To get Let's Encrypt HTTPS certificates for their Web sites, I'm aware of quite a few folks using a particular role, which wraps Certbot, a standalone application not native to Ansible.
There is, however, a native Ansible module called acme_certificate, and at least one accompanying role that wraps it.
It seems to me that it would make sense to native Ansible modules whenever possible, but are there reasons for not doing so in this particular case?
Thanks for linking your question. Here's the github thread for reference: https://github.com/geerlingguy/ansible-role-certbot/issues/87
There are many different ways to get certs from a CA. certbot (what this repo uses) is just one of the ways which uses letsencrypt as a certificate authority. acme_certificate is more generic and if you can't use letsencrypt then it might be a good tool to check out for http-01, dns-01 and tls-alpn-01 challenges.
Certbot is a great way to manage certs from letsencrypt, so if you're needs are fairly standard this is a good choice. It's a higher level package and will also handle auto renewal (assuming you enable it).
it is possible to do renewals with acme_certificate. You could do something similar with letsencrypt https://docs.ansible.com/ansible/2.5/modules/letsencrypt_module.html . certbot just handles a lot of this for you, specifically for letsencrypt.
Personally I think using certbot to help manage certificates is simpler, but that's up to you. certbot is an application that handles the verification process for with the certificate authority, which is very handy. With acme_certificate you'll essentially be doing that yourself. It also automatically can set up automatic renewals which is very nice.
Others have pointed it out already; Certbot makes it easy to handle certificates
while acme_certificate module is more flexible and transparent.
To request the ssl certificate with acme_certificate, there are good examples
on DigitalOcean
or on Reddit.
These examples boil down to following tasks:
openssl_privatekey)openssl_privatekey)openssl_csr)dns-01, http-01 or tls-alpn-01 is implemented.With Certbot you can have all these steps in one handy command. They provide instructions for any platform.
sudo certbot --nginx
Module acme_certificate is Ansible native and a playbook with all these steps
is only written once. The tasks in the playbook are transparent and you have
the certificates and keys for your server configuration at hand. With Certbot
you have to know the directory /etc/letsencrypt/live/my.domain.com wherein
those artifacts are generated.
A crucial point is the responsibility for certificate renewal. Above Certbot command has already created a cron job which checks the validity of the certificate and renews it if required. If the certificate is managed with Ansible you have to run an Ansible playbook for renewal.
Letsencrypt certificates are valid for 90 days, so the renewal process gets automated. For the renewal, above Ansible playbook works, it does the renewal as well. However, it is advised to create a new csr (3) and certificate key (2) when a certificate is renewed. Handling this properly, the playbook will grow quite a bit.
On Ubuntu, above certbot command has already created a cron job which handles certificate renewal, so nothing else needs to be done.
There are roles in Ansible Galaxy for Certbot and
acme_certificate module. Personally, I like acme_certificate module for its transparency and because it's an Ansible native solution. However, I run Ansible from my personal notebook
and do not want to remember running a playbook for certificate renewal.
Therefore, I have installed Certbot which runs on the host and does the renewal without an external trigger.
I have been writing a few playbooks and roles to automate the installation of servers in my network, but the initial request for a certificate from LE has always proven cumbersome. E.g. For a dns-01 challenge, your dns configuration must have been propagated upstream or certbot will fail.
I am now considering to use the native acme_* modules to acquire the initial certificate(s) and then generate services on the host (using more generic ansible modules) to let certbot manage the renewal.
Implementation of additional functionality such as force-renewal (which I didn't consider before the 29 Feb 2020 bug in LE) and revocation of certificates is not yet very clear to me, but I'm leaning towards the native module.
