An Ansible playbook generates the key pairs and the CSRs.  Specifically:

  • The key lives where the playbook determines it to. For example: a key manager, the host, or an HSM.
  • Certificate Manager receives the CSR and issues the certificate.
  • The user playbook deploys the certificate and the key.

This strategy requires the following settings.

​Pre-issuance Playbook

Upload an Ansible playbook that runs on target hosts before certificate enrollment to:

  • Generate a key pair and CSR
  • Create directories or perform any pre-enrollment setup.

Specifically:

  • If the bulk destination selected in Step 2 - Target does not set a Key Destination File Path, this playbook must handle key placement. 
  • The playbook must register the CSR PEM encoding in an Ansible variable for Certificate Manager to issue the certificate.

See Downloading the installation files for instructions on downloading the Certificate Manager Ansible Sample Playbooks compressed file.

Mandatory: Yes.

CSR PEM Output Variable

The name of the Ansible variable in your Pre-issuance Playbook that holds the PEM encoding of the CSR. Certificate Manager will read this variable to issue the certificate. See the table below for examples.

Playbook definition

Variable name

​register: csr_pem

csr_pem​

set_fact: csr_pem: '{{ csr_output.stdout }}' 

csr_pem

Mandatory: Yes.

Pre-Issuance Extra Variables

The YAML or JSON specification of the variables required by the imported playbook

Mandatory: When the Pre-issuance Playbook requires variables that are not defined within the playbook itself.