Is custom BIG-IP device certificates renewal via cli or ansible-modules possible?

You can use the TMSH command to run a bash command. In this case, openssl to generate the device self certificate (K9114 article). May be best however to create a file to feed into openssl with your required inputs such as CN, locality, etc and run the openssl command against this. Ansible supports running TMSH commands and running commands on the linux command line. I use that for setting master keys across devices 🙂