Install a letsencrypt acmetool hook script when mongodb's certificates are managed by letsencrypt. See https://support.d4science.org/issues/12448

mongodb-org-3.2/tasks/main.yml

@@ -1,2 +1,5 @@
 ---
 - import_tasks: mongodb.yml
+- import_tasks: mongodb-letsencrypt-acmetool.yml
+  when: mongodb_ssl_letsencrypt_managed
+

mongodb-org-3.2/tasks/mongodb-letsencrypt-acmetool.yml

@@ -0,0 +1,12 @@
+---
+- block:
+  - name: Create the acme hooks directory if it does not yet exist
+    file: dest={{ letsencrypt_acme_services_scripts_dir }} state=directory owner=root group=root
+
+  - name: Install a script that fix the letsencrypt certificate for mongodb and then reload the service
+    template: src=mongodb-letsencrypt-acmetool.sh dest={{ letsencrypt_acme_services_scripts_dir }}/mongodb owner=root group=root mode=4555
+
+  when:
+    - mongodb_ssl_letsencrypt_managed
+    - letsencrypt_acme_install
+  tags: [ 'mongodb', 'letsencrypt', 'mongodb_letsencrypt' ]

mongodb-org-3.2/templates/mongodb-letsencrypt-acmetool.sh

@@ -0,0 +1,33 @@
+#!/bin/bash
+
+LE_CERTS_DIR=/etc/letsencrypt/live/$HOSTNAME
+LE_LOG_DIR=/var/log/letsencrypt
+MONGODB_CERTDIR=/etc/pki/mongodb
+MONGODB_CERTFILE=$MONGODB_CERTDIR/mongodb.pem
+DATE=$( date )
+echo "$DATE" >> $LE_LOG_DIR/mongodb.log
+
+if [ -f /etc/default/letsencrypt ] ; then
+    . /etc/default/letsencrypt
+else
+    echo "No letsencrypt default file" >> $LE_LOG_DIR/mongodb.log
+    exit 1
+fi
+
+[ ! -d $MONGODB_CERTDIR ] && mkdir $MONGODB_CERTDIR
+
+echo "Building the new certificate file" >> $LE_LOG_DIR/mongodb.log
+cat ${LE_CERTS_DIR}/{cert,privkey} > ${MONGODB_CERTFILE}
+chmod 440 ${MONGODB_CERTFILE}
+chgrp mongodb ${MONGODB_CERTFILE}
+
+{% if mongodb_ssl_enabled %}
+echo "Reload the mongodb service" >> $LE_LOG_DIR/mongodb.log
+service mongodb stop >/dev/null 2>&1
+sleep 10
+service mongodb start >/dev/null 2>&1
+{% endif %}
+echo "Done." >> $LE_LOG_DIR/mongodb.log
+
+exit 0
+