# Failed to validate the SSL certificate for deb.nodesource.com:443

**URL:** <https://forum.ansible.com/t/failed-to-validate-the-ssl-certificate-for-deb-nodesource-com-443/22601>\
**Category:** Ansible Project\
**Tags:** ubuntu\
**Created:** [September 21, 2016, 1:09pm UTC](https://forum.ansible.com/t/failed-to-validate-the-ssl-certificate-for-deb-nodesource-com-443/22601 "2016-09-21T13:09:34Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Yuri\_Kanivetsky](https://avatars.discourse-cdn.com/v4/letter/y/b3f665/32.png) [@Yuri\_Kanivetsky](https://forum.ansible.com/u/Yuri_Kanivetsky)\
**Post date:** [September 21, 2016, 1:09pm UTC](https://forum.ansible.com/t/failed-to-validate-the-ssl-certificate-for-deb-nodesource-com-443/22601/1 "2016-09-21T13:09:34Z")

</div>

Hi,

For some reason, ansible fails to install nodesource’s apt key on ubuntu/trusty. It seem to worked about a month ago or so (if I’m not mistaken).

playbook.yml:

- hosts: all  
gather\_facts: no

tasks:

- name: apt-get update  
raw: '! which apt-get  
&& exit 0

> > apt-get update’

- name: Install python  
raw: '! which apt-get  
&& exit 0

> > apt-get -y install python’

- hosts: all  
tasks:
- name: Add Nodesource apt key.  
apt\_key:  
url: [https://deb.nodesource.com/gpgkey/nodesource.gpg.key](https://deb.nodesource.com/gpgkey/nodesource.gpg.key)

Output:

$ ansible-playbook playbook.yml -i lxc, -vv  
…  
TASK [Add Nodesource apt key.] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*  
task path: /home/yuri/\_/deb.nodesource.com/playbook.yml:17  
fatal: [lxc]: FAILED! =\> {“changed”: false, “failed”: true, “msg”: “Failed to validate the SSL certificate for [deb.nodesource.com:443](http://deb.nodesource.com:443). Make sure your managed systems have a valid CA certificate installed. If the website serving the url uses SNI you need python \>= 2.7.9 on your managed machine or you can install the `urllib3`, `pyopenssl`, `ndg-httpsclient`, and `pyasn1` python modules to perform SNI verification in python \>= 2.6. You can use validate\_certs=False if you do not need to confirm the servers identity but this is unsafe and not recommended. Paths checked for this platform: /etc/ssl/certs, /etc/pki/ca-trust/extracted/pem, /etc/pki/tls/certs, /usr/share/ca-certificates/cacert.org, /etc/ansible”}

Can I somehow investigate what’s causing the issue? I indeed have python-2.7.6 there. Can I check if [deb.nodesource.com](http://deb.nodesource.com) is using SNI? Can this be an issue with trusty’s certificates? Which packages am I supposed to install? I can see python-urllib3, and python-pyasn1. But I can’t see ndg-httpsclient and pyopenssl for trusty in official repositories. Can I somehow get away with not installing these extra packages?

I’ve run into this issue when trying to use geerlingguy.nodejs role.

Thanks in advance.

Regards,  
Yuri

---

<div class="post-metadata">

**Author:** ![sivel](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/sivel/32/1198_2.png) [@sivel](https://forum.ansible.com/u/sivel)\
**Post date:** [September 21, 2016, 6:14pm UTC](https://forum.ansible.com/t/failed-to-validate-the-ssl-certificate-for-deb-nodesource-com-443/22601/2 "2016-09-21T18:14:34Z")

</div>

The easy solution may just be updating your cacert bundle by updating the ca-certificates package and then trying again.

My initial look indicates that the server is not using SNI, it has a wildcard cert, provided by Amazon.

---

<div class="post-metadata">

**Author:** ![Yuri\_Kanivetsky](https://avatars.discourse-cdn.com/v4/letter/y/b3f665/32.png) [@Yuri\_Kanivetsky](https://forum.ansible.com/u/Yuri_Kanivetsky)\
**Post date:** [September 21, 2016, 9:36pm UTC](https://forum.ansible.com/t/failed-to-validate-the-ssl-certificate-for-deb-nodesource-com-443/22601/3 "2016-09-21T21:36:53Z")

</div>

> The easy solution may just be updating your cacert bundle by updating the ca-certificates package and then trying again.

Adding

- name: Update ca-certificates  
apt:  
name: ca-certificates  
state: latest

before installing apt key didn’t help.

> My initial look indicates that the server is not using SNI, it has a wildcard cert, provided by Amazon.

Following this answer on [serverfault.com](http://serverfault.com):

[http://serverfault.com/a/780388/162443](http://serverfault.com/a/780388/162443)

I get:

$ dig +noall +answer [deb.nodesource.com](http://deb.nodesource.com)

[deb.nodesource.com](http://deb.nodesource.com). 300 IN CNAME [d2buw04m05mirl.cloudfront.net](http://d2buw04m05mirl.cloudfront.net).  
[d2buw04m05mirl.cloudfront.net](http://d2buw04m05mirl.cloudfront.net). 60 IN A 54.230.230.81

…  
$ openssl s\_client -servername [deb.nodesource.com](http://deb.nodesource.com) -tlsextdebug -connect [d2buw04m05mirl.cloudfront.net:443](http://d2buw04m05mirl.cloudfront.net:443) 2\>/dev/null | grep “server name”  
TLS server extension “server name” (id=0), len=0

Which most likely means, that the server uses SNI.

Here’s what I came up with:

- hosts: all

tasks:

- name: Install apt\_key dependencies  
apt:  
name: ‘{{ item }}’  
with\_items: [python-urllib3, python-openssl, python-pyasn1, python-pip]  
when: ansible\_distribution == ‘Ubuntu’ or ansible\_distribution\_release == ‘trusty’

- name: Install apt\_key dependencies  
command: pip install ndg-httpsclient  
when: ansible\_distribution == ‘Ubuntu’ or ansible\_distribution\_release == ‘trusty’

After this apt key gets installed.

Regards,  
Yuri