2

To get Let's Encrypt HTTPS certificates for their Web sites, I'm aware of quite a few folks using a particular role, which wraps Certbot, a standalone application not native to Ansible.

There is, however, a native Ansible module called acme_certificate, and at least one accompanying role that wraps it.

It seems to me that it would make sense to native Ansible modules whenever possible, but are there reasons for not doing so in this particular case?

4

Thanks for linking your question. Here's the github thread for reference: https://github.com/geerlingguy/ansible-role-certbot/issues/87

There are many different ways to get certs from a CA. certbot (what this repo uses) is just one of the ways which uses letsencrypt as a certificate authority. acme_certificate is more generic and if you can't use letsencrypt then it might be a good tool to check out for http-01, dns-01 and tls-alpn-01 challenges.

Certbot is a great way to manage certs from letsencrypt, so if you're needs are fairly standard this is a good choice. It's a higher level package and will also handle auto renewal (assuming you enable it).

it is possible to do renewals with acme_certificate. You could do something similar with letsencrypt https://docs.ansible.com/ansible/2.5/modules/letsencrypt_module.html . certbot just handles a lot of this for you, specifically for letsencrypt.

Personally I think using certbot to help manage certificates is simpler, but that's up to you. certbot is an application that handles the verification process for with the certificate authority, which is very handy. With acme_certificate you'll essentially be doing that yourself. It also automatically can set up automatic renewals which is very nice.

  • Good clean explanation, have my upvote. – Bruce Becker Jul 30 '19 at 10:31
  • 1
    Agreed. How about the question, though? ;) – colan Jul 30 '19 at 14:37
  • 2
    This is exactly the reason I mostly use the role. The module, IMO, is a good demo of how to use the ACME protocol itself in automation... but it's kind of like rewriting part of certbot in your own playbooks. Instead, I like keeping my automation code trim and letting libraries and applications do the heavy lifting. Thus, certbot :) – geerlingguy Aug 26 '19 at 16:28
1

Others have pointed it out already; Certbot makes it easy to handle certificates while acme_certificate module is more flexible and transparent.

Acquire Certificate

To request the ssl certificate with acme_certificate, there are good examples on DigitalOcean or on Reddit. These examples boil down to following tasks:

  1. Ensure you have a private key for your acme account. (module openssl_privatekey)
  2. Ensure you have a private key for your certificate. (module openssl_privatekey)
  3. Ensure you have a certificate signing request. (module openssl_csr)
  4. Then a challenge is requested from letsencrypt. (module `acme_certificate')
  5. One of the challenges dns-01, http-01 or tls-alpn-01 is implemented.
  6. The certficate from letsencrypt is requested. (module `acme_certificate')
  7. (optional) The challenge implementation is removed.
  8. The server configuration is updated with the ssl certificates.

With Certbot you can have all these steps in one handy command. They provide instructions for any platform.

sudo certbot --nginx

Module acme_certificate is Ansible native and a playbook with all these steps is only written once. The tasks in the playbook are transparent and you have the certificates and keys for your server configuration at hand. With Certbot you have to know the directory /etc/letsencrypt/live/my.domain.com wherein those artifacts are generated.

Renew Certificate

A crucial point is the responsibility for certificate renewal. Above Certbot command has already created a cron job which checks the validity of the certificate and renews it if required. If the certificate is managed with Ansible you have to run an Ansible playbook for renewal.

Letsencrypt certificates are valid for 90 days, so the renewal process gets automated. For the renewal, above Ansible playbook works, it does the renewal as well. However, it is advised to create a new csr (3) and certificate key (2) when a certificate is renewed. Handling this properly, the playbook will grow quite a bit.

On Ubuntu, above certbot command has already created a cron job which handles certificate renewal, so nothing else needs to be done.

Conclusion

There are roles in Ansible Galaxy for Certbot and acme_certificate module. Personally, I like acme_certificate module for its transparency and because it's an Ansible native solution. However, I run Ansible from my personal notebook and do not want to remember running a playbook for certificate renewal. Therefore, I have installed Certbot which runs on the host and does the renewal without an external trigger.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.