Parameter |
Choices/Defaults |
Comments |
acme_accountkey_path
|
|
Path to the accountkey for the acme provider
|
acme_chain
(added in 2.5) |
Default:
yes
|
Include the intermediate certificate to the generated certificate
|
acme_challenge_path
|
|
|
attributes
(added in 2.3) |
|
Attributes the file or directory should have. To get supported flags look at the man page for chattr on the target system. This string should contain the attributes in the same order as the one displayed by lsattr.
= operator is assumed as default, otherwise + or - operators need to be included in the string.
aliases: attr
|
csr_path
|
|
Path to the Certificate Signing Request (CSR) used to generate this certificate. This is not required in assertonly mode.
|
extended_key_usage
|
|
The extended_key_usage extension field must contain all these values.
aliases: extendedKeyUsage
|
extended_key_usage_strict
bool |
|
If set to True, the extended_key_usage extension field must contain only these values.
aliases: extendedKeyUsage_strict
|
force
bool |
|
Generate the certificate, even if it already exists.
|
group
|
|
Name of the group that should own the file/directory, as would be fed to chown.
|
has_expired
bool |
|
Checks if the certificate is expired/not expired at the time the module is executed.
|
invalid_at
|
|
The certificate must be invalid at this point in time. The timestamp is formatted as an ASN.1 TIME.
|
issuer
|
|
Key/value pairs that must be present in the issuer name field of the certificate. If you need to specify more than one value with the same key, use a list as value.
|
issuer_strict
bool
(added in 2.5) |
|
If set to True, the issuer field must contain only these values.
|
key_usage
|
|
The key_usage extension field must contain all these values.
aliases: keyUsage
|
key_usage_strict
bool |
|
If set to True, the key_usage extension field must contain only these values.
aliases: keyUsage_strict
|
mode
|
|
Mode the file or directory should be. For those used to /usr/bin/chmod remember that modes are actually octal numbers. You must either add a leading zero so that Ansible's YAML parser knows it is an octal number (like 0644 or 01777 ) or quote it (like '644' or '1777' ) so Ansible receives a string and can do its own conversion from string into number. Giving Ansible a number without following one of these rules will end up with a decimal number which will have unexpected results. As of version 1.8, the mode may be specified as a symbolic mode (for example, u+rwx or u=rw,g=r,o=r ).
|
not_after
|
|
The certificate must expire at this point in time. The timestamp is formatted as an ASN.1 TIME.
aliases: notAfter
|
not_before
|
|
The certificate must start to become valid at this point in time. The timestamp is formatted as an ASN.1 TIME.
aliases: notBefore
|
ownca_digest
(added in 2.7) |
Default:
sha256
|
Digest algorithm to be used for the ownca certificate.
|
ownca_not_after
(added in 2.7) |
|
The timestamp at which the certificate stops being valid. The timestamp is formatted as an ASN.1 TIME. If this value is not specified, certificate will stop being valid 10 years from now.
|
ownca_not_before
(added in 2.7) |
|
The timestamp at which the certificate starts being valid. The timestamp is formatted as an ASN.1 TIME. If this value is not specified, certificate will start being valid from now.
|
ownca_path
(added in 2.7) |
|
Remote absolute path of the CA (Certificate Authority) certificate.
|
ownca_privatekey_passphrase
(added in 2.7) |
|
The passphrase for the ownca_privatekey_path.
|
ownca_privatekey_path
(added in 2.7) |
|
Path to the CA (Certificate Authority) private key to use when signing the certificate.
|
ownca_version
(added in 2.7) |
Default:
3
|
Version of the ownca certificate. Nowadays it should almost always be 3 .
|
owner
|
|
Name of the user that should own the file/directory, as would be fed to chown.
|
path
required |
|
Remote absolute path where the generated certificate file should be created or is already located.
|
privatekey_passphrase
|
|
The passphrase for the privatekey_path.
|
privatekey_path
|
|
Path to the private key to use when signing the certificate.
|
provider
required |
Choices:
- selfsigned
- ownca
- assertonly
- acme
|
Name of the provider to use to generate/retrieve the OpenSSL certificate. The assertonly provider will not generate files and fail if the certificate file is missing.
|
selevel
|
Default:
s0
|
Level part of the SELinux file context. This is the MLS/MCS attribute, sometimes known as the range . _default feature works as for seuser.
|
selfsigned_digest
|
Default:
sha256
|
Digest algorithm to be used when self-signing the certificate
|
selfsigned_not_after
|
|
The timestamp at which the certificate stops being valid. The timestamp is formatted as an ASN.1 TIME. If this value is not specified, certificate will stop being valid 10 years from now.
aliases: selfsigned_notAfter
|
selfsigned_not_before
|
|
The timestamp at which the certificate starts being valid. The timestamp is formatted as an ASN.1 TIME. If this value is not specified, certificate will start being valid from now.
aliases: selfsigned_notBefore
|
selfsigned_version
(added in 2.5) |
Default:
3
|
Version of the selfsigned certificate. Nowadays it should almost always be 3 .
|
serole
|
|
Role part of SELinux file context, _default feature works as for seuser.
|
setype
|
|
Type part of SELinux file context, _default feature works as for seuser.
|
seuser
|
|
User part of SELinux file context. Will default to system policy, if applicable. If set to _default , it will use the user portion of the policy if available.
|
signature_algorithms
|
|
list of algorithms that you would accept the certificate to be signed with (e.g. ['sha256WithRSAEncryption', 'sha512WithRSAEncryption']).
|
state
|
Choices:
present ←
- absent
|
Whether the certificate should exist or not, taking action if the state is different from what is stated.
|
subject
|
|
Key/value pairs that must be present in the subject name field of the certificate. If you need to specify more than one value with the same key, use a list as value.
|
subject_alt_name
|
|
The subject_alt_name extension field must contain these values.
aliases: subjectAltName
|
subject_alt_name_strict
bool |
|
If set to True, the subject_alt_name extension field must contain only these values.
aliases: subjectAltName_strict
|
subject_strict
bool
(added in 2.5) |
|
If set to True, the subject field must contain only these values.
|
unsafe_writes
bool
(added in 2.2) |
|
By default this module uses atomic operations to prevent data corruption or inconsistent reads from the target files, but sometimes systems are configured or just broken in ways that prevent this. One example is docker mounted files, which cannot be updated atomically from inside the container and can only be written in an unsafe manner.
This option allows Ansible to fall back to unsafe methods of updating files when atomic operations fail (however, it doesn't force Ansible to perform unsafe writes). IMPORTANT! Unsafe writes are subject to race conditions and can lead to data corruption.
|
valid_at
|
|
The certificate must be valid at this point in time. The timestamp is formatted as an ASN.1 TIME.
|
valid_in
|
|
The certificate must still be valid in valid_in seconds from now.
|
version
|
|
Version of the certificate. Nowadays it should almost always be 3.
|