# letsencrypt module - account\_key

**URL:** <https://forum.ansible.com/t/letsencrypt-module-account-key/26726>\
**Category:** Ansible Project\
**Created:** [February 13, 2018, 11:06pm UTC](https://forum.ansible.com/t/letsencrypt-module-account-key/26726 "2018-02-13T23:06:29Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Michael\_Bubb](https://avatars.discourse-cdn.com/v4/letter/m/f17d59/32.png) [@Michael\_Bubb](https://forum.ansible.com/u/Michael_Bubb)\
**Post date:** [February 13, 2018, 11:06pm UTC](https://forum.ansible.com/t/letsencrypt-module-account-key/26726/1 "2018-02-13T23:06:29Z")

</div>

Hello -

I am a little confused by what is needed in the account\_key parameter.

The docs say it is:

> _ **File containing the Let’s Encrypt account RSA key.** _  
> _ **Can be created with `openssl rsa ...`.** _  
> |
> 
> - |

I know when I first setup the account it generated keys in /etc/letsencrypt/accounts/…

They are in a json format though:

[https://github.com/certbot/certbot/blob/master/tests/letstest/testdata/sample-config/accounts/acme-staging.api.letsencrypt.org/directory/48d6b9e8d767eccf7e4d877d6ffa81e3/private\_key.json](https://github.com/certbot/certbot/blob/master/tests/letstest/testdata/sample-config/accounts/acme-staging.api.letsencrypt.org/directory/48d6b9e8d767eccf7e4d877d6ffa81e3/private_key.json)

I didnt think they needed to be created - perhaps an openssl export?

what is that parameter looking for?

thanks

Michael

---

<div class="post-metadata">

**Author:** ![felixfontein](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/felixfontein/32/7530_2.png) [@felixfontein](https://forum.ansible.com/u/felixfontein)\
**Post date:** [February 14, 2018, 8:30am UTC](https://forum.ansible.com/t/letsencrypt-module-account-key/26726/2 "2018-02-14T08:30:45Z")

</div>

Hi,

> I am a little confused by what is needed in the account\_key parameter.
> 
> The docs say it is:
> 
> \*File containing the Let's Encrypt account RSA key.\*  
> \*Can be created with openssl rsa ....\*  
> I know when I first setup the account it generated keys in  
> /etc/letsencrypt/accounts/...
> 
> They are in a json format though:

well, the ones used by CertBot are in JSON, that is. There are many  
different ACME (the Let's Encrypt protocol) clients, and some use JWK  
(JSON Web Key), while others (like acme-tiny and the one integrated in  
Ansible) use PEM.

> [https://github.com/certbot/certbot/blob/master/tests/letstest/testdata/sample-config/accounts/acme-staging.api.letsencrypt.org/directory/48d6b9e8d767eccf7e4d877d6ffa81e3/private\_key.json](https://github.com/certbot/certbot/blob/master/tests/letstest/testdata/sample-config/accounts/acme-staging.api.letsencrypt.org/directory/48d6b9e8d767eccf7e4d877d6ffa81e3/private_key.json)
> 
> I didnt think they needed to be created - perhaps an openssl export?

Either you simply create a new key, or you convert your existing key  
(assuming you have one) using for example this method:  
[https://github.com/diafygi/acme-tiny/#use-existing-lets-encrypt-key](https://github.com/diafygi/acme-tiny/#use-existing-lets-encrypt-key)

> what is that parameter looking for?

If you have an existing account key (say, from CertBot) and want to use  
Ansible to create certificates for the same sets of domains, it's  
probably best if you convert the existing key. Otherwise, creating a  
new one is fine. Just keep whatever key you use secret and don't delete  
it.

Best regards,  
Felix

---

<div class="post-metadata">

**Author:** ![Michael\_Bubb](https://avatars.discourse-cdn.com/v4/letter/m/f17d59/32.png) [@Michael\_Bubb](https://forum.ansible.com/u/Michael_Bubb)\
**Post date:** [February 15, 2018, 6:18pm UTC](https://forum.ansible.com/t/letsencrypt-module-account-key/26726/3 "2018-02-15T18:18:38Z")

</div>

Thank you