Implemented SAN via Letsencrypt and Certbot

roles/nginx-https-get-cert/tasks/flavors/dedicated.yml

@@ -0,0 +1,23 @@
+- name: "receive certificate for {{ domain }}"
+  command: >-
+    certbot certonly 
+    --agree-tos 
+    --email {{ users.administrator.email }}
+    --non-interactive 
+    {% if certbot_acme_challenge_method != "webroot" %}
+    --dns-{{ certbot_acme_challenge_method }}
+    --dns-{{ certbot_acme_challenge_method }}-credentials {{ certbot_credentials_file }}
+    --dns-{{ certbot_acme_challenge_method }}-propagation-seconds {{ certbot_dns_propagation_wait_seconds }}
+    {% else %}
+    --webroot 
+    -w {{ certbot_webroot_path }}
+    {% endif %}
+    {% if wildcard_domain is defined and ( wildcard_domain | bool ) %}
+    -d {{ primary_domain }} 
+    -d *.{{ primary_domain }}
+    {% else %}
+    -d {{ domain }}
+    {% endif %}
+    {{ '--test-cert' if mode_test | bool else '' }}
+  register: certbot_result
+  changed_when: "'Certificate not yet due for renewal' not in certbot_result.stdout"

roles/nginx-https-get-cert/tasks/flavors/san.yml

@@ -0,0 +1,27 @@
+- name: Install certbundle
+  include_role:
+    name: pkgmgr-install
+  vars:
+    package_name: certbundle
+  when: run_once_san_certs is not defined
+
+- name: Generate SAN certificate with certbundle
+  command: >-
+    certbundle
+    --domains "{{ all_domains | join(',') }}"
+    --certbot-email "{{ users.administrator.email }}"
+    --certbot-acme-challenge-method "{{ certbot_acme_challenge_method }}"
+    {% if certbot_acme_challenge_method != 'webroot' %}
+    --certbot-credentials-file "{{ certbot_credentials_file }}"
+    --certbot-dns-propagation-seconds "{{ certbot_dns_propagation_wait_seconds }}"
+    {% else %}
+    --certbot-webroot-path "{{ certbot_webroot_path }}"
+    {% endif %}
+    {{ '--mode-test' if mode_test | bool else '' }}
+  register: certbundle_result
+  when: run_once_san_certs is not defined
+
+- name: run the san tasks once
+  set_fact:
+    run_once_san_certs: true
+  when: run_once_san_certs is not defined

roles/nginx-https-get-cert/tasks/flavors/wildcard.yml

@@ -0,0 +1,19 @@
+- name: "Load wildcard certificate for domain"
+  include_tasks: "dedicated.yml"
+  vars:
+    wildcard_domain: true
+  when: 
+    - domain.split('.') | length == (primary_domain.split('.') | length + 1) and domain.endswith(primary_domain)
+    - run_once_receive_certificate is not defined  
+
+- name: "Load dedicated certificate for domain"
+  include_tasks: "dedicated.yml"
+  vars:
+    wildcard_domain: false
+  when: 
+    - not (domain.split('.') | length == (primary_domain.split('.') | length + 1) and domain.endswith(primary_domain))
+
+- name: run the receive_certificate tasks once
+  set_fact:
+    run_once_receive_certificate: true
+  when: run_once_receive_certificate is not defined