<p dir="auto"><em>From <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/codegastudio/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/codegastudio">@codegastudio</a> on November 12, 2016 9:3</em></p>

<h5 dir="auto">ISSUE TYPE</h5>

<ul dir="auto">
<li>Bug Report</li>
</ul>
<h5 dir="auto">COMPONENT NAME</h5>

<p dir="auto">Letsencrypt</p>
<h5 dir="auto">ANSIBLE VERSION</h5>

<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="ansible 2.2.0.0
  config file = 
  configured module search path = Default w/o overrides"><pre class="notranslate"><code class="notranslate">ansible 2.2.0.0
  config file = 
  configured module search path = Default w/o overrides
</code></pre></div>
<h5 dir="auto">CONFIGURATION</h5>

<p dir="auto">None</p>
<h5 dir="auto">OS / ENVIRONMENT</h5>

<p dir="auto">MacOS Sierra to Ubuntu 14.04.2 LTS trusty</p>
<h5 dir="auto">SUMMARY</h5>

<p dir="auto">Follow steps describe in <a href="https://docs.ansible.com/ansible/letsencrypt_module.html" rel="nofollow">letsencrypt_module</a> and get error</p>
<blockquote>
<p dir="auto">Error creating new cert :: Certificate public key must be different than account key</p>
</blockquote>
<p dir="auto">At first run, i get error during ' letsencrypt step two'.<br>
At second run, error appear during ' letsencrypt step one'.<br>
At any time crt file is created.<br>
curl access fine to challenge.</p>
<h5 dir="auto">STEPS TO REPRODUCE</h5>


<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="---
- stat: path=/home/{{ user }}/ssl/{{ inventory_hostname }}.key
  register: rsa_key_file
  tags: letsencrypt 


- stat: path=/home/{{ user }}/ssl/{{ inventory_hostname }}.csr
  register: csr_file
  tags: letsencrypt 
  

- name: create letsencrypt SSL repository
  file: &gt;
    path=/home/{{ user }}/ssl 
    state=directory 
    mode=0755 
    owner={{ user }} 
    group={{ user }} 
  tags: letsencrypt  

- name: generate RSA key
  command: openssl genrsa -out /home/{{ user }}/ssl/{{ inventory_hostname }}.key 2048  
  when: rsa_key_file.stat.exists == False
  
  
- name: change KEY owner
  file: &gt;
    path=/home/{{ user }}/ssl/{{ inventory_hostname }}.key 
    owner={{ user }} 
    group={{ user }}
  tags: letsencrypt   


- name: generate CSR 
  command: openssl req -new -sha256 -key /home/{{ user }}/ssl/{{ inventory_hostname }}.key -out /home/{{ user }}/ssl/{{ inventory_hostname }}.csr -passin pass:{{ letsencrypt.csr_pass_phrase }} -subj {{ letsencrypt.csr_subj }}
  when: csr_file.stat.exists == False
  tags: letsencrypt  
  
- name: change CSR owner
  file: path=/home/{{ user }}/ssl/{{ inventory_hostname }}.csr owner={{ user }} group={{ user }}
  tags: letsencrypt   


- name: letsencrypt step one
  letsencrypt: &gt;
    account_key=/home/{{ user }}/ssl/{{ inventory_hostname }}.key 
    csr=/home/{{ user }}/ssl/{{ inventory_hostname }}.csr 
    dest=/home/{{ user }}/ssl/{{ inventory_hostname }}.crt 
    remaining_days={{ letsencrypt.ssl_days_duration }} 
    account_email={{ letsencrypt.account_email }}
  register: sample_com_challenge
  tags: letsencrypt 

- name: create letsencrypt challenge data repository
  file: &gt;
    path=/home/{{ user }}/challenges/{{ sample_com_challenge['challenge_data'][ inventory_hostname]['http-01']['resource'] | dirname }} 
    state=directory 
    mode=0755 
    owner={{ user }} 
    group={{ user }} 
    recurse=yes
  tags: letsencrypt 
  

- name: copy challenge data in directory
  copy: &gt;
    dest=/home/{{ user }}/challenges/{{ sample_com_challenge['challenge_data'][ inventory_hostname]['http-01']['resource'] }}
    content=&quot;{{ sample_com_challenge['challenge_data'][inventory_hostname]['http-01']['resource_value'] }}&quot;
    owner={{ user }} 
    group={{ user }}
  when: sample_com_challenge|changed
  tags: letsencrypt 

  
- name: letsencrypt step two
  letsencrypt: &gt;
    account_key=/home/{{ user }}/ssl/{{ inventory_hostname }}.key
    csr=/home/{{ user }}/ssl/{{ inventory_hostname }}.csr
    dest=/home/{{ user }}/ssl/{{ inventory_hostname }}.crt
    data={{ sample_com_challenge }}
    remaining_days={{ letsencrypt.ssl_days_duration }} 
    account_email={{ letsencrypt.account_email }}
  when: sample_com_challenge
  tags: letsencrypt"><pre class="notranslate"><code class="notranslate">---
- stat: path=/home/{{ user }}/ssl/{{ inventory_hostname }}.key
  register: rsa_key_file
  tags: letsencrypt 


- stat: path=/home/{{ user }}/ssl/{{ inventory_hostname }}.csr
  register: csr_file
  tags: letsencrypt 
  

- name: create letsencrypt SSL repository
  file: &gt;
    path=/home/{{ user }}/ssl 
    state=directory 
    mode=0755 
    owner={{ user }} 
    group={{ user }} 
  tags: letsencrypt  

- name: generate RSA key
  command: openssl genrsa -out /home/{{ user }}/ssl/{{ inventory_hostname }}.key 2048  
  when: rsa_key_file.stat.exists == False
  
  
- name: change KEY owner
  file: &gt;
    path=/home/{{ user }}/ssl/{{ inventory_hostname }}.key 
    owner={{ user }} 
    group={{ user }}
  tags: letsencrypt   


- name: generate CSR 
  command: openssl req -new -sha256 -key /home/{{ user }}/ssl/{{ inventory_hostname }}.key -out /home/{{ user }}/ssl/{{ inventory_hostname }}.csr -passin pass:{{ letsencrypt.csr_pass_phrase }} -subj {{ letsencrypt.csr_subj }}
  when: csr_file.stat.exists == False
  tags: letsencrypt  
  
- name: change CSR owner
  file: path=/home/{{ user }}/ssl/{{ inventory_hostname }}.csr owner={{ user }} group={{ user }}
  tags: letsencrypt   


- name: letsencrypt step one
  letsencrypt: &gt;
    account_key=/home/{{ user }}/ssl/{{ inventory_hostname }}.key 
    csr=/home/{{ user }}/ssl/{{ inventory_hostname }}.csr 
    dest=/home/{{ user }}/ssl/{{ inventory_hostname }}.crt 
    remaining_days={{ letsencrypt.ssl_days_duration }} 
    account_email={{ letsencrypt.account_email }}
  register: sample_com_challenge
  tags: letsencrypt 

- name: create letsencrypt challenge data repository
  file: &gt;
    path=/home/{{ user }}/challenges/{{ sample_com_challenge['challenge_data'][ inventory_hostname]['http-01']['resource'] | dirname }} 
    state=directory 
    mode=0755 
    owner={{ user }} 
    group={{ user }} 
    recurse=yes
  tags: letsencrypt 
  

- name: copy challenge data in directory
  copy: &gt;
    dest=/home/{{ user }}/challenges/{{ sample_com_challenge['challenge_data'][ inventory_hostname]['http-01']['resource'] }}
    content="{{ sample_com_challenge['challenge_data'][inventory_hostname]['http-01']['resource_value'] }}"
    owner={{ user }} 
    group={{ user }}
  when: sample_com_challenge|changed
  tags: letsencrypt 

  
- name: letsencrypt step two
  letsencrypt: &gt;
    account_key=/home/{{ user }}/ssl/{{ inventory_hostname }}.key
    csr=/home/{{ user }}/ssl/{{ inventory_hostname }}.csr
    dest=/home/{{ user }}/ssl/{{ inventory_hostname }}.crt
    data={{ sample_com_challenge }}
    remaining_days={{ letsencrypt.ssl_days_duration }} 
    account_email={{ letsencrypt.account_email }}
  when: sample_com_challenge
  tags: letsencrypt
</code></pre></div>

<h5 dir="auto">EXPECTED RESULTS</h5>

<h5 dir="auto">ACTUAL RESULTS</h5>


<p dir="auto"><strong>letsencrypt step two</strong> (first run)</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="fatal: [mydomain.com]: FAILED! =&gt; {
    &quot;changed&quot;: false,
    &quot;failed&quot;: true,
    &quot;invocation&quot;: {
        &quot;module_args&quot;: {
            &quot;account_email&quot;: &quot;account email&quot;,
            &quot;account_key&quot;: &quot;/path/to/mydomain.com.key&quot;,
            &quot;acme_directory&quot;: &quot;https://acme-staging.api.letsencrypt.org/directory&quot;,
            &quot;agreement&quot;: &quot;https://letsencrypt.org/documents/LE-SA-v1.1.1-August-1-2016.pdf&quot;,
            &quot;challenge&quot;: &quot;http-01&quot;,
            &quot;csr&quot;: &quot;/path/to/mydomain.com.csr&quot;,
            &quot;data&quot;: {
                &quot;authorizations&quot;: [
                    {
                        &quot;challenges&quot;: [
                            {
                                &quot;status&quot;: &quot;pending&quot;,
                                &quot;token&quot;: &quot;3lrXt6Z4BoiG1-chtNQN5qp1NpZSPxsqMO_fXrsVkUg&quot;,
                                &quot;type&quot;: &quot;dns-01&quot;,
                                &quot;uri&quot;: &quot;https://acme-staging.api.letsencrypt.org/acme/challenge/hoWJesKjyhFDejgmLdr5OeYw0DnjNxu4Q3km6MvO5C4/16834820&quot;
                            },
                            {
                                &quot;status&quot;: &quot;pending&quot;,
                                &quot;token&quot;: &quot;fmbH41Un6qNaAscvfWRgTjeyqepRGC5bE75Ok5tlrW8&quot;,
                                &quot;type&quot;: &quot;http-01&quot;,
                                &quot;uri&quot;: &quot;https://acme-staging.api.letsencrypt.org/acme/challenge/hoWJesKjyhFDejgmLdr5OeYw0DnjNxu4Q3km6MvO5C4/16834821&quot;
                            },
                            {
                                &quot;status&quot;: &quot;pending&quot;,
                                &quot;token&quot;: &quot;WLsp235f8mMR6vDMFSKvPFD4ksb3Ih-6cLExV2nZuo0&quot;,
                                &quot;type&quot;: &quot;tls-sni-01&quot;,
                                &quot;uri&quot;: &quot;https://acme-staging.api.letsencrypt.org/acme/challenge/hoWJesKjyhFDejgmLdr5OeYw0DnjNxu4Q3km6MvO5C4/16834822&quot;
                            }
                        ],
                        &quot;combinations&quot;: [
                            [
                                1
                            ],
                            [
                                2
                            ],
                            [
                                0
                            ]
                        ],
                        &quot;expires&quot;: &quot;2016-11-19T08:50:42.20041263Z&quot;,
                        &quot;identifier&quot;: {
                            &quot;type&quot;: &quot;dns&quot;,
                            &quot;value&quot;: &quot;mydomain.com&quot;
                        },
                        &quot;status&quot;: &quot;pending&quot;,
                        &quot;uri&quot;: &quot;https://acme-staging.api.letsencrypt.org/acme/authz/hoWJesKjyhFDejgmLdr5OeYw0DnjNxu4Q3km6MvO5C4&quot;
                    }
                ],
                &quot;cert_days&quot;: -1,
                &quot;challenge_data&quot;: {
                    &quot;mydomain.com&quot;: {
                        &quot;dns-01&quot;: {
                            &quot;resource&quot;: &quot;_acme-challenge&quot;,
                            &quot;resource_value&quot;: &quot;IcS0IrdJ1Y18Ss0E751NsxQW2Pac9HqHPVLYr95CE4s&quot;
                        },
                        &quot;http-01&quot;: {
                            &quot;resource&quot;: &quot;.well-known/acme-challenge/fmbH41Un6qNaAscvfWRgTjeyqepRGC5bE75Ok5tlrW8&quot;,
                            &quot;resource_value&quot;: &quot;fmbH41Un6qNaAscvfWRgTjeyqepRGC5bE75Ok5tlrW8.oBDu6v-YxqIYLfJ80VhCzjYW2UyoK9P6HuZP0IkENAc&quot;
                        }
                    }
                },
                &quot;changed&quot;: true
            },
            &quot;dest&quot;: &quot;/path/to/mydomain.com.crt&quot;,
            &quot;remaining_days&quot;: 365
        },
        &quot;module_name&quot;: &quot;letsencrypt&quot;
    },
    &quot;msg&quot;: &quot;Error new cert: CODE: 400 RESULT: {\n  \&quot;type\&quot;: \&quot;urn:acme:error:malformed\&quot;,\n  \&quot;detail\&quot;: \&quot;Error creating new cert :: Certificate public key must be different than account key\&quot;,\n  \&quot;status\&quot;: 400\n}&quot;
}"><pre class="notranslate"><code class="notranslate">fatal: [mydomain.com]: FAILED! =&gt; {
    "changed": false,
    "failed": true,
    "invocation": {
        "module_args": {
            "account_email": "account email",
            "account_key": "/path/to/mydomain.com.key",
            "acme_directory": "https://acme-staging.api.letsencrypt.org/directory",
            "agreement": "https://letsencrypt.org/documents/LE-SA-v1.1.1-August-1-2016.pdf",
            "challenge": "http-01",
            "csr": "/path/to/mydomain.com.csr",
            "data": {
                "authorizations": [
                    {
                        "challenges": [
                            {
                                "status": "pending",
                                "token": "3lrXt6Z4BoiG1-chtNQN5qp1NpZSPxsqMO_fXrsVkUg",
                                "type": "dns-01",
                                "uri": "https://acme-staging.api.letsencrypt.org/acme/challenge/hoWJesKjyhFDejgmLdr5OeYw0DnjNxu4Q3km6MvO5C4/16834820"
                            },
                            {
                                "status": "pending",
                                "token": "fmbH41Un6qNaAscvfWRgTjeyqepRGC5bE75Ok5tlrW8",
                                "type": "http-01",
                                "uri": "https://acme-staging.api.letsencrypt.org/acme/challenge/hoWJesKjyhFDejgmLdr5OeYw0DnjNxu4Q3km6MvO5C4/16834821"
                            },
                            {
                                "status": "pending",
                                "token": "WLsp235f8mMR6vDMFSKvPFD4ksb3Ih-6cLExV2nZuo0",
                                "type": "tls-sni-01",
                                "uri": "https://acme-staging.api.letsencrypt.org/acme/challenge/hoWJesKjyhFDejgmLdr5OeYw0DnjNxu4Q3km6MvO5C4/16834822"
                            }
                        ],
                        "combinations": [
                            [
                                1
                            ],
                            [
                                2
                            ],
                            [
                                0
                            ]
                        ],
                        "expires": "2016-11-19T08:50:42.20041263Z",
                        "identifier": {
                            "type": "dns",
                            "value": "mydomain.com"
                        },
                        "status": "pending",
                        "uri": "https://acme-staging.api.letsencrypt.org/acme/authz/hoWJesKjyhFDejgmLdr5OeYw0DnjNxu4Q3km6MvO5C4"
                    }
                ],
                "cert_days": -1,
                "challenge_data": {
                    "mydomain.com": {
                        "dns-01": {
                            "resource": "_acme-challenge",
                            "resource_value": "IcS0IrdJ1Y18Ss0E751NsxQW2Pac9HqHPVLYr95CE4s"
                        },
                        "http-01": {
                            "resource": ".well-known/acme-challenge/fmbH41Un6qNaAscvfWRgTjeyqepRGC5bE75Ok5tlrW8",
                            "resource_value": "fmbH41Un6qNaAscvfWRgTjeyqepRGC5bE75Ok5tlrW8.oBDu6v-YxqIYLfJ80VhCzjYW2UyoK9P6HuZP0IkENAc"
                        }
                    }
                },
                "changed": true
            },
            "dest": "/path/to/mydomain.com.crt",
            "remaining_days": 365
        },
        "module_name": "letsencrypt"
    },
    "msg": "Error new cert: CODE: 400 RESULT: {\n  \"type\": \"urn:acme:error:malformed\",\n  \"detail\": \"Error creating new cert :: Certificate public key must be different than account key\",\n  \"status\": 400\n}"
}
</code></pre></div>
<p dir="auto"><strong>letsencrypt step one</strong> (second run)</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="fatal: [mydomain.com]: FAILED! =&gt; {
    &quot;changed&quot;: false,
    &quot;failed&quot;: true,
    &quot;invocation&quot;: {
        &quot;module_args&quot;: {
            &quot;account_email&quot;: &quot;account email&quot;,
            &quot;account_key&quot;: &quot;/path/to/mydomain.com.key&quot;,
            &quot;acme_directory&quot;: &quot;https://acme-staging.api.letsencrypt.org/directory&quot;,
            &quot;agreement&quot;: &quot;https://letsencrypt.org/documents/LE-SA-v1.1.1-August-1-2016.pdf&quot;,
            &quot;challenge&quot;: &quot;http-01&quot;,
            &quot;csr&quot;: &quot;/path/to/mydomain.com.csr&quot;,
            &quot;data&quot;: null,
            &quot;dest&quot;: &quot;/path/to/mydomain.com.crt&quot;,
            &quot;remaining_days&quot;: 365
        },
        &quot;module_name&quot;: &quot;letsencrypt&quot;
    },
    &quot;msg&quot;: &quot;Error new cert: CODE: 400 RESULT: {\n  \&quot;type\&quot;: \&quot;urn:acme:error:malformed\&quot;,\n  \&quot;detail\&quot;: \&quot;Error creating new cert :: Certificate public key must be different than account key\&quot;,\n  \&quot;status\&quot;: 400\n}&quot;
}"><pre class="notranslate"><code class="notranslate">fatal: [mydomain.com]: FAILED! =&gt; {
    "changed": false,
    "failed": true,
    "invocation": {
        "module_args": {
            "account_email": "account email",
            "account_key": "/path/to/mydomain.com.key",
            "acme_directory": "https://acme-staging.api.letsencrypt.org/directory",
            "agreement": "https://letsencrypt.org/documents/LE-SA-v1.1.1-August-1-2016.pdf",
            "challenge": "http-01",
            "csr": "/path/to/mydomain.com.csr",
            "data": null,
            "dest": "/path/to/mydomain.com.crt",
            "remaining_days": 365
        },
        "module_name": "letsencrypt"
    },
    "msg": "Error new cert: CODE: 400 RESULT: {\n  \"type\": \"urn:acme:error:malformed\",\n  \"detail\": \"Error creating new cert :: Certificate public key must be different than account key\",\n  \"status\": 400\n}"
}
</code></pre></div>
<p dir="auto"><em>Copied from original issue: <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="188901441" data-permission-text="Title is private" data-url="https://github.com/ansible/ansible-modules-extras/issues/3444" data-hovercard-type="issue" data-hovercard-url="/ansible/ansible-modules-extras/issues/3444/hovercard" href="https://github.com/ansible/ansible-modules-extras/issues/3444">ansible/ansible-modules-extras#3444</a></em></p>
<p dir="auto">When running this task</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="- name: 'Subversion | Install SSH user public keys'
  authorized_key: user=sshsvn
                  key=&quot;{{lookup('file', inventory_dir + '/files/certs/' + item + '.svn.pub')}}&quot;
                  key_options='command=&quot;/usr/local/bin/svnserve -t --tunnel-user={{item}}&quot;,no-port-forwarding,no-agent-forwarding,no-X11-forwarding,no-pty'
  with_items: svn_user"><pre class="notranslate"><code class="notranslate">- name: 'Subversion | Install SSH user public keys'
  authorized_key: user=sshsvn
                  key="{{lookup('file', inventory_dir + '/files/certs/' + item + '.svn.pub')}}"
                  key_options='command="/usr/local/bin/svnserve -t --tunnel-user={{item}}",no-port-forwarding,no-agent-forwarding,no-X11-forwarding,no-pty'
  with_items: svn_user
</code></pre></div>
<p dir="auto">then the key options are no longer added to the ~/.ssh/authorized_keys file on the remote host anymore. This used to be working prior to version 1.4 final but is no longer working since. Tested against 1.4.1, 1.4.3 and 1.5dev/HEAD.</p>
<p dir="auto">To reproduce, simply run the above task where the variable svn_user is a list of usernames as strings and the file "item.svn.pub" is a SSH RSA public key file.</p>