-
-
Notifications
You must be signed in to change notification settings - Fork 1
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Enhance Certificate-Renewal functionality #2
Comments
Greetings. I've thought of having a Is that what you though of? Or do you have some better way in mind? Have a nice day |
Greetings. Renew action would be definitely better than revoking and recreating. But as you are asking about what I thought of, I would prefer Ansible's idempotent way. Renew action seems better for one-time playbooks, not those you run on schedule. Certificate would be simply issued exactly as specified in arguments. If it doesn't match arguments, it get reissued automatically. So normal To be more clear about my thinking, let's take into account use case of managing OpnSense routers with your role. Use case 1 - current statusThere is no easy way to replace certificate on router, when it changes and you'll probably upload it manually. One-time playbook would be great for this, simply something like Use case 2 - certificates installed from ansibleWhen there would be some easy way to change certificate on router, I don't want to think about renewing certificate. I'll simply run my Btw. in that ideal (for me) case there would still be need for one new attribute, something like Feel free to ditch this idea if it isn't in line with your thinking. Have a nice day |
I like that idea. So we would have to implement:
Am I missing something? |
Sounds great, I think it might be everything. But we will probably discover something missing when starting to use this :D |
Sorry for the delay. Have been busy with starting a business. I'll add it to my internal ticket-system and hopefully will find time for it in the next few weeks |
What is best way to reissue certificate with different settings? If I'm not mistaken, only way for now is to revoke original with
state: absent
and then add it again?It's quite common to forget i.e. DNS name and I'm wondering if there is better way.
Feel free to close this if this is only correct way. Thanks.
The text was updated successfully, but these errors were encountered: