Chapter 21. Requesting certificates by using the RHEL system role

Procedure

1. Create a playbook file, for example ~/playbook.yml, with the following content:

   ---
   - hosts: managed-node-01.example.com
     roles:
       - rhel-system-roles.certificate
     vars:
       certificate_requests:
         - name: mycert
           dns: "*.example.com"
           ca: self-sign

   • Set the name parameter to the desired name of the certificate, such as mycert.
   • Set the dns parameter to the domain to be included in the certificate, such as *.example.com.
   • Set the ca parameter to self-sign.

   By default, certmonger automatically tries to renew the certificate before it expires. You can disable this by setting the auto_renew parameter in the Ansible playbook to no.

2. Validate the playbook syntax:

   $ ansible-playbook --syntax-check ~/playbook.yml

   Note that this command only validates the syntax and does not protect against a wrong but valid configuration.

3. Run the playbook:

   $ ansible-playbook ~/playbook.yml

Procedure

1. Create a playbook file, for example ~/playbook.yml, with the following content:

   ---
   - hosts: managed-node-01.example.com
     roles:
       - rhel-system-roles.certificate
     vars:
       certificate_requests:
         - name: mycert
           dns: www.example.com
           principal: HTTP/www.example.com@EXAMPLE.COM
           ca: ipa

   • Set the name parameter to the desired name of the certificate, such as mycert.
   • Set the dns parameter to the domain to be included in the certificate, such as www.example.com.
   • Set the principal parameter to specify the Kerberos principal, such as HTTP/www.example.com@EXAMPLE.COM.
   • Set the ca parameter to ipa.

   By default, certmonger automatically tries to renew the certificate before it expires. You can disable this by setting the auto_renew parameter in the Ansible playbook to no.

2. Validate the playbook syntax:

   $ ansible-playbook --syntax-check ~/playbook.yml

   Note that this command only validates the syntax and does not protect against a wrong but valid configuration.

3. Run the playbook:

   $ ansible-playbook ~/playbook.yml

Procedure

1. Create a playbook file, for example ~/playbook.yml, with the following content:

   ---
   - hosts: managed-node-01.example.com
     roles:
       - rhel-system-roles.certificate
     vars:
       certificate_requests:
         - name: mycert
           dns: www.example.com
           ca: self-sign
           run_before: systemctl stop httpd.service
           run_after: systemctl start httpd.service

   • Set the name parameter to the desired name of the certificate, such as mycert.
   • Set the dns parameter to the domain to be included in the certificate, such as www.example.com.
   • Set the ca parameter to the CA you want to use to issue the certificate, such as self-sign.
   • Set the run_before parameter to the command you want to execute before this certificate is issued or renewed, such as systemctl stop httpd.service.
   • Set the run_after parameter to the command you want to execute after this certificate is issued or renewed, such as systemctl start httpd.service.

   By default, certmonger automatically tries to renew the certificate before it expires. You can disable this by setting the auto_renew parameter in the Ansible playbook to no.

2. Validate the playbook syntax:

   $ ansible-playbook --syntax-check ~/playbook.yml

   Note that this command only validates the syntax and does not protect against a wrong but valid configuration.

3. Run the playbook:

   $ ansible-playbook ~/playbook.yml