Renewing #

certs.yml in ansible-collection-deevnet.mgmt lays down every certificate and trust anchor on the site, and is how certificates are renewed: re-run it. Nothing renews a certificate on a timer, so a certificate on a host nobody re-applies will expire (risk register R-12).

cd ansible-collection-deevnet.mgmt
ansible-playbook playbooks/certs.yml                 # everything
ansible-playbook playbooks/certs.yml --tags omada    # one play: trust, hypervisors, router, openbao, omada
ansible-playbook playbooks/certs.yml --limit dv02obs001v01

It needs the inventory’s vaults decrypted, and deevnet.builder and deevnet.net published (make publish in each), because the trust, hypervisor and router plays are theirs.

A run reissues only what is missing, due, unchained or misnamed #

Every certificate is reissued only when one of these holds:

it is missing;
it has fewer than 60 days left;
it no longer chains to the Deevnet Root CA (a rotated issuing CA, or a re-root);
for the hypervisors, the names it carries differ from the inventory’s.

Otherwise the run changes nothing. A run on a healthy site is changed=0 on every host.

The chain check trusts only the root it is given (openssl verify -no-CApath -no-CAstore). Without those flags OpenSSL also loads the host’s own trust store, and a certificate under a root that store still trusts would pass: in CHG-0033 the first re-run skipped the Deevnet API for exactly that reason.

certs.yml renews certificates; it does not configure services #

certs.yml does not change a service’s configuration. certs.yml renews certificates that services already name. A first build, or a change to which files a service reads, goes through that service’s own site.yml play: site.yml --skip-tags vms --limit <host>. Not --tags: a tag selects a role’s include_role, not the tasks it includes, so a container would not be recreated.

The core router’s GUI selection is manual the first time. After that, renewal replaces the certificate the GUI already uses. See Core Router.

Run certs.yml at least every ten months, and after a naming change #

At least every ten months, and after anything that might change what a certificate names: a new CNAME, a new address. The CAs are not renewed by it; see Rotating.