Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteUse Ansible’s community.crypto.acme_certificate module to obtain a Let’s Encrypt certificate in two passes: request the ACME challenge, publish the returned proof for your domain, then call the module again to download the certificate. Choose HTTP-01 when the hostname reaches the Ubuntu server on port 80; choose DNS-01 when port 80 cannot be exposed or when you need a wildcard name such as *.example.com. Store the account key separately from the certificate key, deploy fullchain.pem and privkey.pem, and reload your service only when the files change.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What the Ansible workflow does
Let’s Encrypt is operated by the Internet Security Research Group and issues certificates through the Automated Certificate Management Environment (ACME) protocol. A certificate is valid for 90 days, so issuance is only half of the job: the playbook must also make renewal predictable and ensure that the service starts using the renewed key pair.
As an Amazon Associate I earn from qualifying purchases.
The community.crypto.acme_certificate module is part of the separately installed community.crypto collection; it is not included in ansible-core. The module deliberately uses two passes:
- The first task contacts the ACME directory and returns the challenge data that proves control of each requested name.
- Your playbook fulfills every returned challenge, either by serving a file over HTTP or by creating DNS TXT records.
- The second task receives the first task’s result through its
dataparameter and retrieves the signed certificate, chain, and full chain.
That separation matters because the ACME server cannot validate a domain until your infrastructure has published the challenge. The module does not edit your web server, DNS zone, firewall, or load balancer for you; those actions belong in the playbook or in the systems it calls.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
Decide between HTTP-01 and DNS-01
| Decision | HTTP-01 | DNS-01 |
|---|---|---|
| Network requirement | The requested hostname must resolve to the validating host, and inbound TCP port 80 must reach it. | No inbound HTTP connection is required; the ACME server checks DNS instead. |
| Wildcard names | Cannot validate a wildcard certificate. | Required for names such as *.example.com. |
| Proof to publish | A file or response at /.well-known/acme-challenge/<resource>. |
A TXT value at the returned _acme-challenge record. |
| Operational complexity | Usually simplest when Ansible controls the web root or a temporary listener. | Requires authoritative DNS access and enough time for TXT records to propagate. |
Use HTTP-01 for an ordinary single-host certificate when port 80 is available. Use DNS-01 for a wildcard, for an internal service that cannot accept public HTTP traffic, or when the domain’s HTTP endpoint is terminated somewhere other than the Ubuntu machine running the playbook. A DNS-01 implementation must create the TXT record in the authoritative zone, not merely in a local resolver’s configuration.
Prerequisites on Ubuntu
Domain and network checks
- Register the domain names that will appear in the certificate.
- Create DNS records so each name resolves to the endpoint that will answer the selected challenge.
- For HTTP-01, allow inbound port 80 through cloud security groups, host firewalls, reverse proxies, and NAT. A working HTTPS site alone is not sufficient if port 80 is blocked.
- For DNS-01, identify the authoritative DNS provider and confirm that an API identity can create and remove TXT records in the correct zone.
Verify DNS from outside the Ubuntu host before running Ansible. HTTP-01 failures commonly come from a name still pointing at an old server or from port 80 reaching a different proxy. DNS-01 failures commonly come from selecting the wrong parent zone, publishing the TXT record under the wrong label, or checking before propagation has completed.
Ansible collection and optional Certbot installation
Install the collection on the machine that executes the playbook:
ansible-galaxy collection install community.cryptoPin the collection version in your normal Ansible dependency process if your environment requires repeatable builds. The module will not be found until this collection is installed.
Certbot is optional when Ansible performs both ACME passes. It is useful when you want Certbot’s packaged renewal service or its web-server integrations. If Certbot manages renewal on an Ubuntu snap installation, its systemd timer runs twice daily. You can test that path without waiting for the next timer run:
certbot renew --dry-runA successful dry run tests Certbot’s renewal path, not necessarily the reload behavior of every application using the certificate. Services that do not reload automatically need an explicit deploy hook or an Ansible handler.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
Prepare ACME account and certificate keys
Keep the two private keys separate
The ACME account key identifies your account to the certificate authority. The certificate private key identifies your server. They have different lifecycles and should not be reused interchangeably. Store both outside source control, restrict the account key to the account that runs Ansible, and protect the certificate key so only the service and the deployment process can read it.
You can generate the account key and CSR before the playbook, or use modules from community.crypto to create them. Whichever method you choose, make the CSR include every DNS name that the certificate must cover. If you later replace a multi-domain certificate, request the complete intended name set rather than a subset; otherwise you may unintentionally remove names from the replacement.
Use Ansible Vault or an equivalent secret store
Keep account-key content, DNS API credentials, and any certificate private-key material in Ansible Vault or another secret-management system. Do not print these values with debug, expose them in task output, or put DNS tokens in a repository variable file that is readable by unrelated users. Mark tasks that handle secrets with no_log: true, while remembering that no_log can make troubleshooting harder; enable it specifically where sensitive values could appear.
Build the two-pass playbook
Define paths and ACME settings
The following variables illustrate the data flow. Replace the example domain and paths with values appropriate for your host, and keep the account key and CSR in protected locations.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →acme_directory: "https://acme-v02.api.letsencrypt.org/directory"
certificate_name: "example.com"
account_key_src: "/etc/letsencrypt/accounts/example-account.key"
csr_src: "/etc/letsencrypt/csr/example.com.csr"
certificate_dest: "/etc/letsencrypt/live/example.com/cert.pem"
chain_dest: "/etc/letsencrypt/live/example.com/chain.pem"
fullchain_dest: "/etc/letsencrypt/live/example.com/fullchain.pem"
private_key_dest: "/etc/letsencrypt/live/example.com/privkey.pem"The ACME directory value above is the production Let’s Encrypt directory commonly used for issuance. Keep the directory explicit in inventory or group variables so a staging directory can be selected for testing without editing task logic. A staging run avoids consuming production issuance limits, but it does not produce a certificate trusted by ordinary clients.
First pass: request challenge data
Call community.crypto.acme_certificate with the account key, contact email, CSR, challenge type, and output paths. Register the result; the returned object contains the values needed to fulfill each challenge.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
- name: Request ACME challenge data
community.crypto.acme_certificate:
account_key_src: "{{ account_key_src }}"
account_email: "[email protected]"
acme_directory: "{{ acme_directory }}"
terms_agreed: true
challenge: http-01
csr: "{{ csr_src }}"
certificate: "{{ certificate_dest }}"
chain: "{{ chain_dest }}"
fullchain: "{{ fullchain_dest }}"
remaining_days: 30
register: acme_challenge
no_log: trueremaining_days makes the operation idempotent: when the existing certificate has more than the configured number of days remaining, the playbook can avoid unnecessary issuance. Select a threshold that leaves time for a failed retry and for DNS propagation; do not force a new certificate on every run.
Fulfill HTTP-01 with a webroot
For HTTP-01, publish each returned resource_value at a path formed from its resource. The web server must serve the file without redirecting the challenge request to an authentication page. The exact webroot belongs to your server configuration; the example below assumes Ansible controls a directory already exposed at the domain’s port-80 virtual host.
- name: Publish HTTP-01 files
ansible.builtin.copy:
content: "{{ item.1.resource_value }}"
dest: "/var/www/acme/.well-known/acme-challenge/{{ item.1.resource }}"
owner: root
group: root
mode: "0644"
loop: "{{ acme_challenge.challenge_data | dict2items | subelements('value.http-01') }}"
when:
- acme_challenge.challenge_data is defined
- acme_challenge.challenge_data | length > 0Some inventories contain one challenge object per name while others expose the mapping in a different shape. Inspect the registered result once in a safe test environment and adjust the loop to your collection version; the required fields are the returned resource name and resource value. Do not log the account key while inspecting results.
If another process already occupies port 80, standalone validation cannot bind to that port. Stop or coordinate the existing listener, or use webroot mode with the running web server. If a reverse proxy is in front of the host, ensure it forwards the challenge path unchanged to the directory where Ansible writes the file.
Fulfill DNS-01 with TXT records
Set challenge: dns-01 in the first task when requesting a wildcard or when HTTP-01 is unsuitable. For every returned domain, create the supplied TXT value at the returned _acme-challenge name. The exact Ansible task depends on your DNS provider’s module or API, so keep that provider-specific operation separate from the ACME task.
- Use the authoritative zone that contains the requested name. For
www.example.com, the record may be in theexample.comzone; for delegated subdomains, it may be elsewhere. - Permit the DNS identity to change only the required TXT records. Store its token in Vault and suppress it from logs.
- Wait for authoritative DNS propagation before the second ACME pass. A short local resolver result does not prove that the public authoritative servers all return the new value.
- When several names are challenged at once, publish every returned TXT value; do not assume one value satisfies all names.
DNS-01 is the only validation route that can obtain a wildcard certificate from Let’s Encrypt. A wildcard covers one label level, so a certificate for *.example.com does not by itself cover the apex example.com; include both names in the CSR when both are needed.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
Second pass: retrieve the certificate
After the challenge is publicly available, call the same module again and pass the registered result through data. Include the certificate, chain, and full-chain destinations so the module writes the files your service will consume.
- name: Retrieve the issued certificate
community.crypto.acme_certificate:
account_key_src: "{{ account_key_src }}"
account_email: "[email protected]"
acme_directory: "{{ acme_directory }}"
terms_agreed: true
challenge: http-01
csr: "{{ csr_src }}"
data: "{{ acme_challenge }}"
certificate: "{{ certificate_dest }}"
chain: "{{ chain_dest }}"
fullchain: "{{ fullchain_dest }}"
remaining_days: 30
register: acme_certificate
no_log: trueUse the same challenge type and account settings in both passes. For DNS-01, change challenge to dns-01 in both tasks. The second pass should run only after every challenge is fulfilled and any required DNS wait has completed.
Deploy the files safely
Use the full chain and protect the private key
Ubuntu’s documented live-directory layout places the files under /etc/letsencrypt/live/<domain>/. Configure the service to present fullchain.pem to clients and to use privkey.pem as its private key. The full chain contains the server certificate and intermediates needed by clients that do not already have the intermediate certificate.
Set ownership and permissions appropriate to the service. A common baseline is root ownership and mode 0600 for the private key, with group access granted only when the daemon genuinely needs it. Never make the private key world-readable merely to simplify a reload.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Reload only after a change
Certificate files can be renewed successfully while a long-running service continues using the old key pair. Tie the service reload to the task that changes the deployed certificate, using an Ansible handler. The handler should perform a graceful reload where supported and should not run on every playbook invocation.
- name: Install full chain
ansible.builtin.copy:
src: "{{ fullchain_dest }}"
dest: "/etc/your-service/tls/fullchain.pem"
remote_src: true
owner: root
group: root
mode: "0644"
notify: Reload TLS service
- name: Install private key
ansible.builtin.copy:
src: "{{ private_key_dest }}"
dest: "/etc/your-service/tls/privkey.pem"
remote_src: true
owner: root
group: root
mode: "0600"
notify: Reload TLS service
handlers:
- name: Reload TLS service
ansible.builtin.service:
name: your-service
state: reloadedIf the service reads the files directly from the live directory, you can notify the handler from the ACME retrieval task instead. Confirm the daemon’s configuration and active listener after a renewal; checking only the file timestamp does not prove that the process loaded the new certificate.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Make renewal operational
Certbot-managed renewal
When Certbot owns the certificate, the snap installation’s systemd timer attempts renewal twice daily. Run certbot renew --dry-run after the initial setup and after changes to DNS, the webroot, firewall rules, or service hooks. Add a deploy hook for any service that does not reload automatically after Certbot replaces the files.
A renewal success message from Certbot means the certificate authority accepted the challenge and a new certificate was stored. It does not guarantee that every reverse proxy, game server, or custom daemon has reopened its key and certificate. The deploy hook must perform that application-specific reload.
Ansible-managed renewal
If Ansible performs issuance, schedule the playbook through the scheduler already approved for your fleet and run it often enough that the remaining_days threshold is reached well before expiry. The playbook should:
- Request challenge data only when the current certificate is within the renewal window or absent.
- Publish HTTP or DNS proof idempotently.
- Wait for DNS propagation when using DNS-01.
- Retrieve the certificate in the second module pass.
- Deploy changed files and notify the reload handler.
- Remove temporary HTTP challenge files or DNS TXT records after validation when your provider workflow permits it.
Do not force issuance on every scheduled run. Repeated unnecessary requests complicate incident recovery and can run into certificate-authority issuance limits. Preserve the previous working certificate until the new one has been retrieved and the service reload has succeeded.
Troubleshoot by challenge stage
| Symptom | Likely cause | What to check |
|---|---|---|
| HTTP-01 validation times out | The name points elsewhere, port 80 is blocked, or a proxy does not forward the challenge path. | Resolve the name from an external network, test TCP port 80, and request the exact /.well-known/acme-challenge/ URL. |
| Standalone validation cannot start | Another service already owns port 80. | Identify the listener, stop or coordinate it briefly, or switch to webroot or DNS-01. |
| DNS-01 remains pending | The TXT record is in the wrong zone, has not propagated, or the API token lacks permission. | Inspect authoritative DNS responses, verify the record name and value, and review the token’s zone permissions. |
| The first task succeeds but no certificate appears | The second module pass was skipped, used different parameters, or received the wrong registered data. | Confirm that data is set to the complete first-task result and that all challenges were fulfilled before the second call. |
| Renewal succeeds but clients still see the old certificate | The application kept the old key pair in memory. | Run the service’s graceful reload through a deploy hook or Ansible handler, then inspect the certificate served by the active listener. |
| A replacement loses a hostname | The CSR or renewal request omitted one of the names on the previous multi-domain certificate. | Regenerate the CSR with the complete intended name set before replacing the certificate. |
Security and reliability checklist
- Install and reference the
community.cryptocollection explicitly. - Use a dedicated ACME account key and keep it separate from the certificate private key.
- Store account keys, certificate keys, and DNS credentials in Vault or an equivalent secret store.
- Use HTTP-01 only when port 80 reaches the correct host; otherwise select DNS-01.
- Use DNS-01 for every wildcard name and publish each TXT challenge value in the authoritative zone.
- Set
remaining_daysso normal runs do not issue unnecessarily. - Write
fullchain.pemandprivkey.pemwith restrictive permissions. - Reload the consuming service only when certificate files change.
- Test renewal with
certbot renew --dry-runwhen Certbot manages the lifecycle. - After every renewal test, verify the certificate actually served by the live listener, not just the files on disk.
When this design is the right fit
Ansible is a good fit when you need the ACME transaction, challenge publication, file permissions, service reload, and secret handling represented as one repeatable deployment. The trade-off is that the playbook must own challenge fulfillment explicitly. Certbot’s server plugins can automate supported web servers, but an Ansible workflow gives you direct control over custom proxies, DNS automation, clustered hosts, and nonstandard services.
The essential pattern remains unchanged: select the challenge that matches your network and certificate scope, execute community.crypto.acme_certificate twice, publish every requested proof between those calls, deploy the full chain and private key securely, and make renewal observable through a dry run, hook, or change-triggered reload.
Recommended Free Tools
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
