificate` module?

(Asked by: username_0 on 2019-07-26)

To get Let's Encrypt HTTPS certificates for their Web sites, I'm aware of quite a few folks using [a particular role, which wraps Certbot](https://galaxy.ansible.com/username_6/certbot), a standalone application not native to Ansible.

There is, however, a native Ansible module called [acme\_certificate](https://docs.ansible.com/ansible/latest/modules/acme_certificate_module.html), and [at least one accompanying role that wraps it](https://galaxy.ansible.com/felixfontein/acme_certificate).

It seems to me that it would make sense to native Ansible modules whenever possible, but are there reasons for not doing so in this particular case?

**Tags:** ansible, certbot


---

## 3 answers

### Answer by username_4 on 2019-07-30. Score: 6 | Accepted answer

Thanks for linking your question. Here's the github thread for reference: <https://github.com/username_6/ansible-role-certbot/issues/87>

There are many different ways to get certs from a CA. certbot (what this repo uses) is just one of the ways which uses letsencrypt as a certificate authority. acme\_certificate is more generic and if you can't use letsencrypt then it might be a good tool to check out for http-01, dns-01 and tls-alpn-01 challenges.

Certbot is a great way to manage certs from letsencrypt, so if you're needs are fairly standard this is a good choice. It's a higher level package and will also handle auto renewal (assuming you enable it).

it is possible to do renewals with acme\_certificate. You could do something similar with letsencrypt <https://docs.ansible.com/ansible/2.5/modules/letsencrypt_module.html> . certbot just handles a lot of this for you, specifically for letsencrypt.

Personally I think using certbot to help manage certificates is simpler, but that's up to you. certbot is an application that handles the verification process for with the certificate authority, which is very handy. With acme\_certificate you'll essentially be doing that yourself. It also automatically can set up automatic renewals which is very nice.

> **Comments:**
> **username_5**: Good clean explanation, have my upvote.  
> **username_0**: Agreed.  How about the question, though? ;)  
> **username_6**: This is exactly the reason I mostly use the role. The module, IMO, is a good demo of how to use the ACME protocol itself in automation... but it's kind of like rewriting part of certbot in your own playbooks. Instead, I like keeping my automation code trim and letting libraries and applications do the heavy lifting. Thus, certbot :)  

---

### Answer by username_1 on 2020-03-05. Score: 1

I have been writing a few playbooks and roles to automate the installation of servers in my network, but the initial request for a certificate from LE has always proven cumbersome. E.g. For a dns-01 challenge, your dns configuration must have been propagated upstream or certbot will fail.

I am now considering to use the native acme\_\* modules to acquire the initial certificate(s) and then generate services on the host (using more generic ansible modules) to let certbot manage the renewal.

Implementation of additional functionality such as force-renewal (which I didn't consider before the 29 Feb 2020 bug in LE) and revocation of certificates is not yet very clear to me, but I'm leaning towards the native module.

> **Comments:**
> **username_0**: As soon as you've some something published, please post links here. :)  
> **username_2**: +1 for username_0... under ansible its a right pain to use DNS-01, but dns-01 is also the easiest to manually do if you are on a staging box or something that isn't visible to the interwebs..  

---

### Answer by username_3 on 2020-01-04. Score: 1

Others have pointed it out already; Certbot makes it easy to handle certificates
while acme_certificate module is more flexible and transparent.
Acquire Certificate
To request the ssl certificate with acme_certificate, there are good examples
on DigitalOcean
or on Reddit.
These examples boil down to following tasks:

Ensure you have a private key for your acme account. (module openssl_privatekey)
Ensure you have a private key for your certificate. (module openssl_privatekey)
Ensure you have a certificate signing request. (module openssl_csr)
Then a challenge is requested from letsencrypt. (module `acme_certificate')
One of the challenges dns-01, http-01 or tls-alpn-01 is implemented.
The certficate from letsencrypt is requested. (module `acme_certificate')
(optional) The challenge implementation is removed.
The server configuration is updated with the ssl certificates.

With Certbot you can have all these steps in one handy command. They provide
instructions for any platform.
sudo certbot --nginx

Module acme_certificate is Ansible native and a playbook with all these steps 
is only written once. The tasks in the playbook are transparent and you have
the certificates and keys for your server configuration at hand. With Certbot
you have to know the directory /etc/letsencrypt/live/my.domain.com wherein
those artifacts are generated.
Renew Certificate
A crucial point is the responsibility for certificate renewal. Above Certbot
command has already created a cron job which checks the validity of the
certificate and renews it if required. If the certificate is managed with
Ansible you have to run an Ansible playbook for renewal.
Letsencrypt certificates are valid for 90 days, so the renewal process gets automated.
For the renewal, above Ansible playbook works, it does the renewal as well.
However, it is advised to create a new csr (3) and certificate key (2) when a certificate
is renewed. Handling this properly, the playbook will grow quite a bit.
On Ubuntu, above certbot command has already created a cron job which handles certificate
renewal, so nothing else needs to be done.
Conclusion
There are roles in Ansible Galaxy for Certbot and
acme_certificate module. Personally, I like acme_certificate module for its transparency and because it's an Ansible native solution. However, I run Ansible from my personal notebook
and do not want to remember running a playbook for certificate renewal.
Therefore, I have installed Certbot which runs on the host and does the renewal without an external trigger.


---

