On 8/25/20 4:22 PM, Maciej Delmanowski wrote:
The script will check all the realms and any ACME certs will be renewed if
they are near the end of their vailidity period.
I think that the key here is
I suppose that if you want to
really test the mechanism, you could modify the 'pki-realm' script to check
validity and renew when there are 90+ days left, but I would do that only with
acme-staging CA to be sure.
this one is a good solution.
Otherwise another acceptable solution would be to receive a notification
the first time that the scripts fails as there should still be some days
left before the certificates expire (eventually the cron job could be
daily to narrow down the time frame). I need to check Letsencrypt doc to
see how early they accept renewal.
Is there in place any notification mechanism or shall I look into the
script and eventually fire an email?
The whole 'pki' role was designed in 2015 so it's pretty
old and needs to be
refreshed at some point. The scripts could also be rewritten in Python to be
more manageable, but that's a bit more involved.
I personally prefer bash
because my python is limited but ... whatever works
I'm currently working on
rewritten 'debops' scripts, which could incorporate the support for PKI on the
Ansible Controller side; when that's done, the 'pki' role can then be
redesigned to improve the PKI management on the remote side as well.
> It will
> take some time, hopefully in October the new scripts will be ready.