# AWX on Openshift Origin with Freeipa / Certificate problem

**URL:** <https://forum.ansible.com/t/awx-on-openshift-origin-with-freeipa-certificate-problem/29367>\
**Category:** AWX Project\
**Tags:** awx\
**Created:** [January 4, 2019, 12:51pm UTC](https://forum.ansible.com/t/awx-on-openshift-origin-with-freeipa-certificate-problem/29367 "2019-01-04T12:51:06Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Wilfried\_Anuzet](https://avatars.discourse-cdn.com/v4/letter/w/e8c25b/32.png) [@Wilfried\_Anuzet](https://forum.ansible.com/u/Wilfried_Anuzet)\
**Post date:** [January 4, 2019, 12:51pm UTC](https://forum.ansible.com/t/awx-on-openshift-origin-with-freeipa-certificate-problem/29367/1 "2019-01-04T12:51:06Z")

</div>

Hello,

I installed the awx project on an okd instance using the official playbook.  
I’ve a problem to set the LDAPS authentication against our freeipa implementation.  
The OKD node is integrated with Freeipa using the ipa-client-install command so it have the Freeipa certificate installed.

The problem is that I don’t have the Freeipa CA available in the awx\_web container, Here’s the error on the awx\_web container:

```bash
WARNING django_auth_ldap Caught LDAPError while authenticating user: SERVER_DOWN({'info': 'error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed (self signed certificate in certificate chain)', 'desc': "Can't contact LDAP server"},)

```

I set this variable in the inventory but as it’s specified it seems that it’s just obeyed in local\_docker install:

```bash
# CA Trust directory. If you need to provide custom CA certificates, supplying
# this variable causes this directory on the host to be bind mounted over
# /etc/pki/ca-trust in the awx_task and awx_web containers.
# NOTE: only obeyed in local_docker install
ca_trust_dir=/etc/pki/ca-trust/source/anchor

```

So when I check in the container the anchor folder contain nothing:

```bash
sh-4.2$ ls -l /etc/pki/ca-trust/source/anchors/
total 0

```

On the okd node:

```bash
[root@okdslv01p ~]# ls -l /etc/pki/ca-trust/source/anchors/
total 4
-rw-r--r--. 1 root root 1281 Dec 29 12:15 ca.crt

```

I also can’t use the the update-ca-trust as the root user don’t exist in the awx\_web container, I can’t use sudo and I don’t have the right to write to the /etc/pki/ca-trust/source/anchors location:

```bash
sh-4.2$ su -
su: user root does not exist
sh-4.2$ touch /etc/pki/ca-trust/source/anchors/ca.crt
touch: cannot touch '/etc/pki/ca-trust/source/anchors/ca.crt': Permission denied
sh-4.2$ sudo touch /etc/pki/ca-trust/source/anchors/ca.crt
sudo: unknown user: root
sudo: unable to initialize policy plugin

```

How can I use AWX with my freeipa implementation using the openshift installation ?  
How can I add certificate to the awx\_web container ?

Best regards.

---

<div class="post-metadata">

**Author:** ![Christopher\_Meyers](https://avatars.discourse-cdn.com/v4/letter/c/3e96dc/32.png) [@Christopher\_Meyers](https://forum.ansible.com/u/Christopher_Meyers)\
**Post date:** [January 4, 2019, 1:12pm UTC](https://forum.ansible.com/t/awx-on-openshift-origin-with-freeipa-certificate-problem/29367/2 "2019-01-04T13:12:00Z")

</div>

Build your own version of awx\_web container that inherits from the awx container. Add the cert and run the update-ca-trust command.

```auto
ADD your_ca_root.crt /usr/local/share/ca-certificates/foo.crt
RUN update-ca-certificates

```

---

<div class="post-metadata">

**Author:** ![Wilfried\_Anuzet](https://avatars.discourse-cdn.com/v4/letter/w/e8c25b/32.png) [@Wilfried\_Anuzet](https://forum.ansible.com/u/Wilfried_Anuzet)\
**Post date:** [January 4, 2019, 1:42pm UTC](https://forum.ansible.com/t/awx-on-openshift-origin-with-freeipa-certificate-problem/29367/3 "2019-01-04T13:42:19Z")

</div>

Ok thanks!

It was my last solution ☹  
I will do that.

I will read the playbook to find how I can add my custom image to the deployment.  
Do you know in which file this is defined ?