<linkrel="next"title="community.crypto.ecs_domain module – Request validation of a domain with the Entrust Certificate Services (ECS) API"href="ecs_domain_module.html"/>
<linkrel="prev"title="community.crypto.crypto_info module – Retrieve cryptographic capabilities"href="crypto_info_module.html"/><!-- extra head elements for Ansible beyond RTD Sphinx Theme -->
</head>
<bodyclass="wy-body-for-nav"><!-- extra body elements for Ansible beyond RTD Sphinx Theme -->
<liclass="toctree-l1"><aclass="reference internal"href="docsite/guide_selfsigned.html">How to create self-signed certificates</a></li>
<liclass="toctree-l1"><aclass="reference internal"href="docsite/guide_ownca.html">How to create a small CA</a></li>
</ul>
<ulclass="current">
<liclass="toctree-l1"><aclass="reference internal"href="acme_account_module.html">community.crypto.acme_account module – Create, modify or delete ACME accounts</a></li>
<liclass="toctree-l1"><aclass="reference internal"href="acme_account_info_module.html">community.crypto.acme_account_info module – Retrieves information on ACME accounts</a></li>
<liclass="toctree-l1"><aclass="reference internal"href="acme_certificate_module.html">community.crypto.acme_certificate module – Create SSL/TLS certificates with the ACME protocol</a></li>
<liclass="toctree-l1"><aclass="reference internal"href="acme_certificate_revoke_module.html">community.crypto.acme_certificate_revoke module – Revoke certificates with the ACME protocol</a></li>
<liclass="toctree-l1"><aclass="reference internal"href="acme_challenge_cert_helper_module.html">community.crypto.acme_challenge_cert_helper module – Prepare certificates required for ACME challenges such as <codeclass="docutils literal notranslate"><spanclass="pre">tls-alpn-01</span></code></a></li>
<liclass="toctree-l1"><aclass="reference internal"href="acme_inspect_module.html">community.crypto.acme_inspect module – Send direct requests to an ACME server</a></li>
<liclass="toctree-l1"><aclass="reference internal"href="certificate_complete_chain_module.html">community.crypto.certificate_complete_chain module – Complete certificate chain given a set of untrusted and root certificates</a></li>
<liclass="toctree-l1"><aclass="reference internal"href="ecs_domain_module.html">community.crypto.ecs_domain module – Request validation of a domain with the Entrust Certificate Services (ECS) API</a></li>
<liclass="toctree-l1"><aclass="reference internal"href="get_certificate_module.html">community.crypto.get_certificate module – Get a certificate from a host:port</a></li>
<liclass="toctree-l1"><aclass="reference internal"href="openssh_cert_module.html">community.crypto.openssh_cert module – Generate OpenSSH host or user certificates.</a></li>
<liclass="toctree-l1"><aclass="reference internal"href="openssh_keypair_module.html">community.crypto.openssh_keypair module – Generate OpenSSH private and public keys</a></li>
<liclass="toctree-l1"><aclass="reference internal"href="openssl_csr_info_module.html">community.crypto.openssl_csr_info module – Provide information of OpenSSL Certificate Signing Requests (CSR)</a></li>
<liclass="toctree-l1"><aclass="reference internal"href="openssl_privatekey_info_module.html">community.crypto.openssl_privatekey_info module – Provide information for OpenSSL private keys</a></li>
<liclass="toctree-l1"><aclass="reference internal"href="openssl_privatekey_pipe_module.html">community.crypto.openssl_privatekey_pipe module – Generate OpenSSL private keys without disk access</a></li>
<liclass="toctree-l1"><aclass="reference internal"href="openssl_publickey_module.html">community.crypto.openssl_publickey module – Generate an OpenSSL public key from its private key.</a></li>
<liclass="toctree-l1"><aclass="reference internal"href="openssl_publickey_info_module.html">community.crypto.openssl_publickey_info module – Provide information for OpenSSL public keys</a></li>
<liclass="toctree-l1"><aclass="reference internal"href="openssl_signature_module.html">community.crypto.openssl_signature module – Sign data with openssl</a></li>
<liclass="toctree-l1"><aclass="reference internal"href="openssl_signature_info_module.html">community.crypto.openssl_signature_info module – Verify signatures with openssl</a></li>
<liclass="toctree-l1"><aclass="reference internal"href="x509_certificate_info_module.html">community.crypto.x509_certificate_info module – Provide information of OpenSSL X.509 certificates</a></li>
<liclass="toctree-l1"><aclass="reference internal"href="gpg_fingerprint_filter.html">community.crypto.gpg_fingerprint filter – Retrieve a GPG fingerprint from a GPG public or private key</a></li>
<liclass="toctree-l1"><aclass="reference internal"href="openssl_privatekey_info_filter.html">community.crypto.openssl_privatekey_info filter – Retrieve information from OpenSSL private keys</a></li>
<liclass="toctree-l1"><aclass="reference internal"href="openssl_publickey_info_filter.html">community.crypto.openssl_publickey_info filter – Retrieve information from OpenSSL public keys in PEM format</a></li>
<liclass="toctree-l1"><aclass="reference internal"href="x509_certificate_info_filter.html">community.crypto.x509_certificate_info filter – Retrieve information from X.509 certificates in PEM format</a></li>
<liclass="toctree-l1"><aclass="reference internal"href="x509_crl_info_filter.html">community.crypto.x509_crl_info filter – Retrieve information from X.509 CRLs in PEM format</a></li>
<liclass="toctree-l1"><aclass="reference internal"href="gpg_fingerprint_lookup.html">community.crypto.gpg_fingerprint lookup – Retrieve a GPG fingerprint from a GPG public or private key file</a></li>
<liclass="breadcrumb-item active">community.crypto.ecs_certificate module – Request SSL/TLS certificates with the Entrust Certificate Services (ECS) API</li>
<liclass="wy-breadcrumbs-aside">
<!-- User defined GitHub URL -->
<ahref="https://github.com/ansible-collections/community.crypto/edit/main/plugins/modules/ecs_certificate.py?description=%23%23%23%23%23%20SUMMARY%0A%3C!—%20Your%20description%20here%20–%3E%0A%0A%0A%23%23%23%23%23%20ISSUE%20TYPE%0A-%20Docs%20Pull%20Request%0A%0A%2Blabel:%20docsite_pr"class="fa fa-github"> Edit on GitHub</a>
<h1>community.crypto.ecs_certificate module – Request SSL/TLS certificates with the Entrust Certificate Services (ECS) API<aclass="headerlink"href="#community-crypto-ecs-certificate-module-request-ssl-tls-certificates-with-the-entrust-certificate-services-ecs-api"title="Link to this heading"></a></h1>
<p>This module is part of the <aclass="reference external"href="https://galaxy.ansible.com/community/crypto">community.crypto collection</a> (version 2.15.1).</p>
You need further requirements to be able to use this module,
see <aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-requirements"><spanclass="std std-ref">Requirements</span></a> for details.</p>
<p>To use it in a playbook, specify: <codeclass="code docutils literal notranslate"><spanclass="pre">community.crypto.ecs_certificate</span></code>.</p>
<li><p>Create, reissue, and renew certificates with the Entrust Certificate Services (ECS) API.</p></li>
<li><p>Requires credentials for the <aclass="reference external"href="https://www.entrustdatacard.com/products/categories/ssl-certificates">Entrust Certificate Services</a> (ECS) API.</p></li>
<li><p>In order to request a certificate, the domain and organization used in the certificate signing request must be already validated in the ECS system. It is <em>not</em> the responsibility of this module to perform those steps.</p></li>
<spanid="ansible-collections-community-crypto-ecs-certificate-module-requirements"></span><h2><aclass="toc-backref"href="#id2"role="doc-backlink">Requirements</a><aclass="headerlink"href="#requirements"title="Link to this heading"></a></h2>
<aclass="ansibleOptionLink"href="#parameter-additional_emails"title="Permalink to this option"></a><pclass="ansible-option-type-line"><spanclass="ansible-option-type">list</span> / <spanclass="ansible-option-elements">elements=string</span></p>
</div></td>
<td><divclass="ansible-option-cell"><p>A list of additional email addresses to receive the delivery notice and expiry notification for the certificate.</p>
<aclass="ansibleOptionLink"href="#parameter-backup"title="Permalink to this option"></a><pclass="ansible-option-type-line"><spanclass="ansible-option-type">boolean</span></p>
<td><divclass="ansible-option-cell"><p>Whether a backup should be made for the certificate in <codeclass="ansible-option docutils literal notranslate"><strong><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-path"><spanclass="std std-ref"><spanclass="pre">path</span></span></a></strong></code>.</p>
<aclass="ansibleOptionLink"href="#parameter-cert_expiry"title="Permalink to this option"></a><pclass="ansible-option-type-line"><spanclass="ansible-option-type">string</span></p>
<td><divclass="ansible-option-cell"><p>The date the certificate should be set to expire, in RFC3339 compliant date or date-time format. For example, <codeclass="ansible-value docutils literal notranslate"><spanclass="pre">2020-02-23</span></code>, <codeclass="ansible-value docutils literal notranslate"><spanclass="pre">2020-02-23T15:00:00.05Z</span></code>.</p>
<p><codeclass="ansible-option docutils literal notranslate"><strong><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-cert-expiry"><spanclass="std std-ref"><spanclass="pre">cert_expiry</span></span></a></strong></code> is only supported for requests of <codeclass="ansible-option-value docutils literal notranslate"><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-request-type"><spanclass="std std-ref"><spanclass="pre">request_type=new</span></span></a></code> or <codeclass="ansible-option-value docutils literal notranslate"><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-request-type"><spanclass="std std-ref"><spanclass="pre">request_type=renew</span></span></a></code>. If <codeclass="ansible-option-value docutils literal notranslate"><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-request-type"><spanclass="std std-ref"><spanclass="pre">request_type=reissue</span></span></a></code>, <codeclass="ansible-option docutils literal notranslate"><strong><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-cert-expiry"><spanclass="std std-ref"><spanclass="pre">cert_expiry</span></span></a></strong></code> will be used for the first certificate issuance, but subsequent issuances will have the same expiry as the initial certificate.</p>
<p>A reissued certificate will always have the same expiry as the original certificate.</p>
<p>Note that only the date (day, month, year) is supported for specifying the expiry date. If you choose to specify an expiry time with the expiry date, the time will be adjusted to Eastern Standard Time (EST). This could have the unintended effect of moving your expiry date to the previous day.</p>
<p>Applies only to accounts with a pooling inventory model.</p>
<p>Only one of <codeclass="ansible-option docutils literal notranslate"><strong><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-cert-expiry"><spanclass="std std-ref"><spanclass="pre">cert_expiry</span></span></a></strong></code> or <codeclass="ansible-option docutils literal notranslate"><strong><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-cert-lifetime"><spanclass="std std-ref"><spanclass="pre">cert_lifetime</span></span></a></strong></code> may be specified.</p>
<aclass="ansibleOptionLink"href="#parameter-cert_lifetime"title="Permalink to this option"></a><pclass="ansible-option-type-line"><spanclass="ansible-option-type">string</span></p>
</div></td>
<td><divclass="ansible-option-cell"><p>The lifetime of the certificate.</p>
<p>Applies to all certificates for accounts with a non-pooling inventory model.</p>
<p><codeclass="ansible-option docutils literal notranslate"><strong><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-cert-lifetime"><spanclass="std std-ref"><spanclass="pre">cert_lifetime</span></span></a></strong></code> is only supported for requests of <codeclass="ansible-option-value docutils literal notranslate"><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-request-type"><spanclass="std std-ref"><spanclass="pre">request_type=new</span></span></a></code> or <codeclass="ansible-option-value docutils literal notranslate"><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-request-type"><spanclass="std std-ref"><spanclass="pre">request_type=renew</span></span></a></code>. If <codeclass="ansible-option-value docutils literal notranslate"><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-request-type"><spanclass="std std-ref"><spanclass="pre">request_type=reissue</span></span></a></code>, <codeclass="ansible-option docutils literal notranslate"><strong><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-cert-lifetime"><spanclass="std std-ref"><spanclass="pre">cert_lifetime</span></span></a></strong></code> will be used for the first certificate issuance, but subsequent issuances will have the same expiry as the initial certificate.</p>
<p>Applies to certificates of <codeclass="ansible-option-value docutils literal notranslate"><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-cert-type"><spanclass="std std-ref"><spanclass="pre">cert_type=CDS_INDIVIDUAL</span></span></a></code>, <codeclass="ansible-value docutils literal notranslate"><spanclass="pre">CDS_GROUP</span></code>, <codeclass="ansible-value docutils literal notranslate"><spanclass="pre">CDS_ENT_LITE</span></code>, <codeclass="ansible-value docutils literal notranslate"><spanclass="pre">CDS_ENT_PRO</span></code>, or <codeclass="ansible-value docutils literal notranslate"><spanclass="pre">SMIME_ENT</span></code> for accounts with a pooling inventory model.</p>
<p><codeclass="ansible-value docutils literal notranslate"><spanclass="pre">P1Y</span></code> is a certificate with a 1 year lifetime.</p>
<p><codeclass="ansible-value docutils literal notranslate"><spanclass="pre">P2Y</span></code> is a certificate with a 2 year lifetime.</p>
<p><codeclass="ansible-value docutils literal notranslate"><spanclass="pre">P3Y</span></code> is a certificate with a 3 year lifetime.</p>
<p>Only one of <codeclass="ansible-option docutils literal notranslate"><strong><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-cert-expiry"><spanclass="std std-ref"><spanclass="pre">cert_expiry</span></span></a></strong></code> or <codeclass="ansible-option docutils literal notranslate"><strong><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-cert-lifetime"><spanclass="std std-ref"><spanclass="pre">cert_lifetime</span></span></a></strong></code> may be specified.</p>
<aclass="ansibleOptionLink"href="#parameter-cert_type"title="Permalink to this option"></a><pclass="ansible-option-type-line"><spanclass="ansible-option-type">string</span></p>
</div></td>
<td><divclass="ansible-option-cell"><p>Specify the type of certificate requested.</p>
<p>If a certificate is being reissued or renewed, this parameter is ignored, and the <codeclass="ansible-option docutils literal notranslate"><strong><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-cert-type"><spanclass="std std-ref"><spanclass="pre">cert_type</span></span></a></strong></code> of the initial certificate is used.</p>
<aclass="ansibleOptionLink"href="#parameter-client_id"title="Permalink to this option"></a><pclass="ansible-option-type-line"><spanclass="ansible-option-type">integer</span></p>
</div></td>
<td><divclass="ansible-option-cell"><p>The client ID to submit the Certificate Signing Request under.</p>
<p>If no client ID is specified, the certificate will be submitted under the primary client with ID of 1.</p>
<p>When using a client other than the primary client, the <codeclass="ansible-option docutils literal notranslate"><strong><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-org"><spanclass="std std-ref"><spanclass="pre">org</span></span></a></strong></code> parameter cannot be specified.</p>
<aclass="ansibleOptionLink"href="#parameter-csr"title="Permalink to this option"></a><pclass="ansible-option-type-line"><spanclass="ansible-option-type">string</span></p>
<td><divclass="ansible-option-cell"><p>Base-64 encoded Certificate Signing Request (CSR). <codeclass="ansible-option docutils literal notranslate"><strong><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-csr"><spanclass="std std-ref"><spanclass="pre">csr</span></span></a></strong></code> is accepted with or without PEM formatting around the Base-64 string.</p>
<p>If no <codeclass="ansible-option docutils literal notranslate"><strong><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-csr"><spanclass="std std-ref"><spanclass="pre">csr</span></span></a></strong></code> is provided when <codeclass="ansible-option-value docutils literal notranslate"><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-request-type"><spanclass="std std-ref"><spanclass="pre">request_type=reissue</span></span></a></code> or <codeclass="ansible-option-value docutils literal notranslate"><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-request-type"><spanclass="std std-ref"><spanclass="pre">request_type=renew</span></span></a></code>, the certificate will be generated with the same public key as the certificate being renewed or reissued.</p>
<p>If <codeclass="ansible-option docutils literal notranslate"><strong><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-subject-alt-name"><spanclass="std std-ref"><spanclass="pre">subject_alt_name</span></span></a></strong></code> is specified, it will override the subject alternate names in the CSR.</p>
<p>If <codeclass="ansible-option docutils literal notranslate"><strong><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-eku"><spanclass="std std-ref"><spanclass="pre">eku</span></span></a></strong></code> is specified, it will override the extended key usage in the CSR.</p>
<p>If <codeclass="ansible-option docutils literal notranslate"><strong><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-ou"><spanclass="std std-ref"><spanclass="pre">ou</span></span></a></strong></code> is specified, it will override the organizational units “ou=” present in the subject distinguished name of the CSR, if any.</p>
<p>The organization “O=” field from the CSR will not be used. It will be replaced in the issued certificate by <codeclass="ansible-option docutils literal notranslate"><strong><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-org"><spanclass="std std-ref"><spanclass="pre">org</span></span></a></strong></code> if present, and if not present, the organization tied to <codeclass="ansible-option docutils literal notranslate"><strong><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-client-id"><spanclass="std std-ref"><spanclass="pre">client_id</span></span></a></strong></code>.</p>
<aclass="ansibleOptionLink"href="#parameter-ct_log"title="Permalink to this option"></a><pclass="ansible-option-type-line"><spanclass="ansible-option-type">boolean</span></p>
</div></td>
<td><divclass="ansible-option-cell"><p>In compliance with browser requirements, this certificate may be posted to the Certificate Transparency (CT) logs. This is a best practice technique that helps domain owners monitor certificates issued to their domains. Note that not all certificates are eligible for CT logging.</p>
<p>If <codeclass="ansible-option docutils literal notranslate"><strong><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-ct-log"><spanclass="std std-ref"><spanclass="pre">ct_log</span></span></a></strong></code> is not specified, the certificate uses the account default.</p>
<p>If <codeclass="ansible-option docutils literal notranslate"><strong><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-ct-log"><spanclass="std std-ref"><spanclass="pre">ct_log</span></span></a></strong></code> is specified and the account settings allow it, <codeclass="ansible-option docutils literal notranslate"><strong><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-ct-log"><spanclass="std std-ref"><spanclass="pre">ct_log</span></span></a></strong></code> overrides the account default.</p>
<p>If <codeclass="ansible-option docutils literal notranslate"><strong><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-ct-log"><spanclass="std std-ref"><spanclass="pre">ct_log</span></span></a></strong></code> is set to <codeclass="ansible-value docutils literal notranslate"><spanclass="pre">false</span></code>, but the account settings are set to “always log”, the certificate generation will fail.</p>
<aclass="ansibleOptionLink"href="#parameter-custom_fields"title="Permalink to this option"></a><pclass="ansible-option-type-line"><spanclass="ansible-option-type">dictionary</span></p>
</div></td>
<td><divclass="ansible-option-cell"><p>Mapping of custom fields to associate with the certificate request and certificate.</p>
<p>Only supported if custom fields are enabled for your account.</p>
<p>Each custom field specified must be a custom field you have defined for your account.</p>
<aclass="ansibleOptionLink"href="#parameter-custom_fields/date1"title="Permalink to this option"></a><pclass="ansible-option-type-line"><spanclass="ansible-option-type">string</span></p>
</div></td>
<td><divclass="ansible-option-indent-desc"></div><divclass="ansible-option-cell"><p>Custom date field.</p>
<aclass="ansibleOptionLink"href="#parameter-custom_fields/date2"title="Permalink to this option"></a><pclass="ansible-option-type-line"><spanclass="ansible-option-type">string</span></p>
</div></td>
<td><divclass="ansible-option-indent-desc"></div><divclass="ansible-option-cell"><p>Custom date field.</p>
<aclass="ansibleOptionLink"href="#parameter-custom_fields/date3"title="Permalink to this option"></a><pclass="ansible-option-type-line"><spanclass="ansible-option-type">string</span></p>
</div></td>
<td><divclass="ansible-option-indent-desc"></div><divclass="ansible-option-cell"><p>Custom date field.</p>
<aclass="ansibleOptionLink"href="#parameter-custom_fields/date4"title="Permalink to this option"></a><pclass="ansible-option-type-line"><spanclass="ansible-option-type">string</span></p>
</div></td>
<td><divclass="ansible-option-indent-desc"></div><divclass="ansible-option-cell"><p>Custom date field.</p>
<aclass="ansibleOptionLink"href="#parameter-custom_fields/date5"title="Permalink to this option"></a><pclass="ansible-option-type-line"><spanclass="ansible-option-type">string</span></p>
</div></td>
<td><divclass="ansible-option-indent-desc"></div><divclass="ansible-option-cell"><p>Custom date field.</p>
<aclass="ansibleOptionLink"href="#parameter-custom_fields/dropdown1"title="Permalink to this option"></a><pclass="ansible-option-type-line"><spanclass="ansible-option-type">string</span></p>
<aclass="ansibleOptionLink"href="#parameter-custom_fields/dropdown2"title="Permalink to this option"></a><pclass="ansible-option-type-line"><spanclass="ansible-option-type">string</span></p>
<aclass="ansibleOptionLink"href="#parameter-custom_fields/dropdown3"title="Permalink to this option"></a><pclass="ansible-option-type-line"><spanclass="ansible-option-type">string</span></p>
<aclass="ansibleOptionLink"href="#parameter-custom_fields/dropdown4"title="Permalink to this option"></a><pclass="ansible-option-type-line"><spanclass="ansible-option-type">string</span></p>
<aclass="ansibleOptionLink"href="#parameter-custom_fields/dropdown5"title="Permalink to this option"></a><pclass="ansible-option-type-line"><spanclass="ansible-option-type">string</span></p>
<aclass="ansibleOptionLink"href="#parameter-custom_fields/email1"title="Permalink to this option"></a><pclass="ansible-option-type-line"><spanclass="ansible-option-type">string</span></p>
<aclass="ansibleOptionLink"href="#parameter-custom_fields/email2"title="Permalink to this option"></a><pclass="ansible-option-type-line"><spanclass="ansible-option-type">string</span></p>
<aclass="ansibleOptionLink"href="#parameter-custom_fields/email3"title="Permalink to this option"></a><pclass="ansible-option-type-line"><spanclass="ansible-option-type">string</span></p>
<aclass="ansibleOptionLink"href="#parameter-custom_fields/email4"title="Permalink to this option"></a><pclass="ansible-option-type-line"><spanclass="ansible-option-type">string</span></p>
<aclass="ansibleOptionLink"href="#parameter-custom_fields/email5"title="Permalink to this option"></a><pclass="ansible-option-type-line"><spanclass="ansible-option-type">string</span></p>
<aclass="ansibleOptionLink"href="#parameter-custom_fields/number1"title="Permalink to this option"></a><pclass="ansible-option-type-line"><spanclass="ansible-option-type">float</span></p>
</div></td>
<td><divclass="ansible-option-indent-desc"></div><divclass="ansible-option-cell"><p>Custom number field.</p>
<aclass="ansibleOptionLink"href="#parameter-custom_fields/number2"title="Permalink to this option"></a><pclass="ansible-option-type-line"><spanclass="ansible-option-type">float</span></p>
</div></td>
<td><divclass="ansible-option-indent-desc"></div><divclass="ansible-option-cell"><p>Custom number field.</p>
<aclass="ansibleOptionLink"href="#parameter-custom_fields/number3"title="Permalink to this option"></a><pclass="ansible-option-type-line"><spanclass="ansible-option-type">float</span></p>
</div></td>
<td><divclass="ansible-option-indent-desc"></div><divclass="ansible-option-cell"><p>Custom number field.</p>
<aclass="ansibleOptionLink"href="#parameter-custom_fields/number4"title="Permalink to this option"></a><pclass="ansible-option-type-line"><spanclass="ansible-option-type">float</span></p>
</div></td>
<td><divclass="ansible-option-indent-desc"></div><divclass="ansible-option-cell"><p>Custom number field.</p>
<aclass="ansibleOptionLink"href="#parameter-custom_fields/number5"title="Permalink to this option"></a><pclass="ansible-option-type-line"><spanclass="ansible-option-type">float</span></p>
</div></td>
<td><divclass="ansible-option-indent-desc"></div><divclass="ansible-option-cell"><p>Custom number field.</p>
<aclass="ansibleOptionLink"href="#parameter-custom_fields/text1"title="Permalink to this option"></a><pclass="ansible-option-type-line"><spanclass="ansible-option-type">string</span></p>
</div></td>
<td><divclass="ansible-option-indent-desc"></div><divclass="ansible-option-cell"><p>Custom text field (maximum 500 characters)</p>
<aclass="ansibleOptionLink"href="#parameter-custom_fields/text10"title="Permalink to this option"></a><pclass="ansible-option-type-line"><spanclass="ansible-option-type">string</span></p>
</div></td>
<td><divclass="ansible-option-indent-desc"></div><divclass="ansible-option-cell"><p>Custom text field (maximum 500 characters)</p>
<aclass="ansibleOptionLink"href="#parameter-custom_fields/text11"title="Permalink to this option"></a><pclass="ansible-option-type-line"><spanclass="ansible-option-type">string</span></p>
</div></td>
<td><divclass="ansible-option-indent-desc"></div><divclass="ansible-option-cell"><p>Custom text field (maximum 500 characters)</p>
<aclass="ansibleOptionLink"href="#parameter-custom_fields/text12"title="Permalink to this option"></a><pclass="ansible-option-type-line"><spanclass="ansible-option-type">string</span></p>
</div></td>
<td><divclass="ansible-option-indent-desc"></div><divclass="ansible-option-cell"><p>Custom text field (maximum 500 characters)</p>
<aclass="ansibleOptionLink"href="#parameter-custom_fields/text13"title="Permalink to this option"></a><pclass="ansible-option-type-line"><spanclass="ansible-option-type">string</span></p>
</div></td>
<td><divclass="ansible-option-indent-desc"></div><divclass="ansible-option-cell"><p>Custom text field (maximum 500 characters)</p>
<aclass="ansibleOptionLink"href="#parameter-custom_fields/text14"title="Permalink to this option"></a><pclass="ansible-option-type-line"><spanclass="ansible-option-type">string</span></p>
</div></td>
<td><divclass="ansible-option-indent-desc"></div><divclass="ansible-option-cell"><p>Custom text field (maximum 500 characters)</p>
<aclass="ansibleOptionLink"href="#parameter-custom_fields/text15"title="Permalink to this option"></a><pclass="ansible-option-type-line"><spanclass="ansible-option-type">string</span></p>
</div></td>
<td><divclass="ansible-option-indent-desc"></div><divclass="ansible-option-cell"><p>Custom text field (maximum 500 characters)</p>
<aclass="ansibleOptionLink"href="#parameter-custom_fields/text2"title="Permalink to this option"></a><pclass="ansible-option-type-line"><spanclass="ansible-option-type">string</span></p>
</div></td>
<td><divclass="ansible-option-indent-desc"></div><divclass="ansible-option-cell"><p>Custom text field (maximum 500 characters)</p>
<aclass="ansibleOptionLink"href="#parameter-custom_fields/text3"title="Permalink to this option"></a><pclass="ansible-option-type-line"><spanclass="ansible-option-type">string</span></p>
</div></td>
<td><divclass="ansible-option-indent-desc"></div><divclass="ansible-option-cell"><p>Custom text field (maximum 500 characters)</p>
<aclass="ansibleOptionLink"href="#parameter-custom_fields/text4"title="Permalink to this option"></a><pclass="ansible-option-type-line"><spanclass="ansible-option-type">string</span></p>
</div></td>
<td><divclass="ansible-option-indent-desc"></div><divclass="ansible-option-cell"><p>Custom text field (maximum 500 characters)</p>
<aclass="ansibleOptionLink"href="#parameter-custom_fields/text5"title="Permalink to this option"></a><pclass="ansible-option-type-line"><spanclass="ansible-option-type">string</span></p>
</div></td>
<td><divclass="ansible-option-indent-desc"></div><divclass="ansible-option-cell"><p>Custom text field (maximum 500 characters)</p>
<aclass="ansibleOptionLink"href="#parameter-custom_fields/text6"title="Permalink to this option"></a><pclass="ansible-option-type-line"><spanclass="ansible-option-type">string</span></p>
</div></td>
<td><divclass="ansible-option-indent-desc"></div><divclass="ansible-option-cell"><p>Custom text field (maximum 500 characters)</p>
<aclass="ansibleOptionLink"href="#parameter-custom_fields/text7"title="Permalink to this option"></a><pclass="ansible-option-type-line"><spanclass="ansible-option-type">string</span></p>
</div></td>
<td><divclass="ansible-option-indent-desc"></div><divclass="ansible-option-cell"><p>Custom text field (maximum 500 characters)</p>
<aclass="ansibleOptionLink"href="#parameter-custom_fields/text8"title="Permalink to this option"></a><pclass="ansible-option-type-line"><spanclass="ansible-option-type">string</span></p>
</div></td>
<td><divclass="ansible-option-indent-desc"></div><divclass="ansible-option-cell"><p>Custom text field (maximum 500 characters)</p>
<aclass="ansibleOptionLink"href="#parameter-custom_fields/text9"title="Permalink to this option"></a><pclass="ansible-option-type-line"><spanclass="ansible-option-type">string</span></p>
</div></td>
<td><divclass="ansible-option-indent-desc"></div><divclass="ansible-option-cell"><p>Custom text field (maximum 500 characters)</p>
<aclass="ansibleOptionLink"href="#parameter-eku"title="Permalink to this option"></a><pclass="ansible-option-type-line"><spanclass="ansible-option-type">string</span></p>
<td><divclass="ansible-option-cell"><p>If specified, overrides the key usage in the <codeclass="ansible-option docutils literal notranslate"><strong><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-csr"><spanclass="std std-ref"><spanclass="pre">csr</span></span></a></strong></code>.</p>
<aclass="ansibleOptionLink"href="#parameter-end_user_key_storage_agreement"title="Permalink to this option"></a><pclass="ansible-option-type-line"><spanclass="ansible-option-type">boolean</span></p>
<td><divclass="ansible-option-cell"><p>The end user of the Code Signing certificate must generate and store the private key for this request on cryptographically secure hardware to be compliant with the Entrust CSP and Subscription agreement. If requesting a certificate of type <codeclass="ansible-value docutils literal notranslate"><spanclass="pre">CODE_SIGNING</span></code> or <codeclass="ansible-value docutils literal notranslate"><spanclass="pre">EV_CODE_SIGNING</span></code>, you must set <codeclass="ansible-option docutils literal notranslate"><strong><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-end-user-key-storage-agreement"><spanclass="std std-ref"><spanclass="pre">end_user_key_storage_agreement</span></span></a></strong></code> to true if and only if you acknowledge that you will inform the user of this requirement.</p>
<p>Applicable only to <codeclass="ansible-option docutils literal notranslate"><strong><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-cert-type"><spanclass="std std-ref"><spanclass="pre">cert_type</span></span></a></strong></code> of values <codeclass="ansible-value docutils literal notranslate"><spanclass="pre">CODE_SIGNING</span></code> and <codeclass="ansible-value docutils literal notranslate"><spanclass="pre">EV_CODE_SIGNING</span></code>.</p>
<aclass="ansibleOptionLink"href="#parameter-entrust_api_client_cert_key_path"title="Permalink to this option"></a><pclass="ansible-option-type-line"><spanclass="ansible-option-type">path</span> / <spanclass="ansible-option-required">required</span></p>
</div></td>
<td><divclass="ansible-option-cell"><p>The path to the key for the client certificate used to authenticate to the Entrust Certificate Services (ECS) API.</p>
<aclass="ansibleOptionLink"href="#parameter-entrust_api_client_cert_path"title="Permalink to this option"></a><pclass="ansible-option-type-line"><spanclass="ansible-option-type">path</span> / <spanclass="ansible-option-required">required</span></p>
</div></td>
<td><divclass="ansible-option-cell"><p>The path to the client certificate used to authenticate to the Entrust Certificate Services (ECS) API.</p>
<aclass="ansibleOptionLink"href="#parameter-entrust_api_key"title="Permalink to this option"></a><pclass="ansible-option-type-line"><spanclass="ansible-option-type">string</span> / <spanclass="ansible-option-required">required</span></p>
</div></td>
<td><divclass="ansible-option-cell"><p>The key (password) for authentication to the Entrust Certificate Services (ECS) API.</p>
<aclass="ansibleOptionLink"href="#parameter-entrust_api_specification_path"title="Permalink to this option"></a><pclass="ansible-option-type-line"><spanclass="ansible-option-type">path</span></p>
</div></td>
<td><divclass="ansible-option-cell"><p>The path to the specification file defining the Entrust Certificate Services (ECS) API configuration.</p>
<p>You can use this to keep a local copy of the specification to avoid downloading it every time the module is used.</p>
<aclass="ansibleOptionLink"href="#parameter-entrust_api_user"title="Permalink to this option"></a><pclass="ansible-option-type-line"><spanclass="ansible-option-type">string</span> / <spanclass="ansible-option-required">required</span></p>
</div></td>
<td><divclass="ansible-option-cell"><p>The username for authentication to the Entrust Certificate Services (ECS) API.</p>
<aclass="ansibleOptionLink"href="#parameter-force"title="Permalink to this option"></a><pclass="ansible-option-type-line"><spanclass="ansible-option-type">boolean</span></p>
<td><divclass="ansible-option-cell"><p>If force is used, a certificate is requested regardless of whether <codeclass="ansible-option docutils literal notranslate"><strong><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-path"><spanclass="std std-ref"><spanclass="pre">path</span></span></a></strong></code> points to an existing valid certificate.</p>
<p>If <codeclass="ansible-option-value docutils literal notranslate"><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-request-type"><spanclass="std std-ref"><spanclass="pre">request_type=renew</span></span></a></code>, a forced renew will fail if the certificate being renewed has been issued within the past 30 days, regardless of the value of <codeclass="ansible-option docutils literal notranslate"><strong><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-remaining-days"><spanclass="std std-ref"><spanclass="pre">remaining_days</span></span></a></strong></code> or the return value of <codeclass="ansible-return-value docutils literal notranslate"><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-return-cert-days"><spanclass="std std-ref"><spanclass="pre">cert_days</span></span></a></code> - the ECS API does not support the “renew” operation for certificates that are not at least 30 days old.</p>
<aclass="ansibleOptionLink"href="#parameter-full_chain_path"title="Permalink to this option"></a><pclass="ansible-option-type-line"><spanclass="ansible-option-type">path</span></p>
</div></td>
<td><divclass="ansible-option-cell"><p>The destination path for the full certificate chain of the certificate, intermediates, and roots.</p>
<aclass="ansibleOptionLink"href="#parameter-org"title="Permalink to this option"></a><pclass="ansible-option-type-line"><spanclass="ansible-option-type">string</span></p>
</div></td>
<td><divclass="ansible-option-cell"><p>Organization “O=” to include in the certificate.</p>
<p>If <codeclass="ansible-option docutils literal notranslate"><strong><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-org"><spanclass="std std-ref"><spanclass="pre">org</span></span></a></strong></code> is not specified, the organization from the client represented by <codeclass="ansible-option docutils literal notranslate"><strong><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-client-id"><spanclass="std std-ref"><spanclass="pre">client_id</span></span></a></strong></code> is used.</p>
<p>Unless the <codeclass="ansible-option docutils literal notranslate"><strong><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-cert-type"><spanclass="std std-ref"><spanclass="pre">cert_type</span></span></a></strong></code> is <codeclass="ansible-value docutils literal notranslate"><spanclass="pre">PD_SSL</span></code>, this field may not be specified if the value of <codeclass="ansible-option docutils literal notranslate"><strong><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-client-id"><spanclass="std std-ref"><spanclass="pre">client_id</span></span></a></strong></code> is not “1” (the primary client). non-primary clients, certificates may only be issued with the organization of that client.</p>
<aclass="ansibleOptionLink"href="#parameter-ou"title="Permalink to this option"></a><pclass="ansible-option-type-line"><spanclass="ansible-option-type">list</span> / <spanclass="ansible-option-elements">elements=string</span></p>
</div></td>
<td><divclass="ansible-option-cell"><p>Organizational unit “OU=” to include in the certificate.</p>
<p><codeclass="ansible-option docutils literal notranslate"><strong><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-ou"><spanclass="std std-ref"><spanclass="pre">ou</span></span></a></strong></code> behavior is dependent on whether organizational units are enabled for your account. If organizational unit support is disabled for your account, organizational units from the <codeclass="ansible-option docutils literal notranslate"><strong><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-csr"><spanclass="std std-ref"><spanclass="pre">csr</span></span></a></strong></code> and the <codeclass="ansible-option docutils literal notranslate"><strong><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-ou"><spanclass="std std-ref"><spanclass="pre">ou</span></span></a></strong></code> parameter are ignored.</p>
<p>If both <codeclass="ansible-option docutils literal notranslate"><strong><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-csr"><spanclass="std std-ref"><spanclass="pre">csr</span></span></a></strong></code> and <codeclass="ansible-option docutils literal notranslate"><strong><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-ou"><spanclass="std std-ref"><spanclass="pre">ou</span></span></a></strong></code> are specified, the value in <codeclass="ansible-option docutils literal notranslate"><strong><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-ou"><spanclass="std std-ref"><spanclass="pre">ou</span></span></a></strong></code> will override the OU fields present in the subject distinguished name in the <codeclass="ansible-option docutils literal notranslate"><strong><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-csr"><spanclass="std std-ref"><spanclass="pre">csr</span></span></a></strong></code></p>
<p>If neither <codeclass="ansible-option docutils literal notranslate"><strong><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-csr"><spanclass="std std-ref"><spanclass="pre">csr</span></span></a></strong></code> nor <codeclass="ansible-option docutils literal notranslate"><strong><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-ou"><spanclass="std std-ref"><spanclass="pre">ou</span></span></a></strong></code> are specified for a renew or reissue operation, the OU fields in the initial certificate are reused.</p>
<p>An invalid OU from <codeclass="ansible-option docutils literal notranslate"><strong><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-csr"><spanclass="std std-ref"><spanclass="pre">csr</span></span></a></strong></code> is ignored, but any invalid organizational units in <codeclass="ansible-option docutils literal notranslate"><strong><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-ou"><spanclass="std std-ref"><spanclass="pre">ou</span></span></a></strong></code> will result in an error indicating “Unapproved OU”. The <codeclass="ansible-option docutils literal notranslate"><strong><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-ou"><spanclass="std std-ref"><spanclass="pre">ou</span></span></a></strong></code> parameter can be used to force failure if an unapproved organizational unit is provided.</p>
<aclass="ansibleOptionLink"href="#parameter-path"title="Permalink to this option"></a><pclass="ansible-option-type-line"><spanclass="ansible-option-type">path</span> / <spanclass="ansible-option-required">required</span></p>
</div></td>
<td><divclass="ansible-option-cell"><p>The destination path for the generated certificate as a PEM encoded cert.</p>
<p>If the certificate at this location is not an Entrust issued certificate, a new certificate will always be requested even if the current certificate is technically valid.</p>
<p>If there is already an Entrust certificate at this location, whether it is replaced is depends on the <codeclass="ansible-option docutils literal notranslate"><strong><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-remaining-days"><spanclass="std std-ref"><spanclass="pre">remaining_days</span></span></a></strong></code> calculation.</p>
<p>If an existing certificate is being replaced (see <codeclass="ansible-option docutils literal notranslate"><strong><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-remaining-days"><spanclass="std std-ref"><spanclass="pre">remaining_days</span></span></a></strong></code>, <codeclass="ansible-option docutils literal notranslate"><strong><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-force"><spanclass="std std-ref"><spanclass="pre">force</span></span></a></strong></code>, and <codeclass="ansible-option docutils literal notranslate"><strong><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-tracking-id"><spanclass="std std-ref"><spanclass="pre">tracking_id</span></span></a></strong></code>), whether a new certificate is requested or the existing certificate is renewed or reissued is based on <codeclass="ansible-option docutils literal notranslate"><strong><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-request-type"><spanclass="std std-ref"><spanclass="pre">request_type</span></span></a></strong></code>.</p>
<aclass="ansibleOptionLink"href="#parameter-remaining_days"title="Permalink to this option"></a><pclass="ansible-option-type-line"><spanclass="ansible-option-type">integer</span></p>
<td><divclass="ansible-option-cell"><p>The number of days the certificate must have left being valid. If <codeclass="ansible-return-value docutils literal notranslate"><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-return-cert-days"><spanclass="std std-ref"><spanclass="pre">cert_days</span></span></a></code><<codeclass="ansible-option docutils literal notranslate"><strong><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-remaining-days"><spanclass="std std-ref"><spanclass="pre">remaining_days</span></span></a></strong></code> then a new certificate will be obtained using <codeclass="ansible-option docutils literal notranslate"><strong><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-request-type"><spanclass="std std-ref"><spanclass="pre">request_type</span></span></a></strong></code>.</p>
<p>If <codeclass="ansible-option-value docutils literal notranslate"><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-request-type"><spanclass="std std-ref"><spanclass="pre">request_type=renew</span></span></a></code>, a renewal will fail if the certificate being renewed has been issued within the past 30 days, so do not set a <codeclass="ansible-option docutils literal notranslate"><strong><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-remaining-days"><spanclass="std std-ref"><spanclass="pre">remaining_days</span></span></a></strong></code> value that is within 30 days of the full lifetime of the certificate being acted upon.</p>
<p>For exmaple, if you are requesting Certificates with a 90 day lifetime, do not set <codeclass="ansible-option docutils literal notranslate"><strong><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-remaining-days"><spanclass="std std-ref"><spanclass="pre">remaining_days</span></span></a></strong></code> to a value <codeclass="ansible-value docutils literal notranslate"><spanclass="pre">60</span></code> or higher).</p>
<p>The <codeclass="ansible-option docutils literal notranslate"><strong><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-force"><spanclass="std std-ref"><spanclass="pre">force</span></span></a></strong></code> option may be used to ensure that a new certificate is always obtained.</p>
<aclass="ansibleOptionLink"href="#parameter-request_type"title="Permalink to this option"></a><pclass="ansible-option-type-line"><spanclass="ansible-option-type">string</span></p>
<td><divclass="ansible-option-cell"><p>The operation performed if <codeclass="ansible-option docutils literal notranslate"><strong><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-tracking-id"><spanclass="std std-ref"><spanclass="pre">tracking_id</span></span></a></strong></code> references a valid certificate to reissue, or there is already a certificate present in <codeclass="ansible-option docutils literal notranslate"><strong><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-path"><spanclass="std std-ref"><spanclass="pre">path</span></span></a></strong></code> but either <codeclass="ansible-option docutils literal notranslate"><strong><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-force"><spanclass="std std-ref"><spanclass="pre">force</span></span></a></strong></code> is specified or <codeclass="ansible-return-value docutils literal notranslate"><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-return-cert-days"><spanclass="std std-ref"><spanclass="pre">cert_days</span></span></a></code><<codeclass="ansible-option docutils literal notranslate"><strong><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-remaining-days"><spanclass="std std-ref"><spanclass="pre">remaining_days</span></span></a></strong></code>.</p>
<p>Specifying <codeclass="ansible-option-value docutils literal notranslate"><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-request-type"><spanclass="std std-ref"><spanclass="pre">request_type=validate_only</span></span></a></code> means the request will be validated against the ECS API, but no certificate will be issued.</p>
<p>Specifying <codeclass="ansible-option-value docutils literal notranslate"><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-request-type"><spanclass="std std-ref"><spanclass="pre">request_type=new</span></span></a></code> means a certificate request will always be submitted and a new certificate issued.</p>
<p>Specifying <codeclass="ansible-option-value docutils literal notranslate"><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-request-type"><spanclass="std std-ref"><spanclass="pre">request_type=renew</span></span></a></code> means that an existing certificate (specified by <codeclass="ansible-option docutils literal notranslate"><strong><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-tracking-id"><spanclass="std std-ref"><spanclass="pre">tracking_id</span></span></a></strong></code> if present, otherwise <codeclass="ansible-option docutils literal notranslate"><strong><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-path"><spanclass="std std-ref"><spanclass="pre">path</span></span></a></strong></code>) will be renewed. If there is no certificate to renew, a new certificate is requested.</p>
<p>Specifying <codeclass="ansible-option-value docutils literal notranslate"><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-request-type"><spanclass="std std-ref"><spanclass="pre">request_type=reissue</span></span></a></code> means that an existing certificate (specified by <codeclass="ansible-option docutils literal notranslate"><strong><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-tracking-id"><spanclass="std std-ref"><spanclass="pre">tracking_id</span></span></a></strong></code> if present, otherwise <codeclass="ansible-option docutils literal notranslate"><strong><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-path"><spanclass="std std-ref"><spanclass="pre">path</span></span></a></strong></code>) will be reissued. If there is no certificate to reissue, a new certificate is requested.</p>
<p>If a certificate was issued within the past 30 days, the <codeclass="ansible-value docutils literal notranslate"><spanclass="pre">renew</span></code> operation is not a valid operation and will fail.</p>
<p>Note that <codeclass="ansible-value docutils literal notranslate"><spanclass="pre">reissue</span></code> is an operation that will result in the revocation of the certificate that is reissued, be cautious with its use.</p>
<p><em>check_mode</em> is only supported if <codeclass="ansible-option-value docutils literal notranslate"><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-request-type"><spanclass="std std-ref"><spanclass="pre">request_type=new</span></span></a></code></p>
<p>For example, setting <codeclass="ansible-option-value docutils literal notranslate"><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-request-type"><spanclass="std std-ref"><spanclass="pre">request_type=renew</span></span></a></code> and <codeclass="ansible-option-value docutils literal notranslate"><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-remaining-days"><spanclass="std std-ref"><spanclass="pre">remaining_days=30</span></span></a></code> and pointing to the same certificate on multiple playbook runs means that on the first run new certificate will be requested. It will then be left along on future runs until it is within 30 days of expiry, then the ECS “renew” operation will be performed.</p>
<aclass="ansibleOptionLink"href="#parameter-requester_email"title="Permalink to this option"></a><pclass="ansible-option-type-line"><spanclass="ansible-option-type">string</span> / <spanclass="ansible-option-required">required</span></p>
</div></td>
<td><divclass="ansible-option-cell"><p>The requester email to associate with certificate tracking information and receive delivery and expiry notices for the certificate.</p>
<aclass="ansibleOptionLink"href="#parameter-requester_name"title="Permalink to this option"></a><pclass="ansible-option-type-line"><spanclass="ansible-option-type">string</span> / <spanclass="ansible-option-required">required</span></p>
</div></td>
<td><divclass="ansible-option-cell"><p>The requester name to associate with certificate tracking information.</p>
<aclass="ansibleOptionLink"href="#parameter-requester_phone"title="Permalink to this option"></a><pclass="ansible-option-type-line"><spanclass="ansible-option-type">string</span> / <spanclass="ansible-option-required">required</span></p>
</div></td>
<td><divclass="ansible-option-cell"><p>The requester phone number to associate with certificate tracking information.</p>
<aclass="ansibleOptionLink"href="#parameter-subject_alt_name"title="Permalink to this option"></a><pclass="ansible-option-type-line"><spanclass="ansible-option-type">list</span> / <spanclass="ansible-option-elements">elements=string</span></p>
<td><divclass="ansible-option-cell"><p>The subject alternative name identifiers, as an array of values (applies to <codeclass="ansible-option docutils literal notranslate"><strong><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-cert-type"><spanclass="std std-ref"><spanclass="pre">cert_type</span></span></a></strong></code> with a value of <codeclass="ansible-value docutils literal notranslate"><spanclass="pre">STANDARD_SSL</span></code>, <codeclass="ansible-value docutils literal notranslate"><spanclass="pre">ADVANTAGE_SSL</span></code>, <codeclass="ansible-value docutils literal notranslate"><spanclass="pre">UC_SSL</span></code>, <codeclass="ansible-value docutils literal notranslate"><spanclass="pre">EV_SSL</span></code>, <codeclass="ansible-value docutils literal notranslate"><spanclass="pre">WILDCARD_SSL</span></code>, <codeclass="ansible-value docutils literal notranslate"><spanclass="pre">PRIVATE_SSL</span></code>, and <codeclass="ansible-value docutils literal notranslate"><spanclass="pre">PD_SSL</span></code>).</p>
<p>If you are requesting a new SSL certificate, and you pass a <codeclass="ansible-option docutils literal notranslate"><strong><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-subject-alt-name"><spanclass="std std-ref"><spanclass="pre">subject_alt_name</span></span></a></strong></code> parameter, any SAN names in the CSR are ignored. If no subjectAltName parameter is passed, the SAN names in the CSR are used.</p>
<p>See <codeclass="ansible-option docutils literal notranslate"><strong><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-request-type"><spanclass="std std-ref"><spanclass="pre">request_type</span></span></a></strong></code> to understand more about SANs during reissues and renewals.</p>
<p>In the case of certificates of type <codeclass="ansible-value docutils literal notranslate"><spanclass="pre">STANDARD_SSL</span></code> certificates, if the CN of the certificate is <domain>.<tld> only the www.<domain>.<tld> value is accepted. If the CN of the certificate is www.<domain>.<tld> only the <domain>.<tld> value is accepted.</p>
<aclass="ansibleOptionLink"href="#parameter-tracking_id"title="Permalink to this option"></a><pclass="ansible-option-type-line"><spanclass="ansible-option-type">integer</span></p>
</div></td>
<td><divclass="ansible-option-cell"><p>The tracking ID of the certificate to reissue or renew.</p>
<p><codeclass="ansible-option docutils literal notranslate"><strong><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-tracking-id"><spanclass="std std-ref"><spanclass="pre">tracking_id</span></span></a></strong></code> is invalid if <codeclass="ansible-option-value docutils literal notranslate"><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-request-type"><spanclass="std std-ref"><spanclass="pre">request_type=new</span></span></a></code> or <codeclass="ansible-option-value docutils literal notranslate"><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-request-type"><spanclass="std std-ref"><spanclass="pre">request_type=validate_only</span></span></a></code>.</p>
<p>If there is a certificate present in <codeclass="ansible-option docutils literal notranslate"><strong><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-path"><spanclass="std std-ref"><spanclass="pre">path</span></span></a></strong></code> and it is an ECS certificate, <codeclass="ansible-option docutils literal notranslate"><strong><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-tracking-id"><spanclass="std std-ref"><spanclass="pre">tracking_id</span></span></a></strong></code> will be ignored.</p>
<p>If there is no certificate present in <codeclass="ansible-option docutils literal notranslate"><strong><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-path"><spanclass="std std-ref"><spanclass="pre">path</span></span></a></strong></code> or there is but it is from another provider, the certificate represented by <codeclass="ansible-option docutils literal notranslate"><strong><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-tracking-id"><spanclass="std std-ref"><spanclass="pre">tracking_id</span></span></a></strong></code> will be renewed or reissued and saved to <codeclass="ansible-option docutils literal notranslate"><strong><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-path"><spanclass="std std-ref"><spanclass="pre">path</span></span></a></strong></code>.</p>
<p>If there is no certificate present in <codeclass="ansible-option docutils literal notranslate"><strong><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-path"><spanclass="std std-ref"><spanclass="pre">path</span></span></a></strong></code> and the <codeclass="ansible-option docutils literal notranslate"><strong><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-force"><spanclass="std std-ref"><spanclass="pre">force</span></span></a></strong></code> and <codeclass="ansible-option docutils literal notranslate"><strong><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-remaining-days"><spanclass="std std-ref"><spanclass="pre">remaining_days</span></span></a></strong></code> parameters do not indicate a new certificate is needed, the certificate referenced by <codeclass="ansible-option docutils literal notranslate"><strong><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-tracking-id"><spanclass="std std-ref"><spanclass="pre">tracking_id</span></span></a></strong></code> certificate will be saved to <codeclass="ansible-option docutils literal notranslate"><strong><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-path"><spanclass="std std-ref"><spanclass="pre">path</span></span></a></strong></code>.</p>
<p>This can be used when a known certificate is not currently present on a server, but you want to renew or reissue it to be managed by an ansible playbook. For example, if you specify <codeclass="ansible-option-value docutils literal notranslate"><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-request-type"><spanclass="std std-ref"><spanclass="pre">request_type=renew</span></span></a></code>, <codeclass="ansible-option docutils literal notranslate"><strong><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-tracking-id"><spanclass="std std-ref"><spanclass="pre">tracking_id</span></span></a></strong></code> of an issued certificate, and <codeclass="ansible-option docutils literal notranslate"><strong><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-path"><spanclass="std std-ref"><spanclass="pre">path</span></span></a></strong></code> to a file that does not exist, the first run of a task will download the certificate specified by <codeclass="ansible-option docutils literal notranslate"><strong><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-tracking-id"><spanclass="std std-ref"><spanclass="pre">tracking_id</span></span></a></strong></code> (assuming it is still valid). Future runs of the task will (if applicable - see <codeclass="ansible-option docutils literal notranslate"><strong><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-force"><spanclass="std std-ref"><spanclass="pre">force</span></span></a></strong></code> and <codeclass="ansible-option docutils literal notranslate"><strong><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-remaining-days"><spanclass="std std-ref"><spanclass="pre">remaining_days</span></span></a></strong></code>) renew the certificate now present in <codeclass="ansible-option docutils literal notranslate"><strong><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-path"><spanclass="std std-ref"><spanclass="pre">path</span></span></a></strong></code>.</p>
<aclass="ansibleOptionLink"href="#parameter-tracking_info"title="Permalink to this option"></a><pclass="ansible-option-type-line"><spanclass="ansible-option-type">string</span></p>
</div></td>
<td><divclass="ansible-option-cell"><p>Free form tracking information to attach to the record for the certificate.</p>
<p>Check mode is only supported if <codeclass="ansible-option-value docutils literal notranslate"><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-request-type"><spanclass="std std-ref"><spanclass="pre">request_type=new</span></span></a></code>.</p>
<td><divclass="ansible-option-cell"><p>Can run in <codeclass="docutils literal notranslate"><spanclass="pre">check_mode</span></code> and return changed status prediction without modifying target.</p>
<td><divclass="ansible-option-cell"><p>Will return details on what has changed (or possibly needs changing in <codeclass="docutils literal notranslate"><spanclass="pre">check_mode</span></code>), when in diff mode.</p>
<li><p><codeclass="ansible-option docutils literal notranslate"><strong><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-path"><spanclass="std std-ref"><spanclass="pre">path</span></span></a></strong></code> must be specified as the output location of the certificate.</p></li>
<dt><aclass="reference internal"href="openssl_privatekey_module.html#ansible-collections-community-crypto-openssl-privatekey-module"><spanclass="std std-ref">community.crypto.openssl_privatekey</span></a></dt><dd><p>Can be used to create private keys (both for certificates and accounts).</p>
</dd>
<dt><aclass="reference internal"href="openssl_csr_module.html#ansible-collections-community-crypto-openssl-csr-module"><spanclass="std std-ref">community.crypto.openssl_csr</span></a></dt><dd><p>Can be used to create a Certificate Signing Request (CSR).</p>
<divclass="highlight-yaml+jinja notranslate"><divclass="highlight"><pre><span></span><spanclass="p p-Indicator">-</span><spanclass="w"></span><spanclass="nt">name</span><spanclass="p">:</span><spanclass="w"></span><spanclass="l l-Scalar l-Scalar-Plain">Request a new certificate from Entrust with bare minimum parameters.</span>
<spanclass="w"></span><spanclass="l l-Scalar l-Scalar-Plain">Will request a new certificate if current one is valid but within 30</span>
<spanclass="w"></span><spanclass="l l-Scalar l-Scalar-Plain">days of expiry. If replacing an existing file in path, will back it up.</span>
<spanclass="p p-Indicator">-</span><spanclass="w"></span><spanclass="nt">name</span><spanclass="p">:</span><spanclass="w"></span><spanclass="l l-Scalar l-Scalar-Plain">If there is no certificate present in path, request a new certificate</span>
<spanclass="w"></span><spanclass="l l-Scalar l-Scalar-Plain">of type EV_SSL. Otherwise, if there is an Entrust managed certificate</span>
<spanclass="w"></span><spanclass="l l-Scalar l-Scalar-Plain">in path and it is within 63 days of expiration, request a renew of that</span>
<spanclass="p p-Indicator">-</span><spanclass="w"></span><spanclass="nt">name</span><spanclass="p">:</span><spanclass="w"></span><spanclass="l l-Scalar l-Scalar-Plain">If there is no certificate present in path, download certificate</span>
<spanclass="w"></span><spanclass="l l-Scalar l-Scalar-Plain">specified by tracking_id if it is still valid. Otherwise, if the</span>
<spanclass="w"></span><spanclass="l l-Scalar l-Scalar-Plain">certificate is within 79 days of expiration, request a renew of that</span>
<spanclass="w"></span><spanclass="l l-Scalar l-Scalar-Plain">certificate and save it in path. This can be used to "migrate" a</span>
<spanclass="w"></span><spanclass="l l-Scalar l-Scalar-Plain">certificate to be Ansible managed.</span>
<spanclass="p p-Indicator">-</span><spanclass="w"></span><spanclass="nt">name</span><spanclass="p">:</span><spanclass="w"></span><spanclass="l l-Scalar l-Scalar-Plain">Force a reissue of the certificate specified by tracking_id.</span>
<spanclass="p p-Indicator">-</span><spanclass="w"></span><spanclass="nt">name</span><spanclass="p">:</span><spanclass="w"></span><spanclass="l l-Scalar l-Scalar-Plain">Request a new certificate with an alternative client. Note that the</span>
<spanclass="w"></span><spanclass="l l-Scalar l-Scalar-Plain">issued certificate will have it's Subject Distinguished Name use the</span>
<spanclass="w"></span><spanclass="l l-Scalar l-Scalar-Plain">organization details associated with that client, rather than what is</span>
<spanclass="w"></span><spanclass="l l-Scalar l-Scalar-Plain">in the CSR.</span>
<spanclass="p p-Indicator">-</span><spanclass="w"></span><spanclass="nt">name</span><spanclass="p">:</span><spanclass="w"></span><spanclass="l l-Scalar l-Scalar-Plain">Request a new certificate with a number of CSR parameters overridden</span>
<h2><aclass="toc-backref"href="#id8"role="doc-backlink">Return Values</a><aclass="headerlink"href="#return-values"title="Link to this heading"></a></h2>
<p>Common return values are documented <aclass="reference external"href="https://docs.ansible.com/ansible/devel/reference_appendices/common_return_values.html#common-return-values"title="(in Ansible vdevel)"><spanclass="xref std std-ref">here</span></a>, the following are the fields unique to this module:</p>
<aclass="ansibleOptionLink"href="#return-backup_file"title="Permalink to this return value"></a><pclass="ansible-option-type-line"><spanclass="ansible-option-type">string</span></p>
</div></td>
<td><divclass="ansible-option-cell"><p>Name of backup file created for the certificate.</p>
<pclass="ansible-option-line"><spanclass="ansible-option-returned-bold">Returned:</span> changed and if <codeclass="ansible-option docutils literal notranslate"><strong><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-backup"><spanclass="std std-ref"><spanclass="pre">backup</span></span></a></strong></code> is <codeclass="ansible-value docutils literal notranslate"><spanclass="pre">true</span></code></p>
<aclass="ansibleOptionLink"href="#return-backup_full_chain_file"title="Permalink to this return value"></a><pclass="ansible-option-type-line"><spanclass="ansible-option-type">string</span></p>
</div></td>
<td><divclass="ansible-option-cell"><p>Name of the backup file created for the certificate chain.</p>
<pclass="ansible-option-line"><spanclass="ansible-option-returned-bold">Returned:</span> changed and if <codeclass="ansible-option docutils literal notranslate"><strong><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-backup"><spanclass="std std-ref"><spanclass="pre">backup</span></span></a></strong></code> is <codeclass="ansible-value docutils literal notranslate"><spanclass="pre">true</span></code> and <codeclass="ansible-option docutils literal notranslate"><strong><aclass="reference internal"href="#ansible-collections-community-crypto-ecs-certificate-module-parameter-full-chain-path"><spanclass="std std-ref"><spanclass="pre">full_chain_path</span></span></a></strong></code> is set.</p>
<aclass="ansibleOptionLink"href="#return-cert_days"title="Permalink to this return value"></a><pclass="ansible-option-type-line"><spanclass="ansible-option-type">integer</span></p>
</div></td>
<td><divclass="ansible-option-cell"><p>The number of days the certificate remains valid.</p>
<aclass="ansibleOptionLink"href="#return-cert_details"title="Permalink to this return value"></a><pclass="ansible-option-type-line"><spanclass="ansible-option-type">dictionary</span></p>
</div></td>
<td><divclass="ansible-option-cell"><p>The full response JSON from the Get Certificate call of the ECS API.</p>
<p>While the response contents are guaranteed to be forwards compatible with new ECS API releases, Entrust recommends that you do not make any playbooks take actions based on the content of this field. However it may be useful for debugging, logging, or auditing purposes.</p>
<aclass="ansibleOptionLink"href="#return-cert_status"title="Permalink to this return value"></a><pclass="ansible-option-type-line"><spanclass="ansible-option-type">string</span></p>
</div></td>
<td><divclass="ansible-option-cell"><p>The certificate status in ECS.</p>
<aclass="ansibleOptionLink"href="#return-filename"title="Permalink to this return value"></a><pclass="ansible-option-type-line"><spanclass="ansible-option-type">string</span></p>
</div></td>
<td><divclass="ansible-option-cell"><p>The destination path for the generated certificate.</p>
<pclass="ansible-option-line"><spanclass="ansible-option-returned-bold">Returned:</span> changed or success</p>
<aclass="ansibleOptionLink"href="#return-serial_number"title="Permalink to this return value"></a><pclass="ansible-option-type-line"><spanclass="ansible-option-type">integer</span></p>
</div></td>
<td><divclass="ansible-option-cell"><p>The serial number of the issued certificate.</p>
<aclass="ansibleOptionLink"href="#return-tracking_id"title="Permalink to this return value"></a><pclass="ansible-option-type-line"><spanclass="ansible-option-type">integer</span></p>
</div></td>
<td><divclass="ansible-option-cell"><p>The tracking ID to reference and track the certificate in ECS.</p>
<ahref="https://github.com/ansible-collections/community.crypto/issues/new?assignees=&labels=&template=bug_report.md"aria-role="button"target="_blank"rel="noopener external">Submit a bug report</a>
<ahref="https://github.com/ansible-collections/community.crypto/issues/new?assignees=&labels=&template=feature_request.md"aria-role="button"target="_blank"rel="noopener external">Request a feature</a>
<ahref="ecs_domain_module.html"class="btn btn-neutral float-right"title="community.crypto.ecs_domain module – Request validation of a domain with the Entrust Certificate Services (ECS) API"accesskey="n"rel="next">Next <spanclass="fa fa-arrow-circle-right"aria-hidden="true"></span></a>
