# certificate: the specified credentials were rejected by the server **URL:** \ **Category:** Ansible Project\ **Tags:** ubuntu\ **Created:** [September 25, 2018, 10:05am UTC](https://forum.ansible.com/t/certificate-the-specified-credentials-were-rejected-by-the-server/28640 "2018-09-25T10:05:55Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Gary\_Mo](https://avatars.discourse-cdn.com/v4/letter/g/7ab992/32.png) [@Gary\_Mo](https://forum.ansible.com/u/Gary_Mo)\ **Post date:** [September 25, 2018, 10:05am UTC](https://forum.ansible.com/t/certificate-the-specified-credentials-were-rejected-by-the-server/28640/1 "2018-09-25T10:05:55Z")
Hi, I’m using ansible on Ubuntu 16.04 LTS and try to mange my win10 server. But met trouble when I using Certificate authentication: ` gary@gary-HP-Pavilion-Notebook:~$ ansible win\_test -m win\_ping 192.168.1.207 | UNREACHABLE! =\> { “changed”: false, “msg”: “certificate: the specified credentials were rejected by the server”, “unreachable”: true } ` I just follow the Ansible Document to setup environment step by step: [https://docs.ansible.com/ansible/latest/user\_guide/windows\_winrm.html#certificate](https://docs.ansible.com/ansible/latest/user_guide/windows_winrm.html#certificate) My WinRM setting: ` PS C:\Users\Test\> winrm get winrm/config/Service Service RootSDDL = O:NSG:BAD:P(A;;GA;;;BA)(A;;GR;;;IU)S:P(AU;FA;GA;;;WD)(AU;SA;GXGW;;;WD) MaxConcurrentOperations = 4294967295 MaxConcurrentOperationsPerUser = 1500 EnumerationTimeoutms = 240000 MaxConnections = 300 MaxPacketRetrievalTimeSeconds = 120 AllowUnencrypted = true Auth Basic = true Kerberos = true Negotiate = true Certificate = true CredSSP = false CbtHardeningLevel = Relaxed DefaultPorts HTTP = 5985 HTTPS = 5986 IPv4Filter = \* IPv6Filter = \* EnableCompatibilityHttpListener = false EnableCompatibilityHttpsListener = false CertificateThumbprint AllowRemoteAccess = true ` Host vars: [win\_test] 192.168.1.207 [win\_test:vars] ansible\_connection=“winrm” ansible\_port=5985 ansible\_winrm\_cert\_pem=“/home/gary/Documents/cert.pem” ansible\_winrm\_cert\_key\_pem=“/home/gary/Documents/cert\_key.pem” ansible\_winrm\_transport=“certificate” Anything wrong with my settings? Please help, thanks~ PS: It works when I use Basic anthentication. ---
**Author:** ![jborean](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jborean/32/1525_2.png) [@jborean](https://forum.ansible.com/u/jborean)\ **Post date:** [September 25, 2018, 10:10pm UTC](https://forum.ansible.com/t/certificate-the-specified-credentials-were-rejected-by-the-server/28640/2 "2018-09-25T22:10:36Z")
Certificate auth does not work over http (port 5985). It’s part of the TLS protocol so you must use https. Thanks Jordan ---
**Author:** ![Gary\_Mo](https://avatars.discourse-cdn.com/v4/letter/g/7ab992/32.png) [@Gary\_Mo](https://forum.ansible.com/u/Gary_Mo)\ **Post date:** [September 26, 2018, 8:21am UTC](https://forum.ansible.com/t/certificate-the-specified-credentials-were-rejected-by-the-server/28640/3 "2018-09-26T08:21:50Z")
Hi, Jordan. Thanks for your help~ After changing to HTTPS, I met such error: ` 192.168.1.207 | UNREACHABLE! =\> { “changed”: false, “msg”: “certificate: HTTPSConnectionPool(host=‘192.168.1.207’, port=5986): Max retries exceeded with url: /wsman (Caused by SSLError(SSLError(1, u’[SSL: CERTIFICATE\_VERIFY\_FAILED] certificate verify failed (\_ssl.c:590)'),))”, “unreachable”: true } ` Here is my config of the listener: ` PS C:\Temp\> winrm enumerate winrm/config/Listener Listener Address = \* Transport = HTTPS Port = 5986 Hostname = desktop-9qa0b18 Enabled = true URLPrefix = wsman CertificateThumbprint = 4b 80 86 d5 fd 8f 90 20 36 fe a5 cf b1 9f cc 3f 98 ee 05 78 ListeningOn = ` I am not sure whether I generate the key in right way or not. In fact, I am not familiar to those things like SSL, HTTPS. Here I write down the things I did to use HTTPS in WinRM: 1. Use the IIS tool to create a Self-Signed Certificate for my PC: desktop-9qa0b18 2. Run command: `winrm create winrm/config/Listener?Address=*+Transport=HTTPS @{Port="5986" ;Hostname="desktop-9qa0b18" ;CertificateThumbprint="4b 80 86 d5 fd 8f 90 20 36 fe a5 cf b1 9f cc 3f 98 ee 05 78"}` to create listener 1. Generate a certificate by **openssl** : [https://docs.ansible.com/ansible/latest/user\_guide/windows\_winrm.html#generate-a-certificate](https://docs.ansible.com/ansible/latest/user_guide/windows_winrm.html#generate-a-certificate) 2. Import a certificate: [https://docs.ansible.com/ansible/latest/user\_guide/windows\_winrm.html#import-a-certificate-to-the-certificate-store](https://docs.ansible.com/ansible/latest/user_guide/windows_winrm.html#import-a-certificate-to-the-certificate-store) 3. Mapping the certificate to my account(username=Test) : [https://docs.ansible.com/ansible/latest/user\_guide/windows\_winrm.html#mapping-a-certificate-to-an-account](https://docs.ansible.com/ansible/latest/user_guide/windows_winrm.html#mapping-a-certificate-to-an-account) 4. Run command ansible win\_test -m win\_ping in linux side. ---
**Author:** ![jborean](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jborean/32/1525_2.png) [@jborean](https://forum.ansible.com/u/jborean)\ **Post date:** [September 26, 2018, 8:40am UTC](https://forum.ansible.com/t/certificate-the-specified-credentials-were-rejected-by-the-server/28640/4 "2018-09-26T08:40:44Z")
If you are using a self signed certificate for the https listener (different from the user mapped certificate) then you need to tell Ansible to not verify the server’s certificate with ‘ansible\_winrm\_server\_cert\_validation=ignore’. You can get Ansible to use a custom cert chain for verification once you get this working and you don’t want to use self signed certificate.