Loading_
Loading_
Renews certificates approaching expiry across a mixed fleet, validates the chain before swapping, reloads services gracefully and rolls back automatically on a failed health check.
---# rotate-certificates.yml## Renew certificates within --renew-window days of expiry, verify, deploy,# reload, health-check, and roll back automatically on failure.## ansible-playbook rotate-certificates.yml -e renew_window=30 --check# ansible-playbook rotate-certificates.yml -e renew_window=30 - name: Rotate TLS certificates hosts: web_servers become: true serial: "25%" # never take the whole tier at once max_fail_percentage: 0 # any failure stops the rollout vars: renew_window: 30 cert_dir: /etc/ssl/certs key_dir: /etc/ssl/private backup_dir: /var/backups/tls acme_directory: https://acme-v02.api.letsencrypt.org/directory pre_tasks: - name: Ensure backup directory exists ansible.builtin.file: path: "{{ backup_dir }}" state: directory mode: "0700"142 more lines behind the library licence
rotate-certificates.yml · 6.6 KB · 3 dependencies documented
This one is behind the licence because it is the kind of script that does real damage when it is wrong — and the version above has already been broken and fixed by two engineers in a live estate.
Certificate renewal fails in the same way every time: the new cert is deployed, the service is reloaded, and nobody notices the intermediate chain is missing until a client that does not cache it complains a week later.
This validates the full chain against the deployed bundle before touching a live service, then reloads rather than restarts wherever the service supports it, then verifies with an actual TLS handshake from the control node.
A failed post-check restores the previous certificate and fails the play, so a broken renewal never survives the run.
The platform turns any script into a governed automation — versioned, gated, audited and reversible.