# letsencrypt

**URL:** <https://forum.ansible.com/t/letsencrypt/32078>\
**Category:** Ansible Project\
**Created:** [January 28, 2020, 9:22pm UTC](https://forum.ansible.com/t/letsencrypt/32078 "2020-01-28T21:22:27Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Mauricio\_Tavares](https://avatars.discourse-cdn.com/v4/letter/m/b5e925/32.png) [@Mauricio\_Tavares](https://forum.ansible.com/u/Mauricio_Tavares)\
**Post date:** [January 28, 2020, 9:22pm UTC](https://forum.ansible.com/t/letsencrypt/32078/1 "2020-01-28T21:22:27Z")

</div>

I saw there is a module[1] that you can use to create a  
letsencrypt cert. How do you use it to renew said certificate?

[1] [https://docs.ansible.com/ansible/latest/modules/acme\_certificate\_module.html#acme-certificate-module](https://docs.ansible.com/ansible/latest/modules/acme_certificate_module.html#acme-certificate-module)

---

<div class="post-metadata">

**Author:** ![felixfontein](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/felixfontein/32/7530_2.png) [@felixfontein](https://forum.ansible.com/u/felixfontein)\
**Post date:** [January 28, 2020, 11:13pm UTC](https://forum.ansible.com/t/letsencrypt/32078/2 "2020-01-28T23:13:01Z")

</div>

Hi,

> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;I saw there is a module[1] that you can use to create a  
> letsencrypt cert. How do you use it to renew said certificate?

exactly the same as for getting a certificate in the first place. There  
is no explicit "renew" operation in the ACME protocol.

You can use the module to only start obtaining a certificate if the  
current certificate doesn't exist or is expiring in less than N days  
(see the remaining\_days option), or you can use it to always obtain a  
certificate (see the force option).

To see how to write your role/playbook so that a renewal is only made  
if the module wants to obtain a certificate, look for `register:  
sample\_com\_challenge` and `when: sample\_com\_challenge is changed` in  
the examples section.

Cheers,  
Felix

---

<div class="post-metadata">

**Author:** ![racke](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/racke/32/4767_2.png) [@racke](https://forum.ansible.com/u/racke)\
**Post date:** [January 29, 2020, 9:10am UTC](https://forum.ansible.com/t/letsencrypt/32078/3 "2020-01-29T09:10:25Z")

</div>

You could use certbot commands as alternative to this module. A proper certbot setup will  
take care of renewals (but I recommend to monitor them).

Regards  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Racke