|
|
|
@ -21,7 +21,7 @@ version_added: "2.2"
|
|
|
|
|
short_description: Create SSL/TLS certificates with the ACME protocol
|
|
|
|
|
description:
|
|
|
|
|
- "Create and renew SSL/TLS certificates with a CA supporting the
|
|
|
|
|
L(ACME protocol,https://tools.ietf.org/html/draft-ietf-acme-acme-14),
|
|
|
|
|
L(ACME protocol,https://tools.ietf.org/html/draft-ietf-acme-acme-18),
|
|
|
|
|
such as L(Let's Encrypt,https://letsencrypt.org/). The current
|
|
|
|
|
implementation supports the C(http-01), C(dns-01) and C(tls-alpn-01)
|
|
|
|
|
challenges."
|
|
|
|
@ -36,7 +36,7 @@ description:
|
|
|
|
|
the necessary certificate has to be created and served.
|
|
|
|
|
It is I(not) the responsibility of this module to perform these steps."
|
|
|
|
|
- "For details on how to fulfill these challenges, you might have to read through
|
|
|
|
|
L(the main ACME specification,https://tools.ietf.org/html/draft-ietf-acme-acme-14#section-8)
|
|
|
|
|
L(the main ACME specification,https://tools.ietf.org/html/draft-ietf-acme-acme-18#section-8)
|
|
|
|
|
and the L(TLS-ALPN-01 specification,https://tools.ietf.org/html/draft-ietf-acme-tls-alpn-05#section-3).
|
|
|
|
|
Also, consider the examples provided for this module."
|
|
|
|
|
notes:
|
|
|
|
@ -47,12 +47,31 @@ notes:
|
|
|
|
|
option."
|
|
|
|
|
- "This module was called C(letsencrypt) before Ansible 2.6. The usage
|
|
|
|
|
did not change."
|
|
|
|
|
- "If you want to use the C(tls-alpn-01) challenge, you can use the
|
|
|
|
|
M(acme_challenge_cert_helper) module to prepare the challenge certificate."
|
|
|
|
|
- "You can use the M(certificate_complete_chain) module to find the root certificate
|
|
|
|
|
for the returned fullchain."
|
|
|
|
|
- "In case you want to debug problems, you might be interested in the M(acme_inspect)
|
|
|
|
|
module."
|
|
|
|
|
seealso:
|
|
|
|
|
- name: The Let's Encrypt documentation
|
|
|
|
|
description: Documentation for the Let's Encrypt Certification Authority.
|
|
|
|
|
Provides useful information for example on rate limits.
|
|
|
|
|
link: https://letsencrypt.org/docs/
|
|
|
|
|
- name: Automatic Certificate Management Environment (ACME)
|
|
|
|
|
description: The current draft specification of the ACME protocol.
|
|
|
|
|
link: https://tools.ietf.org/html/draft-ietf-acme-acme-18
|
|
|
|
|
- name: ACME TLS ALPN Challenge Extension
|
|
|
|
|
description: The current draft specification of the C(tls-alpn-01) challenge.
|
|
|
|
|
link: https://tools.ietf.org/html/draft-ietf-acme-tls-alpn-05
|
|
|
|
|
- module: acme_challenge_cert_helper
|
|
|
|
|
description: Helps preparing C(tls-alpn-01) challenges.
|
|
|
|
|
- module: openssl_privatekey
|
|
|
|
|
description: Can be used to create private keys (both for certificates and accounts).
|
|
|
|
|
- module: openssl_csr
|
|
|
|
|
description: Can be used to create a Certificate Signing Request (CSR).
|
|
|
|
|
- module: certificate_complete_chain
|
|
|
|
|
description: Allows to find the root certificate for the returned fullchain.
|
|
|
|
|
- module: acme_certificate_revoke
|
|
|
|
|
description: Allows to revoke certificates.
|
|
|
|
|
- module: acme_account
|
|
|
|
|
description: Allows to create, modify or delete an ACME account.
|
|
|
|
|
- module: acme_inspect
|
|
|
|
|
description: Allows to debug problems.
|
|
|
|
|
extends_documentation_fragment:
|
|
|
|
|
- acme
|
|
|
|
|
options:
|
|
|
|
@ -313,7 +332,7 @@ authorizations:
|
|
|
|
|
type: complex
|
|
|
|
|
contains:
|
|
|
|
|
authorization:
|
|
|
|
|
description: ACME authorization object. See U(https://tools.ietf.org/html/draft-ietf-acme-acme-14#section-7.1.4)
|
|
|
|
|
description: ACME authorization object. See U(https://tools.ietf.org/html/draft-ietf-acme-acme-18#section-7.1.4)
|
|
|
|
|
returned: success
|
|
|
|
|
type: dict
|
|
|
|
|
order_uri:
|
|
|
|
@ -503,11 +522,11 @@ class ACMEClient(object):
|
|
|
|
|
keyauthorization = self.account.get_keyauthorization(token)
|
|
|
|
|
|
|
|
|
|
if type == 'http-01':
|
|
|
|
|
# https://tools.ietf.org/html/draft-ietf-acme-acme-14#section-8.3
|
|
|
|
|
# https://tools.ietf.org/html/draft-ietf-acme-acme-18#section-8.3
|
|
|
|
|
resource = '.well-known/acme-challenge/' + token
|
|
|
|
|
data[type] = {'resource': resource, 'resource_value': keyauthorization}
|
|
|
|
|
elif type == 'dns-01':
|
|
|
|
|
# https://tools.ietf.org/html/draft-ietf-acme-acme-14#section-8.4
|
|
|
|
|
# https://tools.ietf.org/html/draft-ietf-acme-acme-18#section-8.4
|
|
|
|
|
resource = '_acme-challenge'
|
|
|
|
|
value = nopad_b64(hashlib.sha256(to_bytes(keyauthorization)).digest())
|
|
|
|
|
record = (resource + domain[1:]) if domain.startswith('*.') else (resource + '.' + domain)
|
|
|
|
@ -584,7 +603,7 @@ class ACMEClient(object):
|
|
|
|
|
'''
|
|
|
|
|
Create a new certificate based on the csr.
|
|
|
|
|
Return the certificate object as dict
|
|
|
|
|
https://tools.ietf.org/html/draft-ietf-acme-acme-14#section-7.4
|
|
|
|
|
https://tools.ietf.org/html/draft-ietf-acme-acme-18#section-7.4
|
|
|
|
|
'''
|
|
|
|
|
csr = pem_to_der(self.csr)
|
|
|
|
|
new_cert = {
|
|
|
|
@ -618,7 +637,7 @@ class ACMEClient(object):
|
|
|
|
|
def _download_cert(self, url):
|
|
|
|
|
'''
|
|
|
|
|
Download and parse the certificate chain.
|
|
|
|
|
https://tools.ietf.org/html/draft-ietf-acme-acme-14#section-7.4.2
|
|
|
|
|
https://tools.ietf.org/html/draft-ietf-acme-acme-18#section-7.4.2
|
|
|
|
|
'''
|
|
|
|
|
content, info = self.account.get_request(url, parse_json_result=False, headers={'Accept': 'application/pem-certificate-chain'})
|
|
|
|
|
|
|
|
|
@ -686,7 +705,7 @@ class ACMEClient(object):
|
|
|
|
|
def _new_order_v2(self):
|
|
|
|
|
'''
|
|
|
|
|
Start a new certificate order (ACME v2 protocol).
|
|
|
|
|
https://tools.ietf.org/html/draft-ietf-acme-acme-14#section-7.4
|
|
|
|
|
https://tools.ietf.org/html/draft-ietf-acme-acme-18#section-7.4
|
|
|
|
|
'''
|
|
|
|
|
identifiers = []
|
|
|
|
|
for domain in self.domains:
|
|
|
|
@ -843,7 +862,7 @@ class ACMEClient(object):
|
|
|
|
|
'''
|
|
|
|
|
Deactivates all valid authz's. Does not raise exceptions.
|
|
|
|
|
https://community.letsencrypt.org/t/authorization-deactivation/19860/2
|
|
|
|
|
https://tools.ietf.org/html/draft-ietf-acme-acme-14#section-7.5.2
|
|
|
|
|
https://tools.ietf.org/html/draft-ietf-acme-acme-18#section-7.5.2
|
|
|
|
|
'''
|
|
|
|
|
authz_deactivate = {
|
|
|
|
|
'status': 'deactivated'
|
|
|
|
|