Note
This plugin is part of the fortinet.fortios collection (version 2.1.2).
You might already have this collection installed if you are using the ansible package. It is not included in ansible-core. To check whether it is installed, run ansible-galaxy collection list.
To install it, use: ansible-galaxy collection install fortinet.fortios.
To use it in a playbook, specify: fortinet.fortios.fortios_certificate_local.
New in version 2.10: of fortinet.fortios
The below requirements are needed on the host that executes this module.
| Parameter | Choices/Defaults | Comments | |
|---|---|---|---|
| access_token string | Token-based authentication. Generated from GUI of Fortigate. | ||
| certificate_local dictionary | Local keys and certificates. | ||
| acme_ca_url string | The URL for the ACME CA server (Let"s Encrypt is the ). | ||
| acme_domain string | A valid domain that resolves to this Fortigate. | ||
| acme_email string | Contact email address that is required by some CAs like LetsEncrypt. | ||
| acme_renew_window integer | Beginning of the renewal window (in days before certificate expiration, 30 by default). | ||
| acme_rsa_key_size integer | Length of the RSA private key of the generated cert (Minimum 2048 bits). | ||
| auto_regenerate_days integer | Number of days to wait before expiry of an updated local certificate is requested (0 = disabled). | ||
| auto_regenerate_days_warning integer | Number of days to wait before an expiry warning message is generated (0 = disabled). | ||
| ca_identifier string | CA identifier of the CA server for signing via SCEP. | ||
| certificate string | PEM format certificate. | ||
| cmp_path string | Path location inside CMP server. | ||
| cmp_regeneration_method string |
| CMP auto-regeneration method. | |
| cmp_server string | "ADDRESS:PORT" for CMP server. | ||
| cmp_server_cert string | CMP server certificate. Source certificate.ca.name. | ||
| comments string | Comment. | ||
| csr string | Certificate Signing Request. | ||
| enroll_protocol string |
| Certificate enrollment protocol. | |
| ike_localid string | Local ID the FortiGate uses for authentication as a VPN client. | ||
| ike_localid_type string |
| IKE local ID type. | |
| last_updated integer | Time at which certificate was last updated. | ||
| name string / required | Name. | ||
| name_encoding string |
| Name encoding method for auto-regeneration. | |
| password string | Password as a PEM file. | ||
| private_key string | PEM format key, encrypted with a password. | ||
| range string |
| Either a global or VDOM IP address range for the certificate. | |
| scep_password string | SCEP server challenge password for auto-regeneration. | ||
| scep_url string | SCEP server URL. | ||
| source string |
| Certificate source type. | |
| source_ip string | Source IP address for communications to the SCEP server. | ||
| state string | Certificate Signing Request State. | ||
| enable_log boolean |
| Enable/Disable logging for task. | |
| state string / required |
| Indicates whether to create or remove the object. | |
| vdom string | Default: "root" | Virtual domain, among those defined previously. A vdom is a virtual instance of the FortiGate that can be configured and used as a different unit. | |
Note
- hosts: fortigates
collections:
- fortinet.fortios
connection: httpapi
vars:
vdom: "root"
ansible_httpapi_use_ssl: yes
ansible_httpapi_validate_certs: no
ansible_httpapi_port: 443
tasks:
- name: Local keys and certificates.
fortios_certificate_local:
vdom: "{{ vdom }}"
state: "present"
access_token: "<your_own_value>"
certificate_local:
acme_ca_url: "<your_own_value>"
acme_domain: "<your_own_value>"
acme_email: "<your_own_value>"
acme_renew_window: "6"
acme_rsa_key_size: "7"
auto_regenerate_days: "8"
auto_regenerate_days_warning: "9"
ca_identifier: "myId_10"
certificate: "<your_own_value>"
cmp_path: "<your_own_value>"
cmp_regeneration_method: "keyupate"
cmp_server: "<your_own_value>"
cmp_server_cert: "<your_own_value> (source certificate.ca.name)"
comments: "<your_own_value>"
csr: "<your_own_value>"
enroll_protocol: "none"
ike_localid: "<your_own_value>"
ike_localid_type: "asn1dn"
last_updated: "21"
name: "default_name_22"
name_encoding: "printable"
password: "<your_own_value>"
private_key: "<your_own_value>"
range: "global"
scep_password: "<your_own_value>"
scep_url: "<your_own_value>"
source: "factory"
source_ip: "84.230.14.43"
state: "<your_own_value>"
Common return values are documented here, the following are the fields unique to this module:
| Key | Returned | Description |
|---|---|---|
| build string | always | Build number of the fortigate image Sample: 1547 |
| http_method string | always | Last method used to provision the content into FortiGate Sample: PUT |
| http_status string | always | Last result given by FortiGate on last operation applied Sample: 200 |
| mkey string | success | Master key (id) used in the last call to FortiGate Sample: id |
| name string | always | Name of the table used to fulfill the request Sample: urlfilter |
| path string | always | Path of the table used to fulfill the request Sample: webfilter |
| revision string | always | Internal revision number Sample: 17.0.2.10658 |
| serial string | always | Serial number of the unit Sample: FGVMEVYYQT3AB5352 |
| status string | always | Indication of the operation's result Sample: success |
| vdom string | always | Virtual domain used Sample: root |
| version string | always | Version of the FortiGate Sample: v5.6.3 |
© 2012–2018 Michael DeHaan
© 2018–2021 Red Hat, Inc.
Licensed under the GNU General Public License version 3.
https://docs.ansible.com/ansible/latest/collections/fortinet/fortios/fortios_certificate_local_module.html