# Regression of #9966? **URL:** \ **Category:** Ansible Developer\ **Tags:** ubuntu\ **Created:** [December 10, 2015, 6:10am UTC](https://forum.ansible.com/t/regression-of-9966/19979 "2015-12-10T06:10:50Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Bob\_Tanner](https://avatars.discourse-cdn.com/v4/letter/b/49beb7/32.png) [@Bob\_Tanner](https://forum.ansible.com/u/Bob_Tanner)\ **Post date:** [December 10, 2015, 6:10am UTC](https://forum.ansible.com/t/regression-of-9966/19979/1 "2015-12-10T06:10:50Z")
Getting what looks like a regression of [https://github.com/ansible/ansible/issues/9966](https://github.com/ansible/ansible/issues/9966). Since the issue is closed posting what is there here. ```auto $ ansible --version ansible 2.1.0 (devel 30e729557f) last updated 2015/12/09 22:10:16 (GMT -500) lib/ansible/modules/core: (detached HEAD 0b5555b62c) last updated 2015/12/09 22:10:16 (GMT -500) lib/ansible/modules/extras: (detached HEAD cbed642009) last updated 2015/12/09 22:10:16 (GMT -500) config file = /Users/tanner/projects/ansible.git/playbooks.git/ansible.cfg configured module search path = Default w/o overrides ``` ```auto - name: add zfs-native apt repository apt_repository: > repo="ppa:zfs-native/stable" update_cache="yes" ``` ```auto FAILED! => {"changed": false, "failed": true, "msg": "Failed to validate the SSL certificate for launchpad.net:443. Make sure your managed systems have a valid CA certificate installed. If the website serving the url uses SNI you need python >= 2.7.9 on your managed machine. You can use validate_certs=False if you do not need to confirm the server\s identity but this is unsafe and not recommended Paths checked for this platform: /etc/ssl/certs, /etc/pki/ca-trust/extracted/pem, /etc/pki/tls/certs, /usr/share/ca-certificates/cacert.org, /etc/ansible"} ``` The managed machine is a fully patched Ubuntu 14.04 and it’s python 2.7.6 ---
**Author:** ![Florian\_Apolloner](https://avatars.discourse-cdn.com/v4/letter/f/dfb087/32.png) [@Florian\_Apolloner](https://forum.ansible.com/u/Florian_Apolloner)\ **Post date:** [December 10, 2015, 9:51am UTC](https://forum.ansible.com/t/regression-of-9966/19979/2 "2015-12-10T09:51:19Z")
A wireshark dump of the HTTPs request should help clearing this up. Are you behind a corporate proxy which intercepts SSL? I am not sure if launchpad uses SNI, in which case Python 2.7 (\<2.7.9) will just not work. Can you try this in a shell: python -c “import urllib2; print 2.urlopen(‘[https://launchpad.net](https://launchpad.net)’).read()” Cheers, Florian ---
**Author:** ![Bob\_Tanner](https://avatars.discourse-cdn.com/v4/letter/b/49beb7/32.png) [@Bob\_Tanner](https://forum.ansible.com/u/Bob_Tanner)\ **Post date:** [December 10, 2015, 6:10pm UTC](https://forum.ansible.com/t/regression-of-9966/19979/3 "2015-12-10T18:10:55Z")
Not behind any proxy or firewall. $ python -c “import urllib2; print urllib2.urlopen(‘[https://launchpad.net](https://launchpad.net)’).read()” [http://git.io/v0fGA](http://git.io/v0fGA) ---
**Author:** ![Florian\_Apolloner](https://avatars.discourse-cdn.com/v4/letter/f/dfb087/32.png) [@Florian\_Apolloner](https://forum.ansible.com/u/Florian_Apolloner)\ **Post date:** [December 10, 2015, 6:19pm UTC](https://forum.ansible.com/t/regression-of-9966/19979/4 "2015-12-10T18:19:26Z")
Maybe ansible uses a different CA bundle, can you check the paths returned from [https://github.com/ansible/ansible/blob/devel/lib/ansible/module\_utils/urls.py#L430-L483](https://github.com/ansible/ansible/blob/devel/lib/ansible/module_utils/urls.py#L430-L483) and if the root ca in question is in there? ---
**Author:** ![Bob\_Tanner](https://avatars.discourse-cdn.com/v4/letter/b/49beb7/32.png) [@Bob\_Tanner](https://forum.ansible.com/u/Bob_Tanner)\ **Post date:** [December 11, 2015, 3:54pm UTC](https://forum.ansible.com/t/regression-of-9966/19979/5 "2015-12-11T15:54:26Z")
/etc/ssl/certs DigiCert\_Assured\_ID\_Root\_CA.pem DigiCert\_Assured\_ID\_Root\_G2.pem DigiCert\_Assured\_ID\_Root\_G3.pem DigiCert\_Global\_Root\_CA.pem DigiCert\_Global\_Root\_G2.pem DigiCert\_Global\_Root\_G3.pem DigiCert\_High\_Assurance\_EV\_Root\_CA.pem DigiCert\_Trusted\_Root\_G4.pem [launchpad.net](http://launchpad.net) is telling me CA is DigiCert\_High\_Assurance\_EV\_Root\_CA.pem $ openssl verify DigiCert\_High\_Assurance\_EV\_Root\_CA.pem DigiCert\_High\_Assurance\_EV\_Root\_CA.pem: OK ---
**Author:** ![Toshio\_Kuratomi](https://avatars.discourse-cdn.com/v4/letter/t/41988e/32.png) [@Toshio\_Kuratomi](https://forum.ansible.com/u/Toshio_Kuratomi)\ **Post date:** [December 14, 2015, 2:50am UTC](https://forum.ansible.com/t/regression-of-9966/19979/6 "2015-12-14T02:50:11Z")
Hmm... Finally got a chance to try this out tonight. Was not able to reproduce. I don't have a fully patched system but it is Ubuntu-14.04.... Not sure if I have python-2.7.5 or python-2.7.6: badger@ubuntu14:~$ dpkg -s python|grep Version Version: 2.7.5-5ubuntu3 badger@ubuntu14:~$ python --version Python 2.7.6 [pts/26@roan]$ ansible --version \*[devel] (18:35:03) ansible 2.1.0 (devel 89603a0509) last updated 2015/12/13 11:34:00 (GMT -700)   lib/ansible/modules/core: (yum-use-rpm 0125770d8d) last updated 2015/12/13 09:23:57 (GMT -700)   lib/ansible/modules/extras: (devel 51813e0033) last updated 2015/12/10 08:10:37 (GMT -700)   config file = /etc/ansible/ansible.cfg   configured module search path = Default w/o overrides [pts/26@roan]$ ansible-playbook -i /etc/ansible/hosts.mine /var/tmp/9966.yml --sudo -K SUDO password: PLAY \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* TASK [wait\_for host=ubuntu14 port=22] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* ok: [ubuntu14 -\> localhost] TASK [add zfs-native apt repository] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* changed: [ubuntu14] PLAY RECAP \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* ubuntu14 : ok=2 changed=1 unreachable=0 failed=0 [pts/26@roan]$ cat /var/tmp/9966.yml \*[devel] (18:35:07)