search

debops / ansible-pki

Bootstrap and manage internal PKI, Certificate Authorities and OpenSSL/GnuTLS certificates
GNU General Public License v3.0
65 stars 29 forks source link

custom acme challenge dir has no effect #96

Open muelli opened 7 years ago

muelli commented 7 years ago

It seems the acme_challenge_dir is hard coded. The /usr/local/lib/pki/pki-realm script allows for overwriting args["acme_challenge_dir"], but that's not done when the "run" sub command is called:

# Execute PKI realm commands [[[
- name: Execute PKI realm commands
  environment:
    PKI_SESSION_TOKEN: '{{ pki_fact_session_token }}'
  command: '"{{ pki_fact_lib_path }}/pki-realm" run -n "{{ item.name }}"'

And "run" is the only place where "request_acme_tiny_certificate" is called.

It would also be nice to have some logging output of the pki-realm script to determine why it does not create ACME certificates. It tests for, amongst other things, [ "${config['pki_acme']}" = "true" ] && [ -x "${config['acme_client_script']}" ] && [ -d "${config['acme_challenge_dir']}" ] and it would be helpful to see why it skipped creation of a certificate. If only with --verbose flag or so.