# Certificate issuance and copying files across servers

**URL:** <https://forum.ansible.com/t/certificate-issuance-and-copying-files-across-servers/22925>\
**Category:** Ansible Project\
**Created:** [October 31, 2016, 8:00am UTC](https://forum.ansible.com/t/certificate-issuance-and-copying-files-across-servers/22925 "2016-10-31T08:00:27Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![marko](https://avatars.discourse-cdn.com/v4/letter/m/dbc845/32.png) [@marko](https://forum.ansible.com/u/marko)\
**Post date:** [October 31, 2016, 8:00am UTC](https://forum.ansible.com/t/certificate-issuance-and-copying-files-across-servers/22925/1 "2016-10-31T08:00:27Z")

</div>

During our server provisioning process we issue certificates for new servers. Certificates are issued by running a script on our CA host after which the certificate files need to be copied to the provisioned server.  
We’d like to include this as part of our Ansible based server provisioning process.

I tried including the certificate issuance task in our server provisioning playbook, but being a bit of a Ansible newbie, I’m running into problems.  
When I run the certificate issuance task on host CA, I need to copy the certificate from host CA to the provisioned host P. Apparently, I can’t use copy or fetch because they work between the Ansible host A and the newly provisioned server P - instead of hosts CA and P. I’ve tried using the synchronize plugin, but ran into authentication problems since the usernames can be different on Ansible host A, and hosts CA and P. Also, the other tasks in the playbook are run using become, so synchronize authentication fails because it’s run as root.

Any recommendations on how to implement the certificate issuance task in Ansible?

marko

---

<div class="post-metadata">

**Author:** ![Dick\_Davies](https://avatars.discourse-cdn.com/v4/letter/d/b9e5f3/32.png) [@Dick\_Davies](https://forum.ansible.com/u/Dick_Davies)\
**Post date:** [October 31, 2016, 1:27pm UTC](https://forum.ansible.com/t/certificate-issuance-and-copying-files-across-servers/22925/2 "2016-10-31T13:27:10Z")

</div>

You can set become: no on a task and it should override the play default.

If that doesn't help , I'd just have one task retrieve the certs at  
the top of the play, and then  
push them out locally when you come to run tasks on the servers.

---

<div class="post-metadata">

**Author:** ![Kai\_Stian\_Olstad](https://avatars.discourse-cdn.com/v4/letter/k/e19adc/32.png) [@Kai\_Stian\_Olstad](https://forum.ansible.com/u/Kai_Stian_Olstad)\
**Post date:** [October 31, 2016, 2:21pm UTC](https://forum.ansible.com/t/certificate-issuance-and-copying-files-across-servers/22925/3 "2016-10-31T14:21:27Z")

</div>

You can use fetch with delegate\_to: CA, den the files will be fetched from the CA server instead of host P to host A, and then a copy will copy the files to host P.

---

<div class="post-metadata">

**Author:** ![marko](https://avatars.discourse-cdn.com/v4/letter/m/dbc845/32.png) [@marko](https://forum.ansible.com/u/marko)\
**Post date:** [November 1, 2016, 6:42am UTC](https://forum.ansible.com/t/certificate-issuance-and-copying-files-across-servers/22925/4 "2016-11-01T06:42:39Z")

</div>

Got it working with your suggestions - thanks guys!

marko