diff --git a/changelogs/fragments/740-ecs_certificate-renewal-without-csr.yml b/changelogs/fragments/740-ecs_certificate-renewal-without-csr.yml new file mode 100644 index 000000000..bb7f15b0d --- /dev/null +++ b/changelogs/fragments/740-ecs_certificate-renewal-without-csr.yml @@ -0,0 +1,2 @@ +bugfixes: + - "ecs_certificate - fixed ``csr`` option to be empty and allow renewal of a specific certificate according to the Renewal Information specification (https://github.com/ansible-collections/community.crypto/pull/740)." diff --git a/plugins/modules/ecs_certificate.py b/plugins/modules/ecs_certificate.py index 2c1238d48..0276556ab 100644 --- a/plugins/modules/ecs_certificate.py +++ b/plugins/modules/ecs_certificate.py @@ -938,8 +938,8 @@ def main(): module.fail_json(msg='The cert_expiry field is invalid when request_type="reissue".') elif module.params['cert_lifetime']: module.fail_json(msg='The cert_lifetime field is invalid when request_type="reissue".') - # Only a reissued request can omit the CSR - else: + # Reissued or renew request can omit the CSR + elif module.params['request_type'] != 'renew': module_params_csr = module.params['csr'] if module_params_csr is None: module.fail_json(msg='The csr field is required when request_type={0}'.format(module.params['request_type']))