debops.pki

The debops.pki role provides a standardized management of the X.509 certificates on hosts controlled by Ansible. Other Ansible roles can utilize the environment created by debops.pki to automatically enable TLS/SSL encrypted connections.

Using this role, you can bootstrap a Public Key Infrastructure in your environment using an internal Certificate Authority, easily switch the active set of certificates between internal and external Certificate Authorities, or use the ACME protocol to automatically obtain certificates from CA that support it (for example Let's Encrypt).

• Getting started
  • Ansible Controller requirements
  • Initial configuration
  • Useful global parameters
  • Example inventory
  • Example playbook
  • Renewing Certificates
• PKI realms structure
  • PKI realm overview
  • The application view
  • Example nginx configuration
  • The PKI realm directory structure
  • How a PKI realm is created
• Internal Certificate Authorities
  • Layout of Certificate Authorities
  • Security of an internal CA
• ACME Integration
  • Let's Encrypt rate limits
  • Certificate renewal
  • Example: Certificate for apex domain and subdomains
  • Example: Certificate for subdomains excluding the apex domain
  • ACME configuration variables
• ACME Tiny Integration
  • Prerequisites
  • Let's Encrypt rate limits
  • How ACME certificates are managed
• ACME Certbot Integration
  • Prerequisites
  • Example ACME certificates with CloudFlare
• External certificates
  • Required files
  • Static private keys and certificates
  • Certificates managed by a custom script
• System CA certificates
  • Configuration of system CA certificates
  • Local Root CA certificates
• Custom file management
  • Examples
• Custom hook scripts
  • Execution environment
  • Known script states
  • Example nginx hook
• Ansible integration
• debops.pki default variables
  • Global PKI configuration
  • Automatic Certificate Management Environment
  • Certbot configuration
  • Required software packages
  • Directory, file and user/group configuration
  • Certificate sign times
  • Configuration of PKI Realms
  • Internal Certificate Authorities
  • Custom file management
  • System-wide CA Certificates
• Default variable details
  • pki_private_groups_present
  • pki_realms
  • pki_authorities
  • pki_certbot_configuration

Copyright

debops.pki - PKI management using Ansible

Copyright (C) 2013-2018 Maciej Delmanowski <drybjed@gmail.com>
Copyright (C) 2015-2017 Robin Schneider <ypid@riseup.net>
Copyright (C) 2014-2018 DebOps <https://debops.org/>
SPDX-License-Identifier: GPL-3.0-only

This Ansible role is part of DebOps.

DebOps is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License version 3, as
published by the Free Software Foundation.

DebOps is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
GNU General Public License for more details.

You should have received a copy of the GNU General Public License
along with DebOps. If not, see https://www.gnu.org/licenses/.