# How to fix faulty SSL listeners so that ConfigureRemotingForAnsible.ps1 can execute **URL:** \ **Category:** Ansible Developer\ **Tags:** windows\ **Created:** [March 10, 2015, 8:47pm UTC](https://forum.ansible.com/t/how-to-fix-faulty-ssl-listeners-so-that-configureremotingforansible-ps1-can-execute/17712 "2015-03-10T20:47:57Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![David\_Goade](https://avatars.discourse-cdn.com/v4/letter/d/c57346/32.png) [@David\_Goade](https://forum.ansible.com/u/David_Goade)\ **Post date:** [March 10, 2015, 8:47pm UTC](https://forum.ansible.com/t/how-to-fix-faulty-ssl-listeners-so-that-configureremotingforansible-ps1-can-execute/17712/1 "2015-03-10T20:47:57Z")
PSRemoting from the Ansible controller to a Windows host was working fine and then one day failed with: … _WINRM CONNECTION ERROR: 500 WinRMTransport. [Errno 104] Connection reset by peer_ … After some investigation, I was able to determine that SSL had become broken on the Windows host. I was able to resolve this by debugging the [Ansible Windows prep script](https://github.com/ansible/ansible/blob/devel/examples/scripts/ConfigureRemotingForAnsible.ps1), removing the apparently faulty SSL Listener from the WSUS replica and re-running the prep script. The prep script is supposed to create a self-signed certificate\* to enable PSRemoting over SSL. However, it does not do that if it detects that an SSL listener is already configured for the server and in this case, the WSUS server was reporting that it had one. This was not consistent with what it told me when I viewed the WSUS servers SSL configuration through the IIS GUI, however. There, it was reporting this: _“The site does not have a secure binding (HTTPS) and cannot accept SSL connections”_ After stepping through the script with the ISE debugger, I was able to view the listeners after it executes line 134 and from there, I could see the following: _WSManConfig: Microsoft.WSMan.Management\WSMan::localhost\Listener_ _Type Keys Name_ _---- ---- ----_ _Container {Transport=HTTPS, Address=} Listener\_1305953032_ _Container {Transport=HTTP, Address=__} Listener\_1084132640_ I guessed that something was faulty with the HTTPS listener: Listener\_1305953032 and executed this command to remove it: Remove-Item WSMan:\localhost\Listener\Listener\_1305953032 Then, I re-ran the prep script and it successfully created a new self-signed certificate for the server. After that, I was able to securely PSRemote to the WSUS server from the Ansible Controller. **Does the community have a recommendation to prevent this from happening again?** **Is a pull request in order?** - Side note: Even though the Windows error message states that the certificate cannot be self-signed, this is apparently not true as the prep script has always created self-signed certs and we’ve been using them successfully ---
**Author:** ![Trond\_Hindenes](https://avatars.discourse-cdn.com/v4/letter/t/96bed5/32.png) [@Trond\_Hindenes](https://forum.ansible.com/u/Trond_Hindenes)\ **Post date:** [March 15, 2015, 7:57pm UTC](https://forum.ansible.com/t/how-to-fix-faulty-ssl-listeners-so-that-configureremotingforansible-ps1-can-execute/17712/2 "2015-03-15T19:57:25Z")
Hi David, We have some known issues with the script and there will probably be a pull req in the near future. However, your issue souds like kind of an edge case. The prep script was never meant to be a “catch-all” solution, but a simple way of getting up and running quickly on a relatively pristine windows instance. We will however, probably be able to perform better testing and report if something seems odd when running the new version of the script. I’ll try and find time to do a PR sometime during the next week. -Trond ---
**Author:** ![David\_Goade](https://avatars.discourse-cdn.com/v4/letter/d/c57346/32.png) [@David\_Goade](https://forum.ansible.com/u/David_Goade)\ **Post date:** [March 16, 2015, 3:03pm UTC](https://forum.ansible.com/t/how-to-fix-faulty-ssl-listeners-so-that-configureremotingforansible-ps1-can-execute/17712/3 "2015-03-16T15:03:25Z")
Hey Trond, Thanks for the reply. I’m definitely living on the edge these days. I’ve had to use Chris Church’s [winrm\_kerberos\_support](https://github.com/cchurch/ansible/tree/winrm_kerberos_support) branch to get domain auth, extend [ViaSat’s ansible-vsphere](https://github.com/ViaSat/ansible-vsphere)module to do rolling snapshots and just yesterday, I dredged-up the [reverted win\_copy commit](https://groups.google.com/forum/#!topic/ansible-devel/Jl5qP73CiKo) just for this one project to automate installing Windows updates. I’m going to make this work no matter what it takes. 🙂 I understand that the script cant do it all. It is really handy though, and there may be an opportunity to do a little validation on the certificate in addition to the SSL Listener. Apparently, it’s possible to have an SSL listener without a certificate. Of course, Windows wasn’t actually listening on the secured port so maybe there’s another opportunity there – check for an answer on the secured port of the local host. Probably nothing new in my suggestions, I know. The main thing I wanted to do was try to contribute a little to the community by sharing my experience and how I fixed it. I will keep an eye out for updates to the script. -David ---
**Author:** ![Trond\_Hindenes](https://avatars.discourse-cdn.com/v4/letter/t/96bed5/32.png) [@Trond\_Hindenes](https://forum.ansible.com/u/Trond_Hindenes)\ **Post date:** [March 26, 2015, 6:58am UTC](https://forum.ansible.com/t/how-to-fix-faulty-ssl-listeners-so-that-configureremotingforansible-ps1-can-execute/17712/4 "2015-03-26T06:58:08Z")
PR [#10539](https://github.com/ansible/ansible/pull/10539) has been added. David, thanks for your testing!