acromedia / ansible-role-letsencrypt Goto Github PK

It should actually try and link sites-available to sites-enabled, but it just uses the same variable for both src and destination.

Registering a default site certificate does not fit all use cases. Some use cases require more than just one cert to be registered, or certs to registered for things besides http virtual hosts (postfix, or vsftpd for example).

The role needs to support:

• Not registering a cert at all,
• Allowing an arbitrary list of certificates to be registered

ssl_protocols and ssl_ciphers in the nginx templates are crazy obsolete.

Turn these two into role defaults, and set them to something way more modern.

LE operations are now seeing

Your system is not supported by certbot-auto anymore.
Certbot will no longer receive updates.
Please visit https://certbot.eff.org/ to check for other alternatives.

on ubuntu (at least on 16).

The certbot installation documentation page now shows references to snap installations. We'll need to update the role to support this new installation method.

Seen a few failures lately with messages that look like:

...
Select the webroot for domain.extample.com:
Choices: ['Enter a new webroot', '/var/www/letsencrypt']
(You can set this with the --webroot-path flag). Skipping.
...

Error is caused by one of the subject alternative names missing from the certbot renewal config file.

Would be nice to find out why they're not showing up, but adding --webroot-path /var/www/letsencrypt to the renewal command line is an easy workaround.

Cron is sending out notifications that the certbot process is already running.

It turns out that the snap version of certbot comes with a built in systemd timer (view them all with systemctl list-timers) which performs renewals automatically. However certbot's renewal does not automatically reload http dameons to pick up the new cert version.

So the cron jobs need to be modified to only test + reload the web config, instead of renew + test + reload.

Some edge cases already have an alternate web server configuration going on, and we just want the software installed.