# Internal CA trust for project playbooks **URL:** \ **Category:** AWX Project\ **Tags:** awx, ee\ **Created:** [September 23, 2021, 7:29am UTC](https://forum.ansible.com/t/internal-ca-trust-for-project-playbooks/35776 "2021-09-23T07:29:13Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Thibaut\_Perrin](https://avatars.discourse-cdn.com/v4/letter/t/a6a055/32.png) [@Thibaut\_Perrin](https://forum.ansible.com/u/Thibaut_Perrin)\ **Post date:** [September 23, 2021, 7:29am UTC](https://forum.ansible.com/t/internal-ca-trust-for-project-playbooks/35776/1 "2021-09-23T07:29:13Z")
Hello everyone, I have a simple yet problematic situation. I have an AWX 19.3 setup in an openshift cluster, and I have a gitlab repo that is hosting my playbooks and another for my collections. When I try and import my collections, I have an error fatal: unable to access ‘[https://gitlab/blabla/repo/](https://gitlab/blabla/repo/)’: SSL certificate problem: self signed certificate in certificate chain". The IRC channel has advised me to build my own EE, but : 1/ I’m not sure on how to do that 2/ I’m not sure on how to do that while including my CA If someone has a detailed view on how to build EE properly and sustainably, or on how to achieve my goal here, I’d be very glad. Thanks a lot and happy automating ! ---
**Author:** ![Cnu\_k](https://avatars.discourse-cdn.com/v4/letter/c/a88e4f/32.png) [@Cnu\_k](https://forum.ansible.com/u/Cnu_k)\ **Post date:** [September 23, 2021, 1:27pm UTC](https://forum.ansible.com/t/internal-ca-trust-for-project-playbooks/35776/2 "2021-09-23T13:27:22Z")
I haven’t tested with our interal github yet as I just finished setting up the operator and a test AWX instance in the OpenShift 4.7 cluster. As per one of the posts, I created following secrets with our internal CA that’s used by LDAP, git and others for HTTPS communication. oc create secret generic org-ca-cert -n awx-test-ns --from-file=ldap-ca.crt=myorg-CA.pem --from-file=bundle-ca.crt= myorg-CA.pem I have not customized the EE docker image yet, I do see that EE container has following mount now with the certificate data /etc/pki/ca-trust/source/anchors/bundle-ca.crt I have these entries in the AWX instance YAML ldap\_cacert\_secret: org-ca-cert bundle\_cacert\_secret: org-ca-cert ---
**Author:** ![Wei-Yen\_Tan](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/wei-yen_tan/32/4111_2.png) [@Wei-Yen\_Tan](https://forum.ansible.com/u/Wei-Yen_Tan)\ **Post date:** [September 23, 2021, 1:38pm UTC](https://forum.ansible.com/t/internal-ca-trust-for-project-playbooks/35776/3 "2021-09-23T13:38:31Z")
Here is how the documentation on how to write ee. [https://ansible-builder.readthedocs.io/en/latest/index.html](https://ansible-builder.readthedocs.io/en/latest/index.html) I also wrote something about it a while back [http://weiyentan.github.io/2021/creating-execution-environments/](http://weiyentan.github.io/2021/creating-execution-environments/) Some things you may need to increment the versions for. I hope it helps ---
**Author:** ![Wei-Yen\_Tan](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/wei-yen_tan/32/4111_2.png) [@Wei-Yen\_Tan](https://forum.ansible.com/u/Wei-Yen_Tan)\ **Post date:** [September 23, 2021, 1:49pm UTC](https://forum.ansible.com/t/internal-ca-trust-for-project-playbooks/35776/4 "2021-09-23T13:49:32Z")
The git ssl verification can be turned off in awx of you are so inclined . I’ll dig it up if you want to go down that path ---
**Author:** ![Thibaut\_Perrin](https://avatars.discourse-cdn.com/v4/letter/t/a6a055/32.png) [@Thibaut\_Perrin](https://forum.ansible.com/u/Thibaut_Perrin)\ **Post date:** [September 23, 2021, 3:49pm UTC](https://forum.ansible.com/t/internal-ca-trust-for-project-playbooks/35776/5 "2021-09-23T15:49:04Z")
That is EXACTLY what I’ve been looking for. Thank you so much. I’ve added the bundle-ca.crt generic secret, and now my git SSL certs do not throw any errors. Thanks again ! 🙂