diff --git a/ansible/roles/certificates/defaults/main.yml b/ansible/roles/certificates/defaults/main.yml
new file mode 100644
index 0000000..260ba96
--- /dev/null
+++ b/ansible/roles/certificates/defaults/main.yml
@@ -0,0 +1,4 @@
+---
+# Generate certs to local current dir where ansible in run (= playbook_dir)
+# After ansible run, dir can be deleted but idempotence is lost and certs are re-generated in next run
+certificates_local_dir: certs