🔐 Certbot

Certbot is an open‑source ACME client used to obtain and renew TLS certificates from Let’s Encrypt. It is free, widely supported, and integrates cleanly with NGINX to request and manage certificates issued by Let’s Encrypt.

🚀 Deployment

Certbot is deployed using an Ansible playbook.
All Certbot‑specific logic is contained in the dedicated certbot_setup role.

This role is intentionally minimal: it installs Certbot and the certbot-nginx plugin using Python modules, following the general approach outlined in the official Certbot instructions.

🔧 Usage

Certificate requests are performed using the Request TLS Certificates Runbook, which invokes the Generate Certs playbook.

Certbot uses the nginx plugin to complete the HTTP‑01 ACME challenge.
This challenge verifies domain ownership by checking for a validation file served at:

http://<domain>/.well-known/acme-challenge/<token>

The Certbot Nginx plugin automatically creates and serves this file.
Your Nginx reverse‑proxy configuration includes the required location block:

location /.well-known/acme-challenge/ {
    root /var/www/certbot;
    allow all;
}

This block is added when configuring each domain’s Reverse-Proxy definition, ensuring Certbot can complete the challenge successfully.