david_igou.routeros_configuration.certificate role – Create and sign RouterOS certificates over the API.

Note

This role is part of the david_igou.routeros_configuration collection (version 0.0.8-alpha).

It is not included in ansible-core. To check whether it is installed, run ansible-galaxy collection list.

To install it use: ansible-galaxy collection install david_igou.routeros_configuration.

To use it in a playbook, specify: david_igou.routeros_configuration.certificate.

Entry point main – Create and sign RouterOS certificates over the API.

Synopsis

  • Creates certificate requests and signs them, idempotently (by name; a cert that already exists and is signed is left untouched).

  • Uses community.routeros.api because api_modify treats certificate as read-only.

Parameters

Parameter

Comments

routeros_acme

list / elements=dictionary

ACME (Let’s Encrypt) requests. Gated/untested on a CHR.

Default: []

args

string / required

Arguments passed to /certificate add-acme.

routeros_api_hostname

string

API hostname/IP of the device.

Default: "{{ inventory_hostname }}"

routeros_api_password

string

API password. Secret — supply via vault. The module marks it no_log.

routeros_api_port

any

TCP port; empty lets the module choose from tls.

Default: ""

routeros_api_tls

boolean

Use TLS (api-ssl).

Choices:

  • false

  • true ← (default)

routeros_api_username

string

API username.

Default: "admin"

routeros_api_validate_certs

boolean

Validate the device TLS certificate.

Choices:

  • false

  • true ← (default)

routeros_certificates

list / elements=dictionary

Certificates to create and sign.

Default: []

ca

string

Name of the signing CA certificate. Omit for self-signed.

common_name

string / required

Certificate common name (CN).

days_valid

integer

Validity period in days.

Default: 365

key_size

integer

RSA key size.

Default: 2048

key_usage

list / elements=string

Key usages (e.g. key-cert-sign, crl-sign for a CA).

name

string / required

Certificate name.

routeros_certificates_export

list / elements=dictionary

Certificates to export to files on the device.

Default: []

export_passphrase

string

Passphrase to encrypt the exported key.

file_name

string

Output file name (default = name).

name

string / required

Certificate name to export.

type

string

Export type (pem/pkcs12).

Default: "pem"

routeros_certificates_import

list / elements=dictionary

Certificates to import from files.

Default: []

file_name

string / required

File to import.

name

string

Name for the imported certificate.

passphrase

string

Passphrase for an encrypted key.

Examples

# Create a self-signed CA (no ca:) and a host certificate signed by it.
# Idempotent by name.
- hosts: routers
  gather_facts: false
  roles:
    - role: david_igou.routeros_configuration.certificate
      vars:
        routeros_certificates:
          - name: local-ca
            common_name: Local CA
            key_usage:
              - key-cert-sign
              - crl-sign
          - name: api-cert
            common_name: router.example.com
            ca: local-ca

# Export a certificate to a PEM file on the device (passphrase-protected key).
- hosts: routers
  gather_facts: false
  roles:
    - role: david_igou.routeros_configuration.certificate
      vars:
        routeros_certificates_export:
          - name: local-ca
            file_name: local-ca
            type: pem
            export_passphrase: "{{ vault_cert_passphrase }}"

# Import a certificate from a file already on the device, naming it on import.
- hosts: routers
  gather_facts: false
  roles:
    - role: david_igou.routeros_configuration.certificate
      vars:
        routeros_certificates_import:
          - file_name: api-cert.crt
            name: api-cert-imported
            passphrase: "{{ vault_cert_passphrase }}"