My domain is: metoz.de
- I ran this command: ansible playbook.
- It produced this output: (Provide the relevant part of the Ansible output, particularly any error messages from the
acme_certificatemodule) - My web server is: Apache/2.4.52
- The operating system my web server runs on is: Ubuntu 22.04.3 LTS
- My hosting provider: self-hosted, cloudflare (but even disabled, only dns)
- I can login to a root shell on my machine: Yes
- I'm using a control panel to manage my site: No
- The version of my client is: Ansible 2.15.3
Problem Description:
I am attempting to use Ansible to automate the generation and installation of Let's Encrypt SSL certificates for my domain metoz.de. The Ansible playbook uses the acme_certificate module to request a certificate.
I have successfully generated an account key and CSR, and I have set up the required directory and file for the HTTP-01 challenge (/.well-known/acme-challenge/). The challenge token is correctly placed in this directory and accesible via GET. However, the certificate generation does not proceed beyond the "pending" status, as reported by the Ansible output.
Here's a snippet of the data from the Ansible debug output for le_challenge:
"authorizations": {
"metoz.de": {
"challenges": [
{
"status": "pending",
"token": "...",
"type": "http-01",
"url": "..."
},
...
],
"expires": "2023-09-16T10:56:54Z",
"identifier": {
"type": "dns",
"value": "metoz.de"
},
"status": "pending",
...
}
}
I have waited for a significant amount of time, but the status remains "pending" and the certificate files are not generated. Could this issue be related to DNS settings or something else? I am using Cloudflare for DNS.
I appreciate any help or guidance you can provide.
These are the ansible tasks:
---
- name: Install OpenSSL package
apt:
name: openssl
state: present
- name: Ensure the required directories exist
file:
path: "{{ item }}"
state: directory
mode: '0755'
loop:
- /etc/letsencrypt
- /etc/letsencrypt/account
- /etc/letsencrypt/csr
- /etc/letsencrypt/cert
- name: Generate a private key for each domain
community.crypto.openssl_privatekey:
path: "/etc/letsencrypt/account/{{ item }}.key"
type: RSA
loop: "{{ domains }}"
- name: Generate a CSR for each domain
openssl_csr:
path: "/etc/letsencrypt/csr/{{ item }}.csr"
privatekey_path: "/etc/letsencrypt/account/{{ item }}.key"
common_name: "{{ item }}"
loop: "{{ domains }}"
- name: Create a challenge for each domain
acme_certificate:
account_key_src: "/etc/letsencrypt/account/{{ item }}.key"
account_email: "{{ email }}"
csr: "/etc/letsencrypt/csr/{{ item }}.csr"
dest: "/etc/letsencrypt/cert/{{ item }}.crt"
acme_directory: "{{ letsencrypt_url }}"
acme_version: "{{ acme_version }}"
terms_agreed: yes
loop: "{{ domains }}"
register: le_challenge
- name: Ensure the challenge directory exists and has correct permissions
file:
path: "/var/www/{{ item }}/.well-known/acme-challenge/"
state: directory
owner: www-data
group: www-data
mode: '0755'
loop: "{{ domains }}"
- name: Create challenge files for all domains
copy:
content: "{{ le_challenge['results'][0]['challenge_data'][item]['http-01']['resource_value'] }}"
dest: "/var/www/{{ item }}/{{ le_challenge['results'][0]['challenge_data'][item]['http-01']['resource'] }}"
loop: "{{ domains }}"
- name: Validate the challenge and retrieve the cert
acme_certificate:
account_key_src: "/etc/letsencrypt/account/{{ item }}.key"
account_email: "{{ email }}"
csr: "/etc/letsencrypt/csr/{{ item }}.csr"
dest: "/etc/letsencrypt/cert/{{ item }}.crt"
challenge: "{{ acme_challenge_type }}"
acme_directory: "{{ letsencrypt_url }}"
acme_version: "{{ acme_version }}"
terms_agreed: yes
data: "{{ le_challenge }}"
loop: "{{ domains }}"
register: le_result
Steps performed
- Installation of required packages: OpenSSL is installed on the server.
- Directory structure: All required directories for Let's Encrypt have been created.
- File Permissions: Directory and file permissions have been set in the correct way, including ownership of
www-data. - Private Keys and CSR: Private keys and CSR (Certificate Signing Request) were generated for each domain.
- ACME Challenge: ACME challenges were created and placed in the
.well-known/acme-challenge/directories. Permissions for these directories were set towww-data.
6 Debugging: Various debugging steps were taken, including checking the output ofle_challengeandle_result. - ACME version and URL: The ACME version and URL used are set correctly.
I spent 5 hours on this and now I've given up 
any idea anyone? any help is so much appreciated! 
