# Retrieve a certificate using vault\_pki\_generate\_certificate

**URL:** <https://forum.ansible.com/t/retrieve-a-certificate-using-vault-pki-generate-certificate/39144>\
**Category:** Get Help\
**Created:** [December 13, 2024, 4:19pm UTC](https://forum.ansible.com/t/retrieve-a-certificate-using-vault-pki-generate-certificate/39144 "2024-12-13T16:19:25Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![abdellahbrahimi](https://avatars.discourse-cdn.com/v4/letter/a/cab0a1/32.png) [@abdellahbrahimi](https://forum.ansible.com/u/abdellahbrahimi)\
**Post date:** [December 13, 2024, 4:19pm UTC](https://forum.ansible.com/t/retrieve-a-certificate-using-vault-pki-generate-certificate/39144/1 "2024-12-13T16:19:25Z")

</div>

I try to retrieve a certificate from Vault server.  
So, my playbook look like this:

```auto
- name: Get Certificate from Vault, using Vault Module
  hosts: localhost
  tasks:
     - name: Issue cert from Vault
       community.hashi_vault.vault_pki_generate_certificate:
         common_name: "Censored-CA"
         role_name: censored-role
         engine_mount_point: "pki/censored-ca"
         url: https://vault.censored.censor
      register: data_response

    - name: Display the result
      ansible.builtin.debug:
        msg: " test {{ data_response }}"

```

but I got this

```auto
PLAY [Get Certificate from Vault, using Vault Module] **************************************************************************************************************************************

TASK [Gathering Facts] *********************************************************************************************************************************************************************
ok: [localhost]

TASK [Login and use the resulting Token] ***************************************************************************************************************************************************
changed: [localhost]

TASK [Issue cert from Vault] ***************************************************************************************************************************************************************
An exception occurred during task execution. To see the full traceback, use -vvv. The error was: , on post https://vault.censored.censor/v1/pki/censored-ca/issue/role-censored
fatal: [localhost]: FAILED! => {
    "changed": false
}

MSG:

1 error occurred:
        * could not fetch the CA certificate (was one set?): unable to fetch corresponding key for issuer issuer_censored ; unable to use this issuer for signing

, on post https://vault.censored.censor/v1/pki/censored-ca/issue/role-censored

PLAY RECAP *********************************************************************************************************************************************************************************
localhost : ok=2 changed=1 unreachable=0 failed=1 skipped=0 rescued=0 ignored=0

```

Please, can you help me? I feel lost. I look at the documentation but I can’t figure out. I will be very thankful if you help me or give me guidance. Thanks in advance.

---

<div class="post-metadata">

**Author:** ![abdellahbrahimi](https://avatars.discourse-cdn.com/v4/letter/a/cab0a1/32.png) [@abdellahbrahimi](https://forum.ansible.com/u/abdellahbrahimi)\
**Post date:** [December 16, 2024, 10:49am UTC](https://forum.ansible.com/t/retrieve-a-certificate-using-vault-pki-generate-certificate/39144/2 "2024-12-16T10:49:15Z")

</div>

Well, I notice, that nobody response to this question.  
But I did manage to find a solution that worked for me.  
So the problem was that I didn’t bundle the private key inside the certificate, and also pay attention to domain name, where you should allow the domain name that you use in your machine.

I hope this help.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/ansible/original/1X/1882d9a01da5d8996a862359b0913cc568a39b84.svg) [@system](https://forum.ansible.com/u/system)\
**Post date:** [January 15, 2025, 10:49am UTC](https://forum.ansible.com/t/retrieve-a-certificate-using-vault-pki-generate-certificate/39144/3 "2025-01-15T10:49:28Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.