Recognise certbot 5.x "Identifiers" field in domain check

certbot 5.x renamed the field in `certbot certificates` output
from "Domains:" to "Identifiers:". The "Check if domains have
changed" task greps that output for "Domains" to read a
certificate's current domains. On certbot 5.x the grep matches
nothing, so letsencrypt_cert_domains becomes empty,
letsencrypt_cert_domains_changed is always true, and every
certificate is reissued on every run.

Match both the old "Domains" and new "Identifiers" labels in
create-cert-standalone.yml and create-cert-webroot.yml so the
check works on certbot 4.x and 5.x alike.
This commit is contained in:
Sergey Aksenov 2026-05-16 18:03:54 +02:00
parent 1011113914
commit 88632e986e
2 changed files with 2 additions and 2 deletions

View File

@ -44,7 +44,7 @@
- name: Check if domains have changed - name: Check if domains have changed
block: block:
- name: Register certificate domains - name: Register certificate domains
shell: "{{ certbot_script }} certificates --cert-name {{ cert_item_name }} | grep Domains | cut -d':' -f2" shell: "{{ certbot_script }} certificates --cert-name {{ cert_item_name }} | grep -E 'Domains|Identifiers' | cut -d':' -f2"
changed_when: false changed_when: false
register: letsencrypt_cert_domains_dirty register: letsencrypt_cert_domains_dirty

View File

@ -16,7 +16,7 @@
- name: Check if domains have changed - name: Check if domains have changed
block: block:
- name: Register certificate domains - name: Register certificate domains
shell: "{{ certbot_script }} certificates --cert-name {{ cert_item_name }} | grep Domains | cut -d':' -f2" shell: "{{ certbot_script }} certificates --cert-name {{ cert_item_name }} | grep -E 'Domains|Identifiers' | cut -d':' -f2"
changed_when: false changed_when: false
register: letsencrypt_cert_domains_dirty register: letsencrypt_cert_domains_dirty