Active
AI Generated
Proactive Assessment
Scan before expiry
Description
Scheduled proactive scans inventory the full certificate estate and renew or escalate before expiry becomes an incident. Extends the risk-based 201 pattern with estate-wide coverage and compliance reporting.
Why it matters
- Proactive scans catch expiring certificates before monitoring fires at 2 a.m.
- Estate-wide inventory avoids the surprise of a forgotten cert on a non-production host.
- Compliance reporting closes the loop for auditors who need proof of lifecycle management.
AO building blocks
Automation orchestrator step types this workflow uses on the canvas. See all building blocks
-
Triggers
Schedule trigger
Starts a workflow automatically on a recurring schedule — nightly, hourly, or a custom cron expression — for recurring housekeeping like certificate renewal checks, drift detection, or report generation without a human or external system kicking off the run.
-
Logic
Switch step
Evaluates conditions and routes execution to the first matching branch, supporting up to 100 ordered paths plus a fallback when nothing matches. Use it to branch on severity tiers, environment (dev/staging/prod), or AI agent output categories where a binary conditional isn't enough.
-
AAP execution
AAP job template
Launches a single Ansible Automation Platform job template from the workflow, polling until the job completes and exposing results to downstream steps. The standard bridge between automation orchestrator reasoning and AAP execution — one playbook with resolved inventory, credentials, limits, and extra vars.
Interactive Experience
Planned scope
- Scheduled scanning of the full certificate estate
- AI classification across all discovered certs
- Auto-remediation for low-risk certs
- Escalation for critical certs
- Compliance reporting
Workflow
flowchart LR
A@{ img: "https://ansible-tmm.github.io/aap-orchestrator-demos/assets/icons/manual-trigger.png", label: "Scheduled Scan", pos: "b", h: 96, constraint: "on" } --> B@{ img: "https://ansible-tmm.github.io/aap-orchestrator-demos/assets/icons/launch-aap-job-template.png", label: "Scan Certificates", pos: "b", h: 96, constraint: "on" }
B --> C@{ img: "https://ansible-tmm.github.io/aap-orchestrator-demos/assets/icons/switch-node.png", label: "Scan Result", pos: "b", h: 96, constraint: "on" }
C -->|Needs Renewal| D@{ img: "https://ansible-tmm.github.io/aap-orchestrator-demos/assets/icons/launch-aap-job-template.png", label: "Renew Proactively", pos: "b", h: 96, constraint: "on" }
C -->|All OK| E@{ img: "https://ansible-tmm.github.io/aap-orchestrator-demos/assets/icons/launch-aap-job-template.png", label: "Log OK", pos: "b", h: 96, constraint: "on" }
D --> F@{ img: "https://ansible-tmm.github.io/aap-orchestrator-demos/assets/icons/launch-aap-job-template.png", label: "Compliance Report", pos: "b", h: 96, constraint: "on" }
E --> F
F --> G@{ img: "https://ansible-tmm.github.io/aap-orchestrator-demos/assets/icons/launch-aap-job-template.png", label: "Notify Chatroom", pos: "b", h: 96, constraint: "on" }
classDef noBorder fill:transparent,stroke:transparent
class A,B,C,D,E,F,G noBorder
Switch routing
| Condition | Action |
|---|---|
Expires within window |
Renew proactively |
No expiry risk |
Log OK — no action |
Playbooks
| Playbook | What it does | Runs on |
|---|---|---|
scan_certificates.yml
|
Scans configurable certificate paths, classifies expiring vs healthy, publishes cert_scan_result artifact. | RHEL node |
renew_proactive.yml
|
Proactively renews expiring certificates found by the scan. | RHEL node |
log_ok.yml
|
Logs healthy certificate estate when no renewals are needed. | RHEL node |
compliance_report.yml
|
Generates a compliance percentage report of the certificate estate. | localhost |
notify_chatroom.yml
|
Posts certificate scan results to Mattermost. | localhost (Mattermost API) |
AI Generated
This demo's playbooks and workflow were generated by AI to illustrate the pattern. They have not been fully tested in a live environment. Review and adapt before using in production.