diff --git a/pr/828/acme_certificate_module.html b/pr/828/acme_certificate_module.html index 6dc53d8f..62d89caf 100644 --- a/pr/828/acme_certificate_module.html +++ b/pr/828/acme_certificate_module.html @@ -749,7 +749,7 @@ see cert: /etc/httpd/ssl/sample.com.crt challenge: dns-01 acme_directory: https://acme-v01.api.letsencrypt.org/directory - # Renew if the certificate is at least 30 days old + # Renew if the certificate is at least 30 days old remaining_days: 60 register: sample_com_challenge @@ -810,14 +810,14 @@ see challenge: tls-alpn-01 remaining_days: 60 data: "{{ sample_com_challenge }}" - # We use Let's Encrypt's ACME v2 endpoint + # We use Let's Encrypt's ACME v2 endpoint acme_directory: https://acme-v02.api.letsencrypt.org/directory acme_version: 2 - # The following makes sure that if a chain with /CN=DST Root CA X3 in its issuer is provided - # as an alternative, it will be selected. These are the roots cross-signed by IdenTrust. - # As long as Let's Encrypt provides alternate chains with the cross-signed root(s) when - # switching to their own ISRG Root X1 root, this will use the chain ending with a cross-signed - # root. This chain is more compatible with older TLS clients. + # The following makes sure that if a chain with /CN=DST Root CA X3 in its issuer is provided + # as an alternative, it will be selected. These are the roots cross-signed by IdenTrust. + # As long as Let's Encrypt provides alternate chains with the cross-signed root(s) when + # switching to their own ISRG Root X1 root, this will use the chain ending with a cross-signed + # root. This chain is more compatible with older TLS clients. select_chain: - test_certificates: last issuer: diff --git a/pr/828/acme_challenge_cert_helper_module.html b/pr/828/acme_challenge_cert_helper_module.html index bde16a38..0d35863d 100644 --- a/pr/828/acme_challenge_cert_helper_module.html +++ b/pr/828/acme_challenge_cert_helper_module.html @@ -327,15 +327,15 @@ see register: sample_com_challenge_certs - name: Install challenge certificates -# We need to set up HTTPS such that for the domain, -# regular_certificate is delivered for regular connections, -# except if ALPN selects the "acme-tls/1"; then, the -# challenge_certificate must be delivered. -# This can for example be achieved with very new versions -# of NGINX; search for ssl_preread and -# ssl_preread_alpn_protocols for information on how to -# route by ALPN protocol. - '...': + # We need to set up HTTPS such that for the domain, + # regular_certificate is delivered for regular connections, + # except if ALPN selects the "acme-tls/1"; then, the + # challenge_certificate must be delivered. + # This can for example be achieved with very new versions + # of NGINX; search for ssl_preread and + # ssl_preread_alpn_protocols for information on how to + # route by ALPN protocol. + ...: domain: "{{ item.domain }}" challenge_certificate: "{{ item.challenge_certificate }}" regular_certificate: "{{ item.regular_certificate }}" diff --git a/pr/828/acme_inspect_module.html b/pr/828/acme_inspect_module.html index 7307ef13..2634b664 100644 --- a/pr/828/acme_inspect_module.html +++ b/pr/828/acme_inspect_module.html @@ -457,8 +457,8 @@ see method: post content: '{"termsOfServiceAgreed":true}' register: account_creation -# account_creation.headers.location contains the account URI -# if creation was successful + # account_creation.headers.location contains the account URI + # if creation was successful - name: Get account information community.crypto.acme_inspect: @@ -480,8 +480,8 @@ see content: '{{ account_info | to_json }}' vars: account_info: - # For valid values, see - # https://tools.ietf.org/html/rfc8555#section-7.3 + # For valid values, see + # https://tools.ietf.org/html/rfc8555#section-7.3 contact: - mailto:me@example.com diff --git a/pr/828/openssl_privatekey_pipe_module.html b/pr/828/openssl_privatekey_pipe_module.html index 359ee3ee..0c81c7cc 100644 --- a/pr/828/openssl_privatekey_pipe_module.html +++ b/pr/828/openssl_privatekey_pipe_module.html @@ -490,7 +490,7 @@ see - name: Show generated key ansible.builtin.debug: msg: "{{ output.privatekey }}" -# DO NOT OUTPUT KEY MATERIAL TO CONSOLE OR LOGS IN PRODUCTION! + # DO NOT OUTPUT KEY MATERIAL TO CONSOLE OR LOGS IN PRODUCTION! # The following example needs CNCF SOPS (https://github.com/getsops/sops) set up and diff --git a/pr/828/x509_certificate_module.html b/pr/828/x509_certificate_module.html index e2f4f00b..f244d29a 100644 --- a/pr/828/x509_certificate_module.html +++ b/pr/828/x509_certificate_module.html @@ -941,7 +941,7 @@ see - name: Get certificate information community.crypto.x509_certificate_info: path: /etc/ssl/crt/ansible.com.crt - # for valid_at, invalid_at and valid_in + # for valid_at, invalid_at and valid_in valid_at: one_day_ten_hours: "+1d10h" fixed_timestamp: 20200331202428Z @@ -950,7 +950,7 @@ see - name: Get CSR information community.crypto.openssl_csr_info: - # Verifies that the CSR signature is valid; module will fail if not + # Verifies that the CSR signature is valid; module will fail if not path: /etc/ssl/csr/ansible.com.csr register: result_csr @@ -962,37 +962,37 @@ see - name: Check conditions on certificate, CSR, and private key ansible.builtin.assert: that: - # When private key was specified for assertonly, this was checked: + # When private key was specified for assertonly, this was checked: - result.public_key == result_privatekey.public_key - # When CSR was specified for assertonly, this was checked: + # When CSR was specified for assertonly, this was checked: - result.public_key == result_csr.public_key - result.subject_ordered == result_csr.subject_ordered - result.extensions_by_oid == result_csr.extensions_by_oid - # signature_algorithms check + # signature_algorithms check - "result.signature_algorithm == 'sha256WithRSAEncryption' or result.signature_algorithm == 'sha512WithRSAEncryption'" - # subject and subject_strict + # subject and subject_strict - "result.subject.commonName == 'ansible.com'" - "result.subject | length == 1" # the number must be the number of entries you check for - # issuer and issuer_strict + # issuer and issuer_strict - "result.issuer.commonName == 'ansible.com'" - "result.issuer | length == 1" # the number must be the number of entries you check for - # has_expired + # has_expired - not result.expired - # version + # version - result.version == 3 - # key_usage and key_usage_strict + # key_usage and key_usage_strict - "'Data Encipherment' in result.key_usage" - "result.key_usage | length == 1" # the number must be the number of entries you check for - # extended_key_usage and extended_key_usage_strict + # extended_key_usage and extended_key_usage_strict - "'DVCS' in result.extended_key_usage" - "result.extended_key_usage | length == 1" # the number must be the number of entries you check for - # subject_alt_name and subject_alt_name_strict + # subject_alt_name and subject_alt_name_strict - "'dns:ansible.com' in result.subject_alt_name" - "result.subject_alt_name | length == 1" # the number must be the number of entries you check for - # not_before and not_after + # not_before and not_after - "result.not_before == '20190331202428Z'" - "result.not_after == '20190413202428Z'" - # valid_at, invalid_at and valid_in + # valid_at, invalid_at and valid_in - "result.valid_at.one_day_ten_hours" # for valid_at - "not result.valid_at.fixed_timestamp" # for invalid_at - "result.valid_at.ten_seconds" # for valid_in