Answers: <p>I have been writing a few playbooks and roles to automate the installation of servers in my network, but the initial request for a certificate from LE has always proven cumbersome. E.g. For a dns-01 challenge, your dns configuration must have been propagated upstream or certbot will fail.</p>
  
  <p>I am now considering to use the native acme_* modules to acquire the initial certificate(s) and then generate services on the host (using more generic ansible modules) to let certbot manage the renewal.</p>
  
  <p>Implementation of additional functionality such as force-renewal (which I didn't consider before the 29 Feb 2020 bug in LE) and revocation of certificates is not yet very clear to me, but I'm leaning towards the native module.</p>
  
Answers: CC BY-SA 4.0
Answers: 2020-03-05T16:04:03.347Z
Answers: As soon as you've some something published, please post links here. :)
Answers: colan
Answers: CC BY-SA 4.0
Answers: 2021-06-14T08:40:32.257Z
Answers: +1 for colan... under ansible its a right pain to use DNS-01, but dns-01 is also the easiest to manually do if you are on a staging box or something that isn't visible to the interwebs..
Answers: baradhili
Answers: CC BY-SA 4.0
Answers: 2020-03-05T05:18:21.830Z
Answers: 2020-03-05T05:18:21.830Z
Answers: zenlord
Answers: <p>Others have pointed it out already; Certbot makes it easy to handle certificates
  while <code>acme_certificate</code> module is more flexible and transparent.</p>
  
  <h2>Acquire Certificate</h2>
  
  <p>To request the ssl certificate with <code>acme_certificate</code>, there are good examples
  on <a href="https://www.digitalocean.com/community/tutorials/how-to-acquire-a-let-s-encrypt-certificate-using-ansible-on-ubuntu-18-04" rel="nofollow noreferrer">DigitalOcean</a>
  or on <a href="https://www.reddit.com/r/ansible/comments/9eyyug/is_there_a_way_to_fully_automate_setting_up_ssl/" rel="nofollow noreferrer">Reddit</a>.
  These examples boil down to following tasks:</p>
  
  <ol>
  <li>Ensure you have a private key for your acme account. (module <code>openssl_privatekey</code>)</li>
  <li>Ensure you have a private key for your certificate. (module <code>openssl_privatekey</code>)</li>
  <li>Ensure you have a certificate signing request. (module <code>openssl_csr</code>)</li>
  <li>Then a challenge is requested from letsencrypt. (module `acme_certificate')</li>
  <li>One of the challenges <code>dns-01</code>, <code>http-01</code> or <code>tls-alpn-01</code> is implemented.</li>
  <li>The certficate from letsencrypt is requested. (module `acme_certificate')</li>
  <li>(optional) The challenge implementation is removed.</li>
  <li>The server configuration is updated with the ssl certificates.</li>
  </ol>
  
  <p>With Certbot you can have all these steps in one handy command. They provide
  <a href="https://certbot.eff.org/instructions" rel="nofollow noreferrer">instructions for any platform</a>.</p>
  
  <pre><code>sudo certbot --nginx
  </code></pre>
  
  <p>Module <code>acme_certificate</code> is Ansible native and a playbook with all these steps 
  is only written once. The tasks in the playbook are transparent and you have
  the certificates and keys for your server configuration at hand. With Certbot
  you have to know the directory <code>/etc/letsencrypt/live/my.domain.com</code> wherein
  those artifacts are generated.</p>
  
  <h2>Renew Certificate</h2>
  
  <p>A crucial point is the responsibility for certificate renewal. Above Certbot
  command has already created a cron job which checks the validity of the
  certificate and renews it if required. If the certificate is managed with
  Ansible you have to run an Ansible playbook for renewal.</p>
  
  <p><a href="https://letsencrypt.org/2015/11/09/why-90-days.html" rel="nofollow noreferrer">Letsencrypt certificates are valid for 90 days, so the renewal process gets automated.</a>
  For the renewal, above Ansible playbook works, it does the renewal as well.
  However, it is advised to create a new csr (3) and certificate key (2) when a certificate
  is renewed. Handling this properly, the playbook will grow quite a bit.</p>
  
  <p>On Ubuntu, above certbot command has already created a cron job which handles certificate
  renewal, so nothing else needs to be done.</p>
  
  <h2>Conclusion</h2>
  
  <p>There are roles in <a href="https://galaxy.ansible.com/" rel="nofollow noreferrer">Ansible Galaxy</a> for Certbot and
  <code>acme_certificate</code> module. Personally, I like <code>acme_certificate</code> module for its transparency and because it's an Ansible native solution. However, I run Ansible from my personal notebook
  and do not want to remember running a playbook for certificate renewal.
  Therefore, I have installed Certbot which runs on the host and does the renewal without an external trigger.</p>
  
Answers: CC BY-SA 4.0
Answers: 2020-01-04T08:41:06.747Z
Answers: 2020-01-06T00:45:02.570Z
Answers: 2020-01-06T00:45:02.570Z
Answers: conspicillatus
Answers: <p>Thanks for linking your question. Here's the github thread for reference: <a href="https://github.com/geerlingguy/ansible-role-certbot/issues/87" rel="noreferrer">https://github.com/geerlingguy/ansible-role-certbot/issues/87</a></p>
  
  <p>There are many different ways to get certs from a CA. certbot (what this repo uses) is just one of the ways which uses letsencrypt as a certificate authority. acme_certificate is more generic and if you can't use letsencrypt then it might be a good tool to check out for http-01, dns-01 and tls-alpn-01 challenges.</p>
  
  <p>Certbot is a great way to manage certs from letsencrypt, so if you're needs are fairly standard this is a good choice. It's a higher level package and will also handle auto renewal (assuming you enable it).</p>
  
  <p>it is possible to do renewals with acme_certificate. You could do something similar with letsencrypt <a href="https://docs.ansible.com/ansible/2.5/modules/letsencrypt_module.html" rel="noreferrer">https://docs.ansible.com/ansible/2.5/modules/letsencrypt_module.html</a> . certbot just handles a lot of this for you, specifically for letsencrypt.</p>
  
  <p>Personally I think using certbot to help manage certificates is simpler, but that's up to you. certbot is an application that handles the verification process for with the certificate authority, which is very handy. With acme_certificate you'll essentially be doing that yourself. It also automatically can set up automatic renewals which is very nice.</p>
  
Answers: CC BY-SA 4.0
Answers: 2019-07-30T10:31:07.523Z
Answers: Good clean explanation, have my upvote.
Answers: Bruce Becker
Answers: CC BY-SA 4.0
Answers: 2019-07-30T14:37:08.447Z
Answers: Agreed.  How about the question, though? ;)
Answers: colan
Answers: CC BY-SA 4.0
Answers: 2019-08-26T16:28:31.347Z
Answers: This is exactly the reason I mostly use the role. The module, IMO, is a good demo of how to use the ACME protocol itself in automation... but it's kind of like rewriting part of certbot in your own playbooks. Instead, I like keeping my automation code trim and letting libraries and applications do the heavy lifting. Thus, certbot :)
Answers: geerlingguy
Answers: CC BY-SA 4.0
Answers: 2019-07-30T09:39:01.873Z
Answers: 2019-07-30T09:39:01.873Z
Answers: Nick Brady
Body: <p>To get Let's Encrypt HTTPS certificates for their Web sites, I'm aware of quite a few folks using <a href="https://galaxy.ansible.com/geerlingguy/certbot" rel="nofollow noreferrer">a particular role, which wraps Certbot</a>, a standalone application not native to Ansible.</p>
  
  <p>There is, however, a native Ansible module called <a href="https://docs.ansible.com/ansible/latest/modules/acme_certificate_module.html" rel="nofollow noreferrer">acme_certificate</a>, and <a href="https://galaxy.ansible.com/felixfontein/acme_certificate" rel="nofollow noreferrer">at least one accompanying role that wraps it</a>.</p>
  
  <p>It seems to me that it would make sense to native Ansible modules whenever possible, but are there reasons for not doing so in this particular case?</p>
  
Tags: <ansible><certbot>
Title: What are some reasons for using an Ansible role for Certbot vs. Ansible's native `acme_certificate` module?
UserDisplayName: colan
ThreadText: # What are some reasons for using an Ansible role for Certbot vs. Ansible's native `acme_certificate` module?
  
  (Asked by: username_0 on 2019-07-26)
  
  To get Let's Encrypt HTTPS certificates for their Web sites, I'm aware of quite a few folks using [a particular role, which wraps Certbot](https://galaxy.ansible.com/username_6/certbot), a standalone application not native to Ansible.
  
  There is, however, a native Ansible module called [acme\_certificate](https://docs.ansible.com/ansible/latest/modules/acme_certificate_module.html), and [at least one accompanying role that wraps it](https://galaxy.ansible.com/felixfontein/acme_certificate).
  
  It seems to me that it would make sense to native Ansible modules whenever possible, but are there reasons for not doing so in this particular case?
  
  **Tags:** ansible, certbot
  
  
  ---
  
  ## 3 answers
  
  ### Answer by username_4 on 2019-07-30. Score: 6 | Accepted answer
  
  Thanks for linking your question. Here's the github thread for reference: <https://github.com/username_6/ansible-role-certbot/issues/87>
  
  There are many different ways to get certs from a CA. certbot (what this repo uses) is just one of the ways which uses letsencrypt as a certificate authority. acme\_certificate is more generic and if you can't use letsencrypt then it might be a good tool to check out for http-01, dns-01 and tls-alpn-01 challenges.
  
  Certbot is a great way to manage certs from letsencrypt, so if you're needs are fairly standard this is a good choice. It's a higher level package and will also handle auto renewal (assuming you enable it).
  
  it is possible to do renewals with acme\_certificate. You could do something similar with letsencrypt <https://docs.ansible.com/ansible/2.5/modules/letsencrypt_module.html> . certbot just handles a lot of this for you, specifically for letsencrypt.
  
  Personally I think using certbot to help manage certificates is simpler, but that's up to you. certbot is an application that handles the verification process for with the certificate authority, which is very handy. With acme\_certificate you'll essentially be doing that yourself. It also automatically can set up automatic renewals which is very nice.
  
  > **Comments:**
  > **username_5**: Good clean explanation, have my upvote.  
  > **username_0**: Agreed.  How about the question, though? ;)  
  > **username_6**: This is exactly the reason I mostly use the role. The module, IMO, is a good demo of how to use the ACME protocol itself in automation... but it's kind of like rewriting part of certbot in your own playbooks. Instead, I like keeping my automation code trim and letting libraries and applications do the heavy lifting. Thus, certbot :)  
  
  ---
  
  ### Answer by username_1 on 2020-03-05. Score: 1
  
  I have been writing a few playbooks and roles to automate the installation of servers in my network, but the initial request for a certificate from LE has always proven cumbersome. E.g. For a dns-01 challenge, your dns configuration must have been propagated upstream or certbot will fail.
  
  I am now considering to use the native acme\_\* modules to acquire the initial certificate(s) and then generate services on the host (using more generic ansible modules) to let certbot manage the renewal.
  
  Implementation of additional functionality such as force-renewal (which I didn't consider before the 29 Feb 2020 bug in LE) and revocation of certificates is not yet very clear to me, but I'm leaning towards the native module.
  
  > **Comments:**
  > **username_0**: As soon as you've some something published, please post links here. :)  
  > **username_2**: +1 for username_0... under ansible its a right pain to use DNS-01, but dns-01 is also the easiest to manually do if you are on a staging box or something that isn't visible to the interwebs..  
  
  ---
  
  ### Answer by username_3 on 2020-01-04. Score: 1
  
  Others have pointed it out already; Certbot makes it easy to handle certificates
  while `acme_certificate` module is more flexible and transparent.
  
  ## Acquire Certificate
  
  To request the ssl certificate with `acme_certificate`, there are good examples
  on [DigitalOcean](https://www.digitalocean.com/community/tutorials/how-to-acquire-a-let-s-encrypt-certificate-using-ansible-on-ubuntu-18-04)
  or on [Reddit](https://www.reddit.com/r/ansible/comments/9eyyug/is_there_a_way_to_fully_automate_setting_up_ssl/).
  These examples boil down to following tasks:
  
  1. Ensure you have a private key for your acme account. (module `openssl_privatekey`)
  2. Ensure you have a private key for your certificate. (module `openssl_privatekey`)
  3. Ensure you have a certificate signing request. (module `openssl_csr`)
  4. Then a challenge is requested from letsencrypt. (module `acme\_certificate')
  5. One of the challenges `dns-01`, `http-01` or `tls-alpn-01` is implemented.
  6. The certficate from letsencrypt is requested. (module `acme\_certificate')
  7. (optional) The challenge implementation is removed.
  8. The server configuration is updated with the ssl certificates.
  
  With Certbot you can have all these steps in one handy command. They provide
  [instructions for any platform](https://certbot.eff.org/instructions).
  
  ```
  sudo certbot --nginx
  
  ```
  
  Module `acme_certificate` is Ansible native and a playbook with all these steps
  is only written once. The tasks in the playbook are transparent and you have
  the certificates and keys for your server configuration at hand. With Certbot
  you have to know the directory `/etc/letsencrypt/live/my.domain.com` wherein
  those artifacts are generated.
  
  ## Renew Certificate
  
  A crucial point is the responsibility for certificate renewal. Above Certbot
  command has already created a cron job which checks the validity of the
  certificate and renews it if required. If the certificate is managed with
  Ansible you have to run an Ansible playbook for renewal.
  
  [Letsencrypt certificates are valid for 90 days, so the renewal process gets automated.](https://letsencrypt.org/2015/11/09/why-90-days.html)
  For the renewal, above Ansible playbook works, it does the renewal as well.
  However, it is advised to create a new csr (3) and certificate key (2) when a certificate
  is renewed. Handling this properly, the playbook will grow quite a bit.
  
  On Ubuntu, above certbot command has already created a cron job which handles certificate
  renewal, so nothing else needs to be done.
  
  ## Conclusion
  
  There are roles in [Ansible Galaxy](https://galaxy.ansible.com/) for Certbot and
  `acme_certificate` module. Personally, I like `acme_certificate` module for its transparency and because it's an Ansible native solution. However, I run Ansible from my personal notebook
  and do not want to remember running a playbook for certificate renewal.
  Therefore, I have installed Certbot which runs on the host and does the renewal without an external trigger.
  
  
  ---
  
  