Install, configure, and run acmetool to generate Let's Encrypt TLS certificates.
Switch branches/tags
Nothing to show
Clone or download
L-P Merge pull request #8 from karlmdavis/issue-7-agreement-url-v1.2
Switched to the v1.2 agreement URL
Latest commit 340024d Dec 25, 2017
Type Name Latest commit message Commit time
Failed to load latest commit information.


Install, configure and run acmetool to generate Let's Encrypt TLS certificates.

acmetool will be configured to use its redirector mode. It will listen on port 80 and redirect (HTTP 308) anything that is not a challenge request.

See acme on GitHub for details.


  • become: true is required as most actions need to be run as root, the rest is run under acme which will be created by the role.

  • You need to open port 80/TCP for acmetool to serve challenges.

  • As the redirector mode is used by default, no HTTP server is required to run. You can install whatever server you want to run after running this role so it can use the generated certificates.

  • Chose your provider and set its API endpoint in acmetool_server, see below.

  • The cron package is required for automatic renewal.

Role Variables


# Address used to register domains with LetsEncrypt.
acmetool_email: ""
# space-separated list of domains to register.
acmetool_domains: ""


# CA server. This defaults to the acme-staging server for testing purposes.
# You will need to change this to the production server :
acmetool_server: ""

# Change this to RSA if your server does not support EC keys (eg. murmur).
acmetool_key_type: "ecdsa"

# If you don't trust acmetool to run hooks as root (sudo), set this to false.
acmetool_enable_hooks: false

See the defaults for the complete list.

Example Playbook

- hosts: all
    - { role: "L-P.acmetool", become: true }

Because on Debian services are automatically enabled and started with their default configuration when installed, nginx will fail to install and leave dpkg in a semi-broken state.
To avoid this you can run the following play between the installation of acmetool and nginx. It will only run if nginx is not yet configured.

- hosts: all
    become: true
    - name: Stop acmetool
      tags: "nginx"
      command: "service acmetool stop"
        creates: "/etc/nginx/nginx.conf"

You can adapt this for any other service that fails the same way.