# Ansible 2.9.4 not considering/ honouring ansible\_winrm\_server\_cert\_validation=ignore flag. **URL:** \ **Category:** Ansible Project\ **Tags:** windows\ **Created:** [February 5, 2020, 9:08am UTC](https://forum.ansible.com/t/ansible-2-9-4-not-considering-honouring-ansible-winrm-server-cert-validation-ignore-flag/32142 "2020-02-05T09:08:30Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Bhushan\_Gholave](https://avatars.discourse-cdn.com/v4/letter/b/8c91f0/32.png) [@Bhushan\_Gholave](https://forum.ansible.com/u/Bhushan_Gholave)\ **Post date:** [February 5, 2020, 9:08am UTC](https://forum.ansible.com/t/ansible-2-9-4-not-considering-honouring-ansible-winrm-server-cert-validation-ignore-flag/32142/1 "2020-02-05T09:08:30Z")
Hi All, Issue closed : [https://github.com/ansible/ansible/issues/67114](https://github.com/ansible/ansible/issues/67114) 1. host file [windows] ```auto 192.152.1.21 ansible_user=administrator ansible_password=Password123 ansible_port=5986 ansible_winrm_transport=basic ansible_winrm_server_cert_validation=ignore ansible_connection=winrm ``` `2. run *ansible -i host -m win_ping all -* with ansible version `2.8.5 response:- ```auto 192.152.1.21 | SUCCESS => { "changed": false, } "ping": "pong" ``` `3. run ``*ansible -i host -m win_ping all -* with ansible version `2.9.4 response:- ```auto 192.152.1.21 | UNREACHABLE! => { "changed": false, "msg": "basic: HTTPSConnectionPool(host='192.152.1.21', port=5986): Max retries exceeded with url: /wsman (Caused by SSLError(SSLError(1, '[SSL: UNSUPPORTED_PROTOCOL] unsupported protocol (_ssl.c:897)'),))", "unreachable": true } ``` ```auto 4. I followed [https://docs.ansible.com/ansible/latest/user_guide/windows_setup.html](https://docs.ansible.com/ansible/latest/user_guide/windows_setup.html) documentation to setup windows host. I run Upgrade-PowerShell.ps1, ``` ---
**Author:** ![Bhushan\_Gholave](https://avatars.discourse-cdn.com/v4/letter/b/8c91f0/32.png) [@Bhushan\_Gholave](https://forum.ansible.com/u/Bhushan_Gholave)\ **Post date:** [February 5, 2020, 9:26am UTC](https://forum.ansible.com/t/ansible-2-9-4-not-considering-honouring-ansible-winrm-server-cert-validation-ignore-flag/32142/2 "2020-02-05T09:26:26Z")
I see there is possibility of issue with pywinrm [https://github.com/diyan/pywinrm/issues/201](https://github.com/diyan/pywinrm/issues/201) looks similar ---
**Author:** ![John\_Roh](https://avatars.discourse-cdn.com/v4/letter/j/ec9cab/32.png) [@John\_Roh](https://forum.ansible.com/u/John_Roh)\ **Post date:** [February 5, 2020, 9:32am UTC](https://forum.ansible.com/t/ansible-2-9-4-not-considering-honouring-ansible-winrm-server-cert-validation-ignore-flag/32142/3 "2020-02-05T09:32:10Z")
pywirnm==0.4.0 included the fix for ansible\_winrm\_server\_cert\_validation=ignore. I’m currently using pywinrm=0.4.0 on my dockerfile. ---
**Author:** ![Bhushan\_Gholave](https://avatars.discourse-cdn.com/v4/letter/b/8c91f0/32.png) [@Bhushan\_Gholave](https://forum.ansible.com/u/Bhushan_Gholave)\ **Post date:** [February 5, 2020, 9:35am UTC](https://forum.ansible.com/t/ansible-2-9-4-not-considering-honouring-ansible-winrm-server-cert-validation-ignore-flag/32142/4 "2020-02-05T09:35:40Z")
Yes I thought the same. But I am using pywinrm=0.4.0 but still it fails to use this flag. Request please validate. Thanks, Bhushan ---
**Author:** ![jborean](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jborean/32/1525_2.png) [@jborean](https://forum.ansible.com/u/jborean)\ **Post date:** [February 5, 2020, 10:41am UTC](https://forum.ansible.com/t/ansible-2-9-4-not-considering-honouring-ansible-winrm-server-cert-validation-ignore-flag/32142/5 "2020-02-05T10:41:24Z")
As I have stated in the issue this has nothing to do with certificate validation. If it was you will be getting a completely separate error message saying something like “certificate verify error” or something like that. This is an error that Python/OpenSSL reports when it cannot negotiate a common TLS protocol between the itself and the Windows server. You can run the following to try and get some more info ` ANSIBLE\_PYTHON=$(head -1 $(which ansible) | cut -c 3-) echo $ANSIBLE\_PYTHON # Used to just display what Python Ansible is using $ANSIBLE\_PYTHON --version # Make sure both match, if they don’t then the openssl binary is at a different path and these tests won’t indicate anything $ANSIBLE\_PYTHON -c “import ssl; print(ssl.OPENSSL\_VERSION)” openssl version openssl s\_client -connect hostname:5986 `# Prints a list of ciphers and the protocols that the openssl supports, once again the binary should be the one Python is compiled against.` `openssl ciphers -s -v` ` In my example here is a snippet of what I receive from the s\_client -connect command ` > **(attachments)** > > ![Auto Generated Inline Image 1.png](https://us1.discourse-cdn.com/ansible/original/2X/0/0cd555a618e6daf50900fd4af871aecf6e04cefc.png) > ![Auto Generated Inline Image 2.png](https://us1.discourse-cdn.com/ansible/original/2X/1/176a6c1fb7930dea0d9928e6384b16cdc831ca7a.png) ---
**Author:** ![Bhushan\_Gholave](https://avatars.discourse-cdn.com/v4/letter/b/8c91f0/32.png) [@Bhushan\_Gholave](https://forum.ansible.com/u/Bhushan_Gholave)\ **Post date:** [February 5, 2020, 12:14pm UTC](https://forum.ansible.com/t/ansible-2-9-4-not-considering-honouring-ansible-winrm-server-cert-validation-ignore-flag/32142/6 "2020-02-05T12:14:32Z")
@Jordan Borean Thank you for explaining this, I got this working with TLS1.2 script. We need restart after applying this. This issue we are facing just for Windows2008R2 machine with recent ansible upgrade. Considering this powershell script while preparing windows host. Thanks, Bhushan > **(attachments)** > > ![Auto Generated Inline Image 1.png](https://us1.discourse-cdn.com/ansible/original/2X/0/0cd555a618e6daf50900fd4af871aecf6e04cefc.png) > ![Auto Generated Inline Image 2.png](https://us1.discourse-cdn.com/ansible/original/2X/1/176a6c1fb7930dea0d9928e6384b16cdc831ca7a.png)