ara | Result #116537: [ok] ansible.builtin.shell on mbox2-stage for "Install certificate on host"

/home/ssh-gateway/ansible/zimbra/install_zimbra_certificate_stage.yaml

Execution

Date 09 Sep 2024 13:28:45 +0100

Duration None

Controller ssh-gw-4.layershift.com

User root

Versions

Ansible 2.16.4

ara 1.7.1 / 1.7.1

Python 3.10.10

Summary

5 Hosts

2 Tasks

8 Results

1 Plays

1 Files

0 Records

remote_user:root check:False tags:all

Date
09 Sep 2024 13:28:45 +0100
Path
/home/ssh-gateway/ansible/zimbra/install_zimbra_certificate_stage.yaml

Argument	Value
version	None
verbosity	2
private_key_file	/home/ssh-gateway/.ssh/id_rsa
remote_user	root
connection	ssh
timeout	None
ssh_common_args	None
sftp_extra_args	None
scp_extra_args	None
ssh_extra_args	None
ask_pass	False
connection_password_file	None
force_handlers	False
flush_cache	False
become	False
become_method	sudo
become_user	None
become_ask_pass	False
become_password_file	None
tags	['all']
skip_tags	[]
check	False
diff	False
inventory	['/home/ssh-gateway/ansible/zimbra/inv-stage']
listhosts	False
subset	None
extra_vars	Not saved by ARA as configured by 'ignored_arguments'
vault_ids	[]
ask_vault_pass	False
vault_password_files	[]
forks	20
module_path	None
syntax	False
listtasks	False
listtags	False
step	False
start_at_task	None
args	['install_zimbra_certificate_stage.yaml']

Task result details

Status
OK
Duration
00:00:14.89
Play
Playbook to install zimbra wildcard certificate on cluster
Task
Install certificate on host
Host
mbox2-stage

Date
09 Sep 2024 13:29:04 +0100
Module / Action
ansible.builtin.shell (/home/ssh-gateway/ansible/zimbra/install_zimbra_certificate_stage.yaml:18)

Field	Value
changed	False
cmd	set -o pipefail chown zimbra.zimbra /tmp/commercial_stage.key /tmp/ssl_stage.crt /tmp/chain_stage.crt su -l zimbra -c "cp -prf /tmp/commercial_stage.key /opt/zimbra/ssl/zimbra/commercial/commercial.key" su -l zimbra -c "zmcertmgr verifycrt comm /tmp/commercial_stage.key /tmp/ssl_stage.crt /tmp/chain_stage.crt" su -l zimbra -c "zmcertmgr deploycrt comm /tmp/ssl_stage.crt /tmp/chain_stage.crt" su -l zimbra -c "zmlocalconfig -e ldap_starttls_required=true" su -l zimbra -c "zmlocalconfig -e ldap_starttls_supported=1" su -l zimbra -c "zmcontrol restart" su -l zimbra -c "zmcertmgr viewdeployedcrt"
delta	0:00:14.489355
end	2024-09-09 12:29:04.458684
invocation	{ "module_args": { "_raw_params": "set -o pipefail\nchown zimbra.zimbra /tmp/commercial_stage.key /tmp/ssl_stage.crt /tmp/chain_stage.crt\nsu -l zimbra -c \"cp -prf /tmp/commercial_stage.key /opt/zimbra/ssl/zimbra/commercial/commercial.key\"\nsu -l zimbra -c \"zmcertmgr verifycrt comm /tmp/commercial_stage.key /tmp/ssl_stage.crt /tmp/chain_stage.crt\"\nsu -l zimbra -c \"zmcertmgr deploycrt comm /tmp/ssl_stage.crt /tmp/chain_stage.crt\"\nsu -l zimbra -c \"zmlocalconfig -e ldap_starttls_required=true\"\nsu -l zimbra -c \"zmlocalconfig -e ldap_starttls_supported=1\"\nsu -l zimbra -c \"zmcontrol restart\"\nsu -l zimbra -c \"zmcertmgr viewdeployedcrt\"\n", "_uses_shell": true, "argv": null, "chdir": null, "creates": null, "executable": "/bin/bash", "expand_argument_vars": true, "removes": null, "stdin": null, "stdin_add_newline": true, "strip_empty_ends": true } }
msg
rc	0
start	2024-09-09 12:28:49.969329
stderr	Unable to start TLS: SSL connect attempt failed error:0A000086:SSL routines::certificate verify failed when connecting to ldap master.
stderr_lines	[ "Unable to start TLS: SSL connect attempt failed error:0A000086:SSL routines::certificate verify failed when connecting to ldap master." ]
stdout	Verifying '/tmp/ssl_stage.crt' against '/tmp/commercial_stage.key' Certificate '/tmp/ssl_stage.crt' and private key '/tmp/commercial_stage.key' match. Verifying '/tmp/ssl_stage.crt' against '/tmp/chain_stage.crt' Valid certificate chain: /tmp/ssl_stage.crt: OK Verifying '/tmp/ssl_stage.crt' against '/opt/zimbra/ssl/zimbra/commercial/commercial.key' Certificate '/tmp/ssl_stage.crt' and private key '/opt/zimbra/ssl/zimbra/commercial/commercial.key' match. Verifying '/tmp/ssl_stage.crt' against '/tmp/chain_stage.crt' Valid certificate chain: /tmp/ssl_stage.crt: OK Copying '/tmp/ssl_stage.crt' to '/opt/zimbra/ssl/zimbra/commercial/commercial.crt' Copying '/tmp/chain_stage.crt' to '/opt/zimbra/ssl/zimbra/commercial/commercial_ca.crt' Appending ca chain '/tmp/chain_stage.crt' to '/opt/zimbra/ssl/zimbra/commercial/commercial.crt' Importing cert '/opt/zimbra/ssl/zimbra/commercial/commercial_ca.crt' as 'zcs-user-commercial_ca' into cacerts '/opt/zimbra/common/lib/jvm/java/lib/security/cacerts' NOTE: restart mailboxd to use the imported certificate. Installing imapd certificate '/opt/zimbra/conf/imapd.crt' and key '/opt/zimbra/conf/imapd.key' Copying '/opt/zimbra/ssl/zimbra/commercial/commercial.crt' to '/opt/zimbra/conf/imapd.crt' Copying '/opt/zimbra/ssl/zimbra/commercial/commercial.key' to '/opt/zimbra/conf/imapd.key' Creating file '/opt/zimbra/ssl/zimbra/jetty.pkcs12' Creating keystore '/opt/zimbra/conf/imapd.keystore' Installing ldap certificate '/opt/zimbra/conf/slapd.crt' and key '/opt/zimbra/conf/slapd.key' Copying '/opt/zimbra/ssl/zimbra/commercial/commercial.crt' to '/opt/zimbra/conf/slapd.crt' Copying '/opt/zimbra/ssl/zimbra/commercial/commercial.key' to '/opt/zimbra/conf/slapd.key' Creating file '/opt/zimbra/ssl/zimbra/jetty.pkcs12' Creating keystore '/opt/zimbra/mailboxd/etc/keystore' Installing mta certificate '/opt/zimbra/conf/smtpd.crt' and key '/opt/zimbra/conf/smtpd.key' Copying '/opt/zimbra/ssl/zimbra/commercial/commercial.crt' to '/opt/zimbra/conf/smtpd.crt' Copying '/opt/zimbra/ssl/zimbra/commercial/commercial.key' to '/opt/zimbra/conf/smtpd.key' Installing proxy certificate '/opt/zimbra/conf/nginx.crt' and key '/opt/zimbra/conf/nginx.key' Copying '/opt/zimbra/ssl/zimbra/commercial/commercial.crt' to '/opt/zimbra/conf/nginx.crt' Copying '/opt/zimbra/ssl/zimbra/commercial/commercial.key' to '/opt/zimbra/conf/nginx.key' NOTE: restart services to use the new certificates. Cleaning up 7 files from '/opt/zimbra/conf/ca' Removing /opt/zimbra/conf/ca/ca.key Removing /opt/zimbra/conf/ca/ca.pem Removing /opt/zimbra/conf/ca/4b0006c8.0 Removing /opt/zimbra/conf/ca/commercial_ca_1.crt Removing /opt/zimbra/conf/ca/8d33f237.0 Removing /opt/zimbra/conf/ca/commercial_ca_2.crt Removing /opt/zimbra/conf/ca/4042bcee.0 Copying CA to /opt/zimbra/conf/ca Copying '/opt/zimbra/ssl/zimbra/ca/ca.key' to '/opt/zimbra/conf/ca/ca.key' Copying '/opt/zimbra/ssl/zimbra/ca/ca.pem' to '/opt/zimbra/conf/ca/ca.pem' Creating CA hash symlink '4b0006c8.0' -> 'ca.pem' Creating /opt/zimbra/conf/ca/commercial_ca_1.crt Creating CA hash symlink '31dfb39d.0' -> 'commercial_ca_1.crt' Creating /opt/zimbra/conf/ca/commercial_ca_2.crt Creating CA hash symlink '4042bcee.0' -> 'commercial_ca_2.crt' Host mbox2.zimbra.stage.town Stopping vmware-ha...Done. Stopping zmconfigd...Done. Stopping zimlet webapp...Done. Stopping zimbraAdmin webapp...Done. Stopping zimbra webapp...Done. Stopping service webapp...Done. Stopping stats...Done. Stopping onlyoffice...Done. Stopping spell...Done. Stopping snmp...Done. Stopping cbpolicyd...Done. Stopping archiving...Done. Stopping opendkim...Done. Stopping amavis...Done. Stopping antivirus...Done. Stopping antispam...Done. Stopping proxy...Done. Stopping memcached...Done. Stopping mailbox...Done. Stopping convertd...Done. Stopping logger...Done. Stopping dnscache...Done. Host mbox2.zimbra.stage.town - imapd: /opt/zimbra/conf/imapd.crt notBefore=Sep 9 11:09:44 2024 GMT notAfter=Dec 8 11:09:43 2024 GMT subject=CN = proxy-mta.zimbra.stage.town issuer=C = US, O = Let's Encrypt, CN = R11 SubjectAltName=ldap1.zimbra.stage.town, ldap2.zimbra.stage.town, mbox1.zimbra.stage.town, mbox2.zimbra.stage.town, proxy-mta.zimbra.stage.town, zimbra.stage.town - ldap: /opt/zimbra/conf/slapd.crt notBefore=Sep 9 11:09:44 2024 GMT notAfter=Dec 8 11:09:43 2024 GMT subject=CN = proxy-mta.zimbra.stage.town issuer=C = US, O = Let's Encrypt, CN = R11 SubjectAltName=ldap1.zimbra.stage.town, ldap2.zimbra.stage.town, mbox1.zimbra.stage.town, mbox2.zimbra.stage.town, proxy-mta.zimbra.stage.town, zimbra.stage.town - mailboxd: /opt/zimbra/mailboxd/etc/mailboxd.pem notBefore=Sep 9 11:09:44 2024 GMT notAfter=Dec 8 11:09:43 2024 GMT subject=CN = proxy-mta.zimbra.stage.town issuer=C = US, O = Let's Encrypt, CN = R11 SubjectAltName=ldap1.zimbra.stage.town, ldap2.zimbra.stage.town, mbox1.zimbra.stage.town, mbox2.zimbra.stage.town, proxy-mta.zimbra.stage.town, zimbra.stage.town - mta: /opt/zimbra/conf/smtpd.crt notBefore=Sep 9 11:09:44 2024 GMT notAfter=Dec 8 11:09:43 2024 GMT subject=CN = proxy-mta.zimbra.stage.town issuer=C = US, O = Let's Encrypt, CN = R11 SubjectAltName=ldap1.zimbra.stage.town, ldap2.zimbra.stage.town, mbox1.zimbra.stage.town, mbox2.zimbra.stage.town, proxy-mta.zimbra.stage.town, zimbra.stage.town - proxy: /opt/zimbra/conf/nginx.crt notBefore=Sep 9 11:09:44 2024 GMT notAfter=Dec 8 11:09:43 2024 GMT subject=CN = proxy-mta.zimbra.stage.town issuer=C = US, O = Let's Encrypt, CN = R11 SubjectAltName=ldap1.zimbra.stage.town, ldap2.zimbra.stage.town, mbox1.zimbra.stage.town, mbox2.zimbra.stage.town, proxy-mta.zimbra.stage.town, zimbra.stage.town
stdout_lines	[ " Verifying '/tmp/ssl_stage.crt' against '/tmp/commercial_stage.key'", "Certificate '/tmp/ssl_stage.crt' and private key '/tmp/commercial_stage.key' match.", " Verifying '/tmp/ssl_stage.crt' against '/tmp/chain_stage.crt'", "Valid certificate chain: /tmp/ssl_stage.crt: OK", " Verifying '/tmp/ssl_stage.crt' against '/opt/zimbra/ssl/zimbra/commercial/commercial.key'", "Certificate '/tmp/ssl_stage.crt' and private key '/opt/zimbra/ssl/zimbra/commercial/commercial.key' match.", " Verifying '/tmp/ssl_stage.crt' against '/tmp/chain_stage.crt'", "Valid certificate chain: /tmp/ssl_stage.crt: OK", " Copying '/tmp/ssl_stage.crt' to '/opt/zimbra/ssl/zimbra/commercial/commercial.crt'", " Copying '/tmp/chain_stage.crt' to '/opt/zimbra/ssl/zimbra/commercial/commercial_ca.crt'", " Appending ca chain '/tmp/chain_stage.crt' to '/opt/zimbra/ssl/zimbra/commercial/commercial.crt'", " Importing cert '/opt/zimbra/ssl/zimbra/commercial/commercial_ca.crt' as 'zcs-user-commercial_ca' into cacerts '/opt/zimbra/common/lib/jvm/java/lib/security/cacerts'", " NOTE: restart mailboxd to use the imported certificate.", " Installing imapd certificate '/opt/zimbra/conf/imapd.crt' and key '/opt/zimbra/conf/imapd.key'", " Copying '/opt/zimbra/ssl/zimbra/commercial/commercial.crt' to '/opt/zimbra/conf/imapd.crt'", " Copying '/opt/zimbra/ssl/zimbra/commercial/commercial.key' to '/opt/zimbra/conf/imapd.key'", " Creating file '/opt/zimbra/ssl/zimbra/jetty.pkcs12'", " Creating keystore '/opt/zimbra/conf/imapd.keystore'", " Installing ldap certificate '/opt/zimbra/conf/slapd.crt' and key '/opt/zimbra/conf/slapd.key'", " Copying '/opt/zimbra/ssl/zimbra/commercial/commercial.crt' to '/opt/zimbra/conf/slapd.crt'", " Copying '/opt/zimbra/ssl/zimbra/commercial/commercial.key' to '/opt/zimbra/conf/slapd.key'", " Creating file '/opt/zimbra/ssl/zimbra/jetty.pkcs12'", " Creating keystore '/opt/zimbra/mailboxd/etc/keystore'", " Installing mta certificate '/opt/zimbra/conf/smtpd.crt' and key '/opt/zimbra/conf/smtpd.key'", " Copying '/opt/zimbra/ssl/zimbra/commercial/commercial.crt' to '/opt/zimbra/conf/smtpd.crt'", " Copying '/opt/zimbra/ssl/zimbra/commercial/commercial.key' to '/opt/zimbra/conf/smtpd.key'", " Installing proxy certificate '/opt/zimbra/conf/nginx.crt' and key '/opt/zimbra/conf/nginx.key'", " Copying '/opt/zimbra/ssl/zimbra/commercial/commercial.crt' to '/opt/zimbra/conf/nginx.crt'", " Copying '/opt/zimbra/ssl/zimbra/commercial/commercial.key' to '/opt/zimbra/conf/nginx.key'", " NOTE: restart services to use the new certificates.", " Cleaning up 7 files from '/opt/zimbra/conf/ca'", " Removing /opt/zimbra/conf/ca/ca.key", " Removing /opt/zimbra/conf/ca/ca.pem", " Removing /opt/zimbra/conf/ca/4b0006c8.0", " Removing /opt/zimbra/conf/ca/commercial_ca_1.crt", " Removing /opt/zimbra/conf/ca/8d33f237.0", " Removing /opt/zimbra/conf/ca/commercial_ca_2.crt", " Removing /opt/zimbra/conf/ca/4042bcee.0", " Copying CA to /opt/zimbra/conf/ca", " Copying '/opt/zimbra/ssl/zimbra/ca/ca.key' to '/opt/zimbra/conf/ca/ca.key'", " Copying '/opt/zimbra/ssl/zimbra/ca/ca.pem' to '/opt/zimbra/conf/ca/ca.pem'", " Creating CA hash symlink '4b0006c8.0' -> 'ca.pem'", " Creating /opt/zimbra/conf/ca/commercial_ca_1.crt", " Creating CA hash symlink '31dfb39d.0' -> 'commercial_ca_1.crt'", " Creating /opt/zimbra/conf/ca/commercial_ca_2.crt", " Creating CA hash symlink '4042bcee.0' -> 'commercial_ca_2.crt'", "Host mbox2.zimbra.stage.town", "\tStopping vmware-ha...Done.", "\tStopping zmconfigd...Done.", "\tStopping zimlet webapp...Done.", "\tStopping zimbraAdmin webapp...Done.", "\tStopping zimbra webapp...Done.", "\tStopping service webapp...Done.", "\tStopping stats...Done.", "\tStopping onlyoffice...Done.", "\tStopping spell...Done.", "\tStopping snmp...Done.", "\tStopping cbpolicyd...Done.", "\tStopping archiving...Done.", "\tStopping opendkim...Done.", "\tStopping amavis...Done.", "\tStopping antivirus...Done.", "\tStopping antispam...Done.", "\tStopping proxy...Done.", "\tStopping memcached...Done.", "\tStopping mailbox...Done.", "\tStopping convertd...Done.", "\tStopping logger...Done.", "\tStopping dnscache...Done.", "Host mbox2.zimbra.stage.town", "- imapd: /opt/zimbra/conf/imapd.crt", "notBefore=Sep 9 11:09:44 2024 GMT", "notAfter=Dec 8 11:09:43 2024 GMT", "subject=CN = proxy-mta.zimbra.stage.town", "issuer=C = US, O = Let's Encrypt, CN = R11", "SubjectAltName=ldap1.zimbra.stage.town, ldap2.zimbra.stage.town, mbox1.zimbra.stage.town, mbox2.zimbra.stage.town, proxy-mta.zimbra.stage.town, zimbra.stage.town", "- ldap: /opt/zimbra/conf/slapd.crt", "notBefore=Sep 9 11:09:44 2024 GMT", "notAfter=Dec 8 11:09:43 2024 GMT", "subject=CN = proxy-mta.zimbra.stage.town", "issuer=C = US, O = Let's Encrypt, CN = R11", "SubjectAltName=ldap1.zimbra.stage.town, ldap2.zimbra.stage.town, mbox1.zimbra.stage.town, mbox2.zimbra.stage.town, proxy-mta.zimbra.stage.town, zimbra.stage.town", "- mailboxd: /opt/zimbra/mailboxd/etc/mailboxd.pem", "notBefore=Sep 9 11:09:44 2024 GMT", "notAfter=Dec 8 11:09:43 2024 GMT", "subject=CN = proxy-mta.zimbra.stage.town", "issuer=C = US, O = Let's Encrypt, CN = R11", "SubjectAltName=ldap1.zimbra.stage.town, ldap2.zimbra.stage.town, mbox1.zimbra.stage.town, mbox2.zimbra.stage.town, proxy-mta.zimbra.stage.town, zimbra.stage.town", "- mta: /opt/zimbra/conf/smtpd.crt", "notBefore=Sep 9 11:09:44 2024 GMT", "notAfter=Dec 8 11:09:43 2024 GMT", "subject=CN = proxy-mta.zimbra.stage.town", "issuer=C = US, O = Let's Encrypt, CN = R11", "SubjectAltName=ldap1.zimbra.stage.town, ldap2.zimbra.stage.town, mbox1.zimbra.stage.town, mbox2.zimbra.stage.town, proxy-mta.zimbra.stage.town, zimbra.stage.town", "- proxy: /opt/zimbra/conf/nginx.crt", "notBefore=Sep 9 11:09:44 2024 GMT", "notAfter=Dec 8 11:09:43 2024 GMT", "subject=CN = proxy-mta.zimbra.stage.town", "issuer=C = US, O = Let's Encrypt, CN = R11", "SubjectAltName=ldap1.zimbra.stage.town, ldap2.zimbra.stage.town, mbox1.zimbra.stage.town, mbox2.zimbra.stage.town, proxy-mta.zimbra.stage.town, zimbra.stage.town" ]

Playbook #1583

Task result details