Others have pointed it out already; Certbot makes it easy to handle certificates
acme_certificate module is more flexible and transparent.
To request the ssl certificate with
acme_certificate, there are good examples
or on Reddit.
These examples boil down to following tasks:
- Ensure you have a private key for your acme account. (module
- Ensure you have a private key for your certificate. (module
- Ensure you have a certificate signing request. (module
- Then a challenge is requested from letsencrypt. (module `acme_certificate')
- One of the challenges
tls-alpn-01 is implemented.
- The certficate from letsencrypt is requested. (module `acme_certificate')
- (optional) The challenge implementation is removed.
- The server configuration is updated with the ssl certificates.
With Certbot you can have all these steps in one handy command. They provide
instructions for any platform.
sudo certbot --nginx
acme_certificate is Ansible native and a playbook with all these steps
is only written once. The tasks in the playbook are transparent and you have
the certificates and keys for your server configuration at hand. With Certbot
you have to know the directory
those artifacts are generated.
A crucial point is the responsibility for certificate renewal. Above Certbot
command has already created a cron job which checks the validity of the
certificate and renews it if required. If the certificate is managed with
Ansible you have to run an Ansible playbook for renewal.
Letsencrypt certificates are valid for 90 days, so the renewal process gets automated.
For the renewal, above Ansible playbook works, it does the renewal as well.
However, it is advised to create a new csr (3) and certificate key (2) when a certificate
is renewed. Handling this properly, the playbook will grow quite a bit.
On Ubuntu, above certbot command has already created a cron job which handles certificate
renewal, so nothing else needs to be done.
There are roles in Ansible Galaxy for Certbot and
acme_certificate module. Personally, I like
acme_certificate module for its transparency and because it's an Ansible native solution. However, I run Ansible from my personal notebook
and do not want to remember running a playbook for certificate renewal.
Therefore, I have installed Certbot which runs on the host and does the renewal without an external trigger.