While Ansible is generally good at automating various tasks across infrastructure, there are scenarios where manual intervention is required. These cases often involve processes that require specific implementations that can't be scripted or automated.
The following example illustrates this point. You've come across a manual task that requires you to enroll certificates for the Windows hosts while running the `playbook.yml` file.
Auto-enroll certificate templates (Windows)
Consider the scenario of deploying certificates within your AD network. Here, Ansible is used to automate the initial setup of certificate authorities (CAs) and distribute certificates to the Windows hosts. However, the process of auto-enrolling certificate templates may require a manual touch.
Why? Certificate enrollment requires you to select specific templates, configure security permissions, and manage permissions that are unique to the environment, as there isn't a one-size-fits-all solution.
Ansible playbook and manual enrollments
On line 58 of [this Ansible playbook](https://github.com/immersive-labs-content/team-sim-ranges/blob/c771a8b0f4fa00f3619417cda752ca9df4b33ad8/ranges/example/range/playbooks/windows/certificate_authority/certificate_authority.yml#L57), the `ansible.builtin.pause` module is used to pause the playbook execution and wait for the user to manually enroll the certificates.
name: Manual configuration required
ansible.builtin.pause:
prompt: "Manual configuration required. See docs/ca.md for manual configurations of auto-enroll templates. Once manual configuration is completed successfully, press any key to continue."
This is done by pointing the user to navigate to `docs/ca.md` and follow the steps to enroll the certificates. `ca.md` presents a step-by-step guide to walk you through the manual process of enrolling the certificates.
Configuring computer templates for CAs
[!TIP]
Right click the GIF images and open them in a new tab to view them in full size.When following the steps in `ca.md`, you'll need to log in to the CA01 instance via the RDP panel using the `m.magdelena` user credentials as an enterprise admin and configure the computer template for the CA. Once logged in, open the `Certificate Template Console` via the Start menu. Expand your CA server, right-click on `Certificate Templates`, and select `Manage`. Then you'll need to configure the user template for the certificate authority.
To start, right-click on `User` and select `Duplicate Template`. Under the General tab, configure the template name to `User (AD)`, set the validity period to 10 years, and select the `Publish certificate in Active Directory` checkbox. Under the Subject Name tab, disable `Include e-mail name in subject name`, `DNS name`, and `E-mail name` and enable `User Principal Name (UPN)`. Lastly, under the Security tab, add `Read`, `Enroll`, and `Autoenroll` permissions for the `Domain Users` group.
Configuring user templates for CAs
When following the steps in `ca.md`, you'll need to log into the CA01 instance via the RDP panel using the `m.magdelena` user credentials as an enterprise admin and configure the computer template for the CA. Once logged in, open the `Certificate Template Console` via the Start menu. Expand your CA server, right-click on `Certificate Templates` and select `Manage`. Then, configure the user template for the certificate authority.
Right-click on `User` and select `Duplicate Template`. Under the General tab, configure the template name to `User (AD)`, set the validity period to 10 years, and select the `Publish certificate in Active Directory` checkbox. Under the Subject Name tab, disable `Include e-mail name in subject name`, `DNS name`, `E-mail name` and enable `User Principal Name (UPN)`. Lastly, under the **Security** tab, add `Read`, `Enroll` and `Autoenroll` permissions for the `Domain Users` group.
Applying the templates
Once the templates are configured for both computer and user templates, you can then apply them. To do this, right-click on `Certificate Templates` and select `New` then `Certificate Template to Issue`. Select the `Computer (AD)` and `User (AD)` templates and click `OK`.