Letsencrypt autorenewal fails for OKD 3.11 about installcentos

[nadilas]

I managed to get around this by using acme.sh on the host:
GD_Key="" GD_Secret="" ~/.acme.sh/acme.sh --renew --renew-hook ~/scaledown.sh --post-hook ~/scaleup.sh --dns dns_gd --cert-home /etc/letsencrypt/live -d domain -d ".domain" -d ".apps.domain" --cert-file /etc/letsencrypt/live/domain/cert.pem --key-file /etc/letsencrypt/live/domain/privkey.pem --fullchain-file /etc/letsencrypt/live/domain/fullchain.pem --ca-file /etc/letsencrypt/live/domain/chain.pem

Even though it was done, OKD doesn't seem to recognize the renewed certificates (still showing old expiration date in the web browser). However console is happy:

Cert not yet due for renewal

I presume I need to redeploy them, but I forgot how. :)

[nadilas]

So it took time some time, but here's what you do, after changing to acme.sh:

ansible-playbook -i inventory.ini openshift-ansible/playbooks/redeploy-certificates.yml

use updated openshift-ansible (3.11.104-1) PR: openshift/openshift-ansible#11472