Issue 1:
From @codegastudio on November 12, 2016 9:3

ISSUE TYPE

Bug Report

COMPONENT NAME

Letsencrypt

ANSIBLE VERSION

ansible 2.2.0.0
config file =
configured module search path = Default w/o overrides

CONFIGURATION

None

OS / ENVIRONMENT

MacOS Sierra to Ubuntu 14.04.2 LTS trusty

SUMMARY

Follow steps describe in letsencrypt_module and get error

Error creating new cert :: Certificate public key must be different than account key

At first run, i get error during ' letsencrypt step two'.

At second run, error appear during ' letsencrypt step one'.

At any time crt file is created.

curl access fine to challenge.

STEPS TO REPRODUCE

---
- stat: path=/home/{{ user }}/ssl/{{ inventory_hostname }}.key
register: rsa_key_file
tags: letsencrypt

- stat: path=/home/{{ user }}/ssl/{{ inventory_hostname }}.csr
register: csr_file
tags: letsencrypt

- name: create letsencrypt SSL repository
file: >
path=/home/{{ user }}/ssl
state=directory
mode=0755
owner={{ user }}
group={{ user }}
tags: letsencrypt

- name: generate RSA key
command: openssl genrsa -out /home/{{ user }}/ssl/{{ inventory_hostname }}.key 2048
when: rsa_key_file.stat.exists == False

- name: change KEY owner
file: >
path=/home/{{ user }}/ssl/{{ inventory_hostname }}.key
owner={{ user }}
group={{ user }}
tags: letsencrypt

- name: generate CSR
command: openssl req -new -sha256 -key /home/{{ user }}/ssl/{{ inventory_hostname }}.key -out /home/{{ user }}/ssl/{{ inventory_hostname }}.csr -passin pass:{{ letsencrypt.csr_pass_phrase }} -subj {{ letsencrypt.csr_subj }}
when: csr_file.stat.exists == False
tags: letsencrypt

- name: change CSR owner
file: path=/home/{{ user }}/ssl/{{ inventory_hostname }}.csr owner={{ user }} group={{ user }}
tags: letsencrypt

- name: letsencrypt step one
letsencrypt: >
account_key=/home/{{ user }}/ssl/{{ inventory_hostname }}.key
csr=/home/{{ user }}/ssl/{{ inventory_hostname }}.csr
dest=/home/{{ user }}/ssl/{{ inventory_hostname }}.crt
remaining_days={{ letsencrypt.ssl_days_duration }}
account_email={{ letsencrypt.account_email }}
register: sample_com_challenge
tags: letsencrypt

- name: create letsencrypt challenge data repository
file: >
path=/home/{{ user }}/challenges/{{ sample_com_challenge['challenge_data'][ inventory_hostname]['http-01']['resource'] | dirname }}
state=directory
mode=0755
owner={{ user }}
group={{ user }}
recurse=yes
tags: letsencrypt

- name: copy challenge data in directory
copy: >
dest=/home/{{ user }}/challenges/{{ sample_com_challenge['challenge_data'][ inventory_hostname]['http-01']['resource'] }}
content="{{ sample_com_challenge['challenge_data'][inventory_hostname]['http-01']['resource_value'] }}"
owner={{ user }}
group={{ user }}
when: sample_com_challenge|changed
tags: letsencrypt

- name: letsencrypt step two
letsencrypt: >
account_key=/home/{{ user }}/ssl/{{ inventory_hostname }}.key
csr=/home/{{ user }}/ssl/{{ inventory_hostname }}.csr
dest=/home/{{ user }}/ssl/{{ inventory_hostname }}.crt
data={{ sample_com_challenge }}
remaining_days={{ letsencrypt.ssl_days_duration }}
account_email={{ letsencrypt.account_email }}
when: sample_com_challenge
tags: letsencrypt

EXPECTED RESULTS

ACTUAL RESULTS

letsencrypt step two (first run)

fatal: [mydomain.com]: FAILED! => {
"changed": false,
"failed": true,
"invocation": {
"module_args": {
"account_email": "account email",
"account_key": "/path/to/mydomain.com.key",
"acme_directory": "https://acme-staging.api.letsencrypt.org/directory",
"agreement": "https://letsencrypt.org/documents/LE-SA-v1.1.1-August-1-2016.pdf",
"challenge": "http-01",
"csr": "/path/to/mydomain.com.csr",
"data": {
"authorizations": [
{
"challenges": [
{
"status": "pending",
"token": "3lrXt6Z4BoiG1-chtNQN5qp1NpZSPxsqMO_fXrsVkUg",
"type": "dns-01",
"uri": "https://acme-staging.api.letsencrypt.org/acme/challenge/hoWJesKjyhFDejgmLdr5OeYw0DnjNxu4Q3km6MvO5C4/16834820"
},
{
"status": "pending",
"token": "fmbH41Un6qNaAscvfWRgTjeyqepRGC5bE75Ok5tlrW8",
"type": "http-01",
"uri": "https://acme-staging.api.letsencrypt.org/acme/challenge/hoWJesKjyhFDejgmLdr5OeYw0DnjNxu4Q3km6MvO5C4/16834821"
},
{
"status": "pending",
"token": "WLsp235f8mMR6vDMFSKvPFD4ksb3Ih-6cLExV2nZuo0",
"type": "tls-sni-01",
"uri": "https://acme-staging.api.letsencrypt.org/acme/challenge/hoWJesKjyhFDejgmLdr5OeYw0DnjNxu4Q3km6MvO5C4/16834822"
}
],
"combinations": [
[
1
],
[
2
],
[
0
]
],
"expires": "2016-11-19T08:50:42.20041263Z",
"identifier": {
"type": "dns",
"value": "mydomain.com"
},
"status": "pending",
"uri": "https://acme-staging.api.letsencrypt.org/acme/authz/hoWJesKjyhFDejgmLdr5OeYw0DnjNxu4Q3km6MvO5C4"
}
],
"cert_days": -1,
"challenge_data": {
"mydomain.com": {
"dns-01": {
"resource": "_acme-challenge",
"resource_value": "IcS0IrdJ1Y18Ss0E751NsxQW2Pac9HqHPVLYr95CE4s"
},
"http-01": {
"resource": ".well-known/acme-challenge/fmbH41Un6qNaAscvfWRgTjeyqepRGC5bE75Ok5tlrW8",
"resource_value": "fmbH41Un6qNaAscvfWRgTjeyqepRGC5bE75Ok5tlrW8.oBDu6v-YxqIYLfJ80VhCzjYW2UyoK9P6HuZP0IkENAc"
}
}
},
"changed": true
},
"dest": "/path/to/mydomain.com.crt",
"remaining_days": 365
},
"module_name": "letsencrypt"
},
"msg": "Error new cert: CODE: 400 RESULT: {\n \"type\": \"urn:acme:error:malformed\",\n \"detail\": \"Error creating new cert :: Certificate public key must be different than account key\",\n \"status\": 400\n}"
}

letsencrypt step one (second run)

fatal: [mydomain.com]: FAILED! => {
"changed": false,
"failed": true,
"invocation": {
"module_args": {
"account_email": "account email",
"account_key": "/path/to/mydomain.com.key",
"acme_directory": "https://acme-staging.api.letsencrypt.org/directory",
"agreement": "https://letsencrypt.org/documents/LE-SA-v1.1.1-August-1-2016.pdf",
"challenge": "http-01",
"csr": "/path/to/mydomain.com.csr",
"data": null,
"dest": "/path/to/mydomain.com.crt",
"remaining_days": 365
},
"module_name": "letsencrypt"
},
"msg": "Error new cert: CODE: 400 RESULT: {\n \"type\": \"urn:acme:error:malformed\",\n \"detail\": \"Error creating new cert :: Certificate public key must be different than account key\",\n \"status\": 400\n}"
}

Copied from original issue: ansible/ansible-modules-extras#3444

Issue 2:
When running this task

- name: 'Subversion | Install SSH user public keys'
authorized_key: user=sshsvn
key="{{lookup('file', inventory_dir + '/files/certs/' + item + '.svn.pub')}}"
key_options='command="/usr/local/bin/svnserve -t --tunnel-user={{item}}",no-port-forwarding,no-agent-forwarding,no-X11-forwarding,no-pty'
with_items: svn_user

then the key options are no longer added to the ~/.ssh/authorized_keys file on the remote host anymore. This used to be working prior to version 1.4 final but is no longer working since. Tested against 1.4.1, 1.4.3 and 1.5dev/HEAD.

To reproduce, simply run the above task where the variable svn_user is a list of usernames as strings and the file "item.svn.pub" is a SSH RSA public key file.