# Failure trying to install remote yum package

**URL:** <https://forum.ansible.com/t/failure-trying-to-install-remote-yum-package/28127>\
**Category:** Ansible Project\
**Created:** [July 23, 2018, 5:31pm UTC](https://forum.ansible.com/t/failure-trying-to-install-remote-yum-package/28127 "2018-07-23T17:31:28Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Chris\_Bidwell](https://avatars.discourse-cdn.com/v4/letter/c/da6949/32.png) [@Chris\_Bidwell](https://forum.ansible.com/u/Chris_Bidwell)\
**Post date:** [July 23, 2018, 5:31pm UTC](https://forum.ansible.com/t/failure-trying-to-install-remote-yum-package/28127/1 "2018-07-23T17:31:28Z")

</div>

This is my playbook:

tasks:

- name: download puppet5 rpm  
yum:  
name: [https://yum.puppetlabs.com/puppet5/puppet5-release-el-6.noarch.rpm](https://yum.puppetlabs.com/puppet5/puppet5-release-el-6.noarch.rpm)  
state: present

**Note: This is only failing on RHEL6 systems. So it’s got to be something python-related. I’ve verified that `urllib3`, `pyOpenSSL`, `ndg-httpsclient`, and `pyasn1` are all installed. From reading further, I’m seeing that there are issues relating to python 2.6.6 no able to use SNI.**

The full traceback is:  
File “/tmp/ansible\_7kxVuI/ansible\_modlib.zip/ansible/module\_utils/urls.py”, line 1055, in fetch\_url  
client\_key=client\_key, cookies=cookies)  
File “/tmp/ansible\_7kxVuI/ansible\_modlib.zip/ansible/module\_utils/urls.py”, line 958, in open\_url  
r = urllib\_request.urlopen(\*urlopen\_args)  
File “/usr/lib64/python2.6/urllib2.py”, line 126, in urlopen  
return \_opener.open(url, data, timeout)  
File “/usr/lib64/python2.6/urllib2.py”, line 389, in open  
req = meth(req)  
File “/tmp/ansible\_7kxVuI/ansible\_modlib.zip/ansible/module\_utils/urls.py”, line 773, in http\_request  
build\_ssl\_validation\_error(self.hostname, self.port, paths\_checked, e)  
File “/tmp/ansible\_7kxVuI/ansible\_modlib.zip/ansible/module\_utils/urls.py”, line 579, in build\_ssl\_validation\_error  
raise SSLValidationError(’ '.join(msg) % (hostname, port, ", ".join(paths)))

fatal: [baseworkstation-lx]: FAILED! =\> {  
“changed”: false,  
“invocation”: {  
“module\_args”: {  
“allow\_downgrade”: false,  
“bugfix”: false,  
“conf\_file”: null,  
“disable\_gpg\_check”: false,  
“disable\_plugin”: ,  
“disablerepo”: null,  
“enable\_plugin”: ,  
“enablerepo”: null,  
“exclude”: null,  
“install\_repoquery”: true,  
“installroot”: “/”,  
“list”: null,  
“name”: [  
“[https://yum.puppetlabs.com/puppet5/puppet5-release-el-6.noarch.rpm](https://yum.puppetlabs.com/puppet5/puppet5-release-el-6.noarch.rpm)”  
],  
“security”: false,  
“skip\_broken”: false,  
“state”: “present”,  
“update\_cache”: false,  
“update\_only”: false,  
“validate\_certs”: true  
}  
},  
“msg”: “Failed to validate the SSL certificate for [yum.puppetlabs.com:443](http://yum.puppetlabs.com:443). Make sure your managed systems have a valid CA certificate installed. If the website serving the url uses SNI you need python \>= 2.7.9 on your managed machine (the python executable used (/usr/bin/python) is version: 2.6.6 (r266:84292, Aug 9 2016, 06:11:56) [GCC 4.4.7 20120313 (Red Hat 4.4.7-17)]) or you can install the `urllib3`, `pyOpenSSL`, `ndg-httpsclient`, and `pyasn1` python modules to perform SNI verification in python \>= 2.6. You can use validate\_certs=False if you do not need to confirm the servers identity but this is unsafe and not recommended. Paths checked for this platform: /etc/ssl/certs, /etc/pki/ca-trust/extracted/pem, /etc/pki/tls/certs, /usr/share/ca-certificates/[cacert.org](http://cacert.org), /etc/ansible. The exception msg was: [Errno 1] \_ssl.c:492: error:14077410:SSL routines:SSL23\_GET\_SERVER\_HELLO:sslv3 alert handshake failure.”

---

<div class="post-metadata">

**Author:** ![S\_C\_Rigler](https://avatars.discourse-cdn.com/v4/letter/s/eb9ed0/32.png) [@S\_C\_Rigler](https://forum.ansible.com/u/S_C_Rigler)\
**Post date:** [July 23, 2018, 5:35pm UTC](https://forum.ansible.com/t/failure-trying-to-install-remote-yum-package/28127/2 "2018-07-23T17:35:03Z")

</div>

Hi Chris,

Try adding “validate\_certs: false” to your yum arguments.

–Steve

---

<div class="post-metadata">

**Author:** ![Chris\_Bidwell](https://avatars.discourse-cdn.com/v4/letter/c/da6949/32.png) [@Chris\_Bidwell](https://forum.ansible.com/u/Chris_Bidwell)\
**Post date:** [July 23, 2018, 5:54pm UTC](https://forum.ansible.com/t/failure-trying-to-install-remote-yum-package/28127/3 "2018-07-23T17:54:28Z")

</div>

Hi, I did that and still no change.

---

<div class="post-metadata">

**Author:** ![Kai\_Stian\_Olstad](https://avatars.discourse-cdn.com/v4/letter/k/e19adc/32.png) [@Kai\_Stian\_Olstad](https://forum.ansible.com/u/Kai_Stian_Olstad)\
**Post date:** [July 23, 2018, 6:27pm UTC](https://forum.ansible.com/t/failure-trying-to-install-remote-yum-package/28127/4 "2018-07-23T18:27:01Z")

</div>

What I can say is that yum.puppetlabs.com is using SNI, how to solve it on RHEL6 I don't know.

But you could use http, since the package is sign you can always check the authenticity.