Repository: ansible/ansible

Issue:
Lets Encrypt default value is no longer correct for sub agreement
<!---
Verify first that your issue/request is not already reported on GitHub.
Also test if the latest release, and master branch are affected too.
-->

##### ISSUE TYPE
<!--- Pick one below and delete the rest: -->
 - Bug Report

##### COMPONENT NAME
<!--- Name of the module/plugin/task/feature -->
Lets Encrypt

##### ANSIBLE VERSION
<!--- Paste verbatim output from "ansible --version" between quotes below -->
```
ansible 2.4.0.0
  config file = None
  configured module search path = [u'/home/__NOPE__/.ansible/plugins/modules', u'/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/local/lib/python2.7/dist-packages/ansible
  executable location = /usr/local/bin/ansible
  python version = 2.7.14 (default, Sep 17 2017, 18:50:44) [GCC 7.2.0]

```

##### CONFIGURATION
Yah nothing relevant here

##### OS / ENVIRONMENT
Also irrelevant

##### SUMMARY
Lets Encrypt changed their subscriber agreement. Default is 
now incorrect

##### STEPS TO REPRODUCE
Attempt to use Lets Encrypt

##### EXPECTED RESULTS

It worked, as it has been for some months
##### ACTUAL RESULTS

```
fatal: [18.195.37.52]: FAILED! => {"changed": false, "failed": true, "msg": "Error registering: 400 {\n  \"type\": \"urn:acme:error:malformed\",\n  \"detail\": \"Provided agreement URL [https://letsencrypt.org/documents/LE-SA-v1.1.1-August-1-2016.pdf] does not match current agreement URL [https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf]\",\n  \"status\": 400\n}"}
```



Discussion:
https://github.com/ansible/ansible/blob/devel/lib/ansible/modules/web_infrastructure/letsencrypt.py#L794

you need to provide an actual `agreement` field manually

```
- name: ACME step one
  letsencrypt:
    account_email: "{{ letsencrypt_admin }}"
    agreement: 'https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf'
    account_key: /etc/pki/letsencrypt/letsencrypt_account.key
    acme_directory: 'https://acme-v01.api.letsencrypt.org/directory'
    challenge: dns-01
    csr: "/etc/pki/letsencrypt/{{ application_name }}_le.csr"
    dest: "{{ ssl_cert_path }}"
    remaining_days: 20
  register: acme_data
```
Yah we have but this stub is to decide whether to update the default

On Thu, 16 Nov 2017, 11:37 Anton Markelov, <notifications@github.com> wrote:

>
> https://github.com/ansible/ansible/blob/devel/lib/ansible/modules/web_infrastructure/letsencrypt.py#L794
>
> you need to provide an actual agreement field manually
>
> - name: ACME step one
>   letsencrypt:
>     account_email: "{{ letsencrypt_admin }}"
>     agreement: 'https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf'
>     account_key: /etc/pki/letsencrypt/letsencrypt_account.key
>     acme_directory: 'https://acme-v01.api.letsencrypt.org/directory'
>     challenge: dns-01
>     csr: "/etc/pki/letsencrypt/{{ application_name }}_le.csr"
>     dest: "{{ ssl_cert_path }}"
>     remaining_days: 20
>   register: acme_data
>
> —
> You are receiving this because you authored the thread.
> Reply to this email directly, view it on GitHub
> <https://github.com/ansible/ansible/issues/32929#issuecomment-344883237>,
> or mute the thread
> <https://github.com/notifications/unsubscribe-auth/AGaMI88oZN-SVMbwLytcwZOBcPDp22hUks5s3BBhgaJpZM4Qe3w6>
> .
>
-- 
Andrew Howden
Careful, well crafted web development.
--
W: https://andrewhowden.com/
PGP: https://pgp.andrewhowden.com (79BAC08A6ED1FF1EABE350A7587D3B3A961D2D2D)
--


Resolving patch:
diff --git a/lib/ansible/modules/web_infrastructure/letsencrypt.py b/lib/ansible/modules/web_infrastructure/letsencrypt.py
--- a/lib/ansible/modules/web_infrastructure/letsencrypt.py
+++ b/lib/ansible/modules/web_infrastructure/letsencrypt.py
@@ -61,7 +61,7 @@
     description:
       - "URI to a terms of service document you agree to when using the
          ACME service at C(acme_directory)."
-    default: 'https://letsencrypt.org/documents/LE-SA-v1.1.1-August-1-2016.pdf'
+      - Default is latest gathered from C(acme_directory) URL.
   challenge:
     description: The challenge to be performed.
     choices: [ 'http-01', 'dns-01', 'tls-sni-02']
@@ -305,11 +305,12 @@ class ACMEAccount(object):
     '''
     def __init__(self, module):
         self.module = module
-        self.agreement = module.params['agreement']
         self.key = module.params['account_key']
         self.email = module.params['account_email']
         self.data = module.params['data']
         self.directory = ACMEDirectory(module)
+        self.agreement = module.params['agreement'] or self.directory['meta']['terms-of-service']
+
         self.uri = None
         self.changed = False
 
@@ -791,7 +792,7 @@ def main():
             account_key=dict(required=True, type='path'),
             account_email=dict(required=False, default=None, type='str'),
             acme_directory=dict(required=False, default='https://acme-staging.api.letsencrypt.org/directory', type='str'),
-            agreement=dict(required=False, default='https://letsencrypt.org/documents/LE-SA-v1.1.1-August-1-2016.pdf', type='str'),
+            agreement=dict(required=False, type='str'),
             challenge=dict(required=False, default='http-01', choices=['http-01', 'dns-01', 'tls-sni-02'], type='str'),
             csr=dict(required=True, aliases=['src'], type='path'),
             data=dict(required=False, no_log=True, default=None, type='dict'),


Test patch: