# AWX (K3s) Certificate issue when contacting Satellite

**URL:** <https://forum.ansible.com/t/awx-k3s-certificate-issue-when-contacting-satellite/36857>\
**Category:** AWX Project\
**Tags:** awx\
**Created:** [July 15, 2022, 2:28pm UTC](https://forum.ansible.com/t/awx-k3s-certificate-issue-when-contacting-satellite/36857 "2022-07-15T14:28:34Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![hieronymus](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/hieronymus/32/1624_2.png) [@hieronymus](https://forum.ansible.com/u/hieronymus)\
**Post date:** [July 15, 2022, 2:28pm UTC](https://forum.ansible.com/t/awx-k3s-certificate-issue-when-contacting-satellite/36857/1 "2022-07-15T14:28:34Z")

</div>

Hi Team,

Has anyone issue with Certificate by AWX on container? I’m using K3s.  
I’ve tried to use _theforeman.foreman.collection_ or _redhat.satellite.collection_ but playbook failed with: Failed to establish a new connection: [Errno 110] Connection timed out.  
For testing, I’ve tried to do a curl from the container awx-instance-web and here’s the result: (I’ve changed names and ipv4)

# curl -iv [https://sat001.xxx/katello/api](https://sat001.xxx/katello/api)

- Trying 1xx.xx.xx.xx…
- TCP\_NODELAY set
- Connected to sat001.xxx (1xx.xx.xx.xx) port 443 (#0)
- ALPN, offering h2
- ALPN, offering http/1.1
- successfully set certificate verify locations:
- CAfile: /etc/pki/tls/certs/ca-bundle.crt  
CApath: none
- TLSv1.3 (OUT), TLS handshake, Client hello (1):
- TLSv1.3 (IN), TLS handshake, Server hello (2):
- TLSv1.2 (IN), TLS handshake, Certificate (11):
- TLSv1.2 (OUT), TLS alert, unknown CA (560):
- SSL certificate problem: self signed certificate in certificate chain
- Closing connection 0  
curl: (60) SSL certificate problem: self signed certificate in certificate chain  
More details here: [curl - SSL CA Certificates](https://curl.haxx.se/docs/sslcerts.html)

curl failed to verify the legitimacy of the server and therefore could not establish a secure connection to it. To learn more about this situation and how to fix it, please visit the web page mentioned above.

So, a curl --insecure is ok but I cannot do it by playbook.  
Has anyone idea about that?  
Thanks in advance

---

<div class="post-metadata">

**Author:** ![AWX\_Project](https://avatars.discourse-cdn.com/v4/letter/a/eada6e/32.png) [@AWX\_Project](https://forum.ansible.com/u/AWX_Project)\
**Post date:** [July 20, 2022, 8:08pm UTC](https://forum.ansible.com/t/awx-k3s-certificate-issue-when-contacting-satellite/36857/2 "2022-07-20T20:08:16Z")

</div>

What if you have your client cert and key mounted at the path described here [https://docs.ansible.com/ansible/latest/collections/theforeman/foreman/foreman\_callback.html#parameter-client\_cert](https://docs.ansible.com/ansible/latest/collections/theforeman/foreman/foreman_callback.html#parameter-client_cert) inside of your awx-ee image? Do your playbooks then run successfully?

IF this works, then there are ways to mount in volumes using the isolated paths setting in AWX.

[https://docs.ansible.com/automation-controller/latest/html/userguide/execution\_environments.html#ee-mount-options](https://docs.ansible.com/automation-controller/latest/html/userguide/execution_environments.html#ee-mount-options)

AWX Team