See below for details on the playbook variable handshakes.

csr_pem_output_var    

Assign to this variable the name of the Ansible fact your pre-issuance playbook will set the CSR into. For example:

csr_pem

The platform:

  1. Reads that fact
  2. Takes the CSR
  3. Enrolls the certificate

The pre-issuance playbook generates the private key on the target host, and this key never leaves that host.

certificate_pem_output_var

Assign the name of the extra variable you want the issued certificate delivered in. For example:

cert_pem

After enrollment:

  • If the Certificate Destination File Path is configured on the Bulk Destination, the platform writes the certificate to that path, and the certificate variable is left empty — which is why the post-issuance sample guards its "write cert" task with: 
    when: cert_pem is defined and cert_pem | length > 0
  • Otherwise, the platform puts the issued certificate PEM into that variable so your post-issuance playbook can read it. 

shared_certificate    

Set this variable to:

  • true to publish one certificate shared across all hosts.
  • false to publish a separate certificate per host