# Fetching collections from private Artifactory: CERTIFICATE\_VERIFY\_FAILED

**URL:** <https://forum.ansible.com/t/fetching-collections-from-private-artifactory-certificate-verify-failed/44675>\
**Category:** Get Help\
**Tags:** awx, ee, galaxy-ng\
**Created:** [October 14, 2025, 6:53am UTC](https://forum.ansible.com/t/fetching-collections-from-private-artifactory-certificate-verify-failed/44675 "2025-10-14T06:53:00Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![kastl-ars](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/kastl-ars/32/2315_2.png) [@kastl-ars](https://forum.ansible.com/u/kastl-ars)\
**Post date:** [October 14, 2025, 6:53am UTC](https://forum.ansible.com/t/fetching-collections-from-private-artifactory-certificate-verify-failed/44675/1 "2025-10-14T06:53:00Z")

</div>

Dear AWX users,

we are trying to pull collection updates from a private Artifactory instance.

We found that we need to disable the TLS certificate validation, even though Artifactory is using a valid certificate.

```auto
Got an unexpected error when getting available versions of collection
community.hashi_vault: Unknown error when attempting to call Galaxy at
'https://artifactory.example.org/api': <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify
failed: unable to get local issuer certificate (_ssl.c:1032)>. <urlopen error
[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local
issuer certificate (_ssl.c:1032)>
ERROR! Unknown error when attempting to call Galaxy at 'artifactory.example.org/api': <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1032)>. <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1032)>

```

Funnily enough, we can curl Artifactory from inside all containers in the awx-task and awx-web pods. Or use python urllib to connect, which also works fine.

It seems to only be the collections update that fails.

The execution environment used for the controlplane (which is used for the project updates) is self-built and includes ansible-core 2.18.10 as well as openssl and ca-certificates. It is based on the example [here](https://github.com/ansible-community/images/blob/main/execution-environments/community-ee-base/execution-environment.yml)

Any ideas how to debug further? Any solutions, tips, tricks?

Kind Regards,  
Johannes

---

<div class="post-metadata">

**Author:** ![shazra](https://avatars.discourse-cdn.com/v4/letter/s/54ee81/32.png) [@shazra](https://forum.ansible.com/u/shazra)\
**Post date:** [October 14, 2025, 7:44am UTC](https://forum.ansible.com/t/fetching-collections-from-private-artifactory-certificate-verify-failed/44675/2 "2025-10-14T07:44:51Z")

</div>

[Trusting a Custom Certificate Authority - Ansible AWX Operator Documentation](https://ansible.readthedocs.io/projects/awx-operator/en/latest/user-guide/advanced-configuration/trusting-a-custom-certificate-authority.html)

Please see if this helps , you have to create a bundle-ca with your custom CA which has signed your artifactory certificate and add it your KIND AWX deployment you have created

---

<div class="post-metadata">

**Author:** ![ildjarn](https://avatars.discourse-cdn.com/v4/letter/i/8491ac/32.png) [@ildjarn](https://forum.ansible.com/u/ildjarn)\
**Post date:** [October 14, 2025, 8:07am UTC](https://forum.ansible.com/t/fetching-collections-from-private-artifactory-certificate-verify-failed/44675/3 "2025-10-14T08:07:55Z")

</div>

Do you use a certificate signed by the new Sectigo R46 CA? I had the same problem with webhook notifications to our ticketing system.  
See [Questions about notifications in AWX 24.6.1 - #7 by ildjarn](https://forum.ansible.com/t/questions-about-notifications-in-awx-24-6-1/44648/7) for how I solved it.

---

<div class="post-metadata">

**Author:** ![kastl-ars](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/kastl-ars/32/2315_2.png) [@kastl-ars](https://forum.ansible.com/u/kastl-ars)\
**Post date:** [October 14, 2025, 11:34am UTC](https://forum.ansible.com/t/fetching-collections-from-private-artifactory-certificate-verify-failed/44675/4 "2025-10-14T11:34:31Z")

</div>

> [@shazra](#):
>
> you have to create a bundle-ca with your custom CA

Artifactory does not use a certificate signed by a custom CA. It is a regular certificate, signed by SwissSign AG.

And why would this error out during collection sync, when all other connections (curl, python urllib3, …) we tried did not complain regarding the certificate?