# Ansible 1.9.4 CERTIFICATE\_VERIFY\_FAILED when connecting to Windows Server **URL:** \ **Category:** Ansible Project\ **Tags:** windows\ **Created:** [October 11, 2015, 5:21am UTC](https://forum.ansible.com/t/ansible-1-9-4-certificate-verify-failed-when-connecting-to-windows-server/19480 "2015-10-11T05:21:05Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![Jason\_Levitt](https://avatars.discourse-cdn.com/v4/letter/j/779978/32.png) [@Jason\_Levitt](https://forum.ansible.com/u/Jason_Levitt)\ **Post date:** [October 11, 2015, 5:21am UTC](https://forum.ansible.com/t/ansible-1-9-4-certificate-verify-failed-when-connecting-to-windows-server/19480/1 "2015-10-11T05:21:05Z")
Using Ansible 1.9.4 and Python 2.7.10 on MacOSX 10.10.5 When attempting: ` env ANSIBLE\_LOAD\_CALLBACK\_PLUGINS=1 ansible winserv -i …/windows\_servers -m win\_ping ` I get: ` 54.68.166.123 | FAILED =\> 500 WinRMTransport. [SSL: CERTIFICATE\_VERIFY\_FAILED] certificate verify failed (\_ssl.c:590) ` As suggested in previous postings, I have a file named fix-ssl.py in my callback\_plugins folder: ` import ssl if hasattr(ssl, ‘\_create\_default\_https\_context’) and hasattr(ssl, ‘\_create\_unverified\_context’): ssl.\_create\_default\_https\_context = ssl.\_create\_unverified\_context class CallbackModule(object): pass ` And in my ansible.cfg file, I have: `bin_ansible_callbacks=True callback_plugins = /callback_plugins/fix-ssl.py` How can I get this to work? ---
**Author:** ![Jason\_Levitt](https://avatars.discourse-cdn.com/v4/letter/j/779978/32.png) [@Jason\_Levitt](https://forum.ansible.com/u/Jason_Levitt)\ **Post date:** [October 12, 2015, 3:31pm UTC](https://forum.ansible.com/t/ansible-1-9-4-certificate-verify-failed-when-connecting-to-windows-server/19480/2 "2015-10-12T15:31:27Z")
Has anyone gotten Ansible 1.9.4 to work with Windows Server using the “ansible” (not ansible-playbook) command? J ---
**Author:** ![j.r.hawkesworth](https://avatars.discourse-cdn.com/v4/letter/j/a3d4f5/32.png) [@j.r.hawkesworth](https://forum.ansible.com/u/j.r.hawkesworth)\ **Post date:** [October 13, 2015, 12:45pm UTC](https://forum.ansible.com/t/ansible-1-9-4-certificate-verify-failed-when-connecting-to-windows-server/19480/3 "2015-10-13T12:45:47Z")
Just wondering if the callback plugin is actually getting loaded. You have `callback_plugins = /callback_plugins/fix-ssl.py` configured but that would be an unusual location if you intended an absolute path. I think you need to configure a full path to the folder, not the name of a file for callback\_plugins if I recall. So something like `callback_plugins = /usr/share/local/callback_plugins/` `(and obviously you'd need to put ``fix-ssl.py into /usr/share/local/callback_plugins). I'm not familiar with OSX paths so /usr/share/local/callback_plugins is just intended to be an example folder.` Hope this helps, Jon ---
**Author:** ![Jason\_Levitt](https://avatars.discourse-cdn.com/v4/letter/j/779978/32.png) [@Jason\_Levitt](https://forum.ansible.com/u/Jason_Levitt)\ **Post date:** [October 16, 2015, 2:48pm UTC](https://forum.ansible.com/t/ansible-1-9-4-certificate-verify-failed-when-connecting-to-windows-server/19480/4 "2015-10-16T14:48:00Z")
I shortened the path to make the posting easier to read. The actual path is something much longer. 🙂 Thanks for taking the time to look though. ---
**Author:** ![Trond\_Hindenes](https://avatars.discourse-cdn.com/v4/letter/t/96bed5/32.png) [@Trond\_Hindenes](https://forum.ansible.com/u/Trond_Hindenes)\ **Post date:** [October 16, 2015, 2:59pm UTC](https://forum.ansible.com/t/ansible-1-9-4-certificate-verify-failed-when-connecting-to-windows-server/19480/5 "2015-10-16T14:59:23Z")
As far as I can see this works differently when using OSX as a control node as opposed to Ubuntu, Centos or other Linux distros. I’m seeing a lot of these errors when Ansible is running from OSX. Not sure if pywinrm behaves differently on osx than on Linux? ---
**Author:** ![j.r.hawkesworth](https://avatars.discourse-cdn.com/v4/letter/j/a3d4f5/32.png) [@j.r.hawkesworth](https://forum.ansible.com/u/j.r.hawkesworth)\ **Post date:** [October 16, 2015, 3:05pm UTC](https://forum.ansible.com/t/ansible-1-9-4-certificate-verify-failed-when-connecting-to-windows-server/19480/6 "2015-10-16T15:05:47Z")
My impression is this is because of the python version that you get with recent OSX. If I recall it was python 2.7.9 that introduced the cert checking in python. ---
**Author:** ![Jason\_Levitt](https://avatars.discourse-cdn.com/v4/letter/j/779978/32.png) [@Jason\_Levitt](https://forum.ansible.com/u/Jason_Levitt)\ **Post date:** [October 16, 2015, 3:37pm UTC](https://forum.ansible.com/t/ansible-1-9-4-certificate-verify-failed-when-connecting-to-windows-server/19480/7 "2015-10-16T15:37:06Z")
There is quite a bit of noise about this issue under Ansible 1.94 and 2.00 here: [https://github.com/ansible/ansible/issues/10294](https://github.com/ansible/ansible/issues/10294) But no resolution. J ---
**Author:** ![Jason\_Levitt](https://avatars.discourse-cdn.com/v4/letter/j/779978/32.png) [@Jason\_Levitt](https://forum.ansible.com/u/Jason_Levitt)\ **Post date:** [October 16, 2015, 4:13pm UTC](https://forum.ansible.com/t/ansible-1-9-4-certificate-verify-failed-when-connecting-to-windows-server/19480/8 "2015-10-16T16:13:32Z")
Ok. Here’s something that works though it shouldn’t be done as it’s a security risk. So, if you’re using the “ansible” command under MacOSX Yosemite, here’s how to get things to work: 1. Edit (or create) the file /Library/Python/2.7/site-packages/sitecustomize.py 2. Add this code to the file: ` import ssl try: \_create\_unverified\_https\_context = ssl.\_create\_unverified\_context except AttributeError: # Legacy Python that doesn’t verify HTTPS certificates by default pass else: # Handle target environment that doesn’t support HTTPS verification ssl.\_create\_default\_https\_context = \_create\_unverified\_https\_context ` That’s it. Works great now. Security risk, obviously, but I consider this a temporary fix. J ---
**Author:** ![Eduardo\_Cerqueira](https://avatars.discourse-cdn.com/v4/letter/e/f0a364/32.png) [@Eduardo\_Cerqueira](https://forum.ansible.com/u/Eduardo_Cerqueira)\ **Post date:** [April 5, 2016, 9:09pm UTC](https://forum.ansible.com/t/ansible-1-9-4-certificate-verify-failed-when-connecting-to-windows-server/19480/9 "2016-04-05T21:09:40Z")
So just sharing the solution presented below by Slim Slam, also works on Fedora 23. Again, I understand it is not an ideal solution but if you are tied on any Ansible version \< 2 and can’t upgrade, it works as a temporally solution or workaround.