On maj 19, Jan Kowalsky wrote: Yes, Let's Encrypt is supported by DebOps, although it's limited - only http-01 authentication, so no wildcard certificates. You can find the details in the documentation here: https://docs.debops.org/en/master/ansible/roles/pki/acme-integration.html Basically, if a host has a public IP address and a DNS domain points to it, you should be able to get the ACME certificates by applying the 'nginx' and 'pki' roles, in that order. For the 'pki' role, you need to configure a PKI realm with a desired domain - for example if you want the ACME certificate to be the same as the host's FQDN, you can put in the inventory: #v+ --- pki_realms: - name: '{{ ansible_fqdn }}' #v- This will create the new PKI realm, and if the 'nginx' role was applied on the host, the 'pki' role will attempt to get the Let's Encrypt certificate for it. You can see the result in the '/etc/pki/realms/<fqdn>/acme/' directory. If something doesn't work, check what happened in the 'acme/error.log' file, fix the issue, remove the entire realm (easiest) and re-run the 'pki' role. Good luck, Maciej