# Ansible winrm to connect to windows guest via certificate.

**URL:** <https://forum.ansible.com/t/ansible-winrm-to-connect-to-windows-guest-via-certificate/25116>\
**Category:** Ansible Project\
**Tags:** windows\
**Created:** [July 28, 2017, 3:59pm UTC](https://forum.ansible.com/t/ansible-winrm-to-connect-to-windows-guest-via-certificate/25116 "2017-07-28T15:59:51Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Rui\_Pereira](https://avatars.discourse-cdn.com/v4/letter/r/90db22/32.png) [@Rui\_Pereira](https://forum.ansible.com/u/Rui_Pereira)\
**Post date:** [July 28, 2017, 3:59pm UTC](https://forum.ansible.com/t/ansible-winrm-to-connect-to-windows-guest-via-certificate/25116/1 "2017-07-28T15:59:51Z")

</div>

Hello Guys,

I’m trying to understand the way to go here. I want to secure as much as possible my connection from my ansible box to the guests. In terms of Linux i already have all the communication based on SSH keys. In terms of windows i have it working via https && user and pass. (basic authentication.)

_[jesus@ansible]$ ansible -i inventories/9networks/hosts 9test -m win\_ping -v --extra-vars “@./inventories/9networks/win\_servers.yml” --ask-vault-pass_  
_Using /home/jesus/ansible\_project\_creation/ansible.cfg as config file_  
_Vault password:_  
_9test1 | SUCCESS =\> {_  
_“changed”: false,_  
_“ping”: “pong”_

I want to upgrade this to a higher standard but all the solutions that I’ve faced so far requires an active directory / Keberos which is not suitable for my scenario. I need to keep things as much simple as possible. Can someone point me in the right direction to configure winrm connections via certificate authentication? I can’t install any AD on the environment. How to make winrm secure connections with certificates?

Thank-you for all the possible help.

---

<div class="post-metadata">

**Author:** ![jborean](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jborean/32/1525_2.png) [@jborean](https://forum.ansible.com/u/jborean)\
**Post date:** [August 4, 2017, 6:52am UTC](https://forum.ansible.com/t/ansible-winrm-to-connect-to-windows-guest-via-certificate/25116/2 "2017-08-04T06:52:20Z")

</div>

Certificate auth is a bit of a pain with WinRM, I found the best article to get this working would be [http://www.hurryupandwait.io/blog/certificate-password-less-based-authentication-in-winrm](http://www.hurryupandwait.io/blog/certificate-password-less-based-authentication-in-winrm). Personally I would say NTLM is more secure than Basic auth as you are not sending the actual password to the server (rather a hash of the password). You also have CredSSP as an option with local accounts but there is not much point using that is using local accounts.

---

<div class="post-metadata">

**Author:** ![Rui\_Pereira](https://avatars.discourse-cdn.com/v4/letter/r/90db22/32.png) [@Rui\_Pereira](https://forum.ansible.com/u/Rui_Pereira)\
**Post date:** [September 5, 2017, 4:52pm UTC](https://forum.ansible.com/t/ansible-winrm-to-connect-to-windows-guest-via-certificate/25116/3 "2017-09-05T16:52:42Z")

</div>

sexta-feira, 4 de Agosto de 2017 às 07:52:20 UTC+1, Jordan Borean escreveu: