# SSLError: \[SSL: CERTIFICATE\_VERIFY\_FAILED\] certificate verify failed **URL:** \ **Category:** Ansible Project\ **Tags:** windows\ **Created:** [June 28, 2016, 12:37am UTC](https://forum.ansible.com/t/sslerror-ssl-certificate-verify-failed-certificate-verify-failed/21870 "2016-06-28T00:37:59Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Hugo\_Enrique\_Hernand](https://avatars.discourse-cdn.com/v4/letter/h/c57346/32.png) [@Hugo\_Enrique\_Hernand](https://forum.ansible.com/u/Hugo_Enrique_Hernand)\ **Post date:** [June 28, 2016, 12:37am UTC](https://forum.ansible.com/t/sslerror-ssl-certificate-verify-failed-certificate-verify-failed/21870/1 "2016-06-28T00:37:59Z")
Hi I’m running ansible against a windows host for testing purposes. but i am getting this error : Red Hat 7.2 Ansible 1.9.2 [ansible-windows]$ ansible windows -i host -m win\_ping -vvvvv \ ESTABLISH WINRM CONNECTION FOR USER: prhtblad on PORT 5986 TO srvspodvlmx01.wt.mx.corp \ WINRM CONNECT: transport=plaintext endpoint=[https://srvspodvlmx01.wt.mx.corp:5986/wsman](https://srvspodvlmx01.wt.mx.corp:5986/wsman) srvspodvlmx01.wt.mx.corp | FAILED =\> Traceback (most recent call last): File “/usr/lib/python2.7/site-packages/ansible/runner/ **init**.py”, line 582, in \_executor exec\_rc = self.\_executor\_internal(host, new\_stdin) File “/usr/lib/python2.7/site-packages/ansible/runner/ **init**.py”, line 785, in \_executor\_internal return self.\_executor\_internal\_inner(host, self.module\_name, self.module\_args, inject, port, complex\_args=complex\_args) File “/usr/lib/python2.7/site-packages/ansible/runner/ **init**.py”, line 964, in \_executor\_internal\_inner conn = self.connector.connect(actual\_host, actual\_port, actual\_user, actual\_pass, actual\_transport, actual\_private\_key\_file, delegate\_host) File “/usr/lib/python2.7/site-packages/ansible/runner/connection.py”, line 52, in connect self.active = conn.connect() File “/usr/lib/python2.7/site-packages/ansible/runner/connection\_plugins/winrm.py”, line 140, in connect self.protocol = self.\_winrm\_connect() File “/usr/lib/python2.7/site-packages/ansible/runner/connection\_plugins/winrm.py”, line 96, in \_winrm\_connect protocol.send\_message(‘’) File “/usr/lib/python2.7/site-packages/winrm/protocol.py”, line 207, in send\_message return self.transport.send\_message(message) File “/usr/lib/python2.7/site-packages/winrm/transport.py”, line 173, in send\_message response = self.session.send(prepared\_request, timeout=self.read\_timeout\_sec) File “/usr/lib/python2.7/site-packages/requests/sessions.py”, line 585, in send r = adapter.send(request, \*\*kwargs) File “/usr/lib/python2.7/site-packages/requests/adapters.py”, line 477, in send raise SSLError(e, request=request) SSLError: [SSL: CERTIFICATE\_VERIFY\_FAILED] certificate verify failed (\_ssl.c:765) Any idea about this error ? Thanks ---
**Author:** ![j.r.hawkesworth](https://avatars.discourse-cdn.com/v4/letter/j/a3d4f5/32.png) [@j.r.hawkesworth](https://forum.ansible.com/u/j.r.hawkesworth)\ **Post date:** [June 28, 2016, 7:59am UTC](https://forum.ansible.com/t/sslerror-ssl-certificate-verify-failed-certificate-verify-failed/21870/2 "2016-06-28T07:59:12Z")
Hi, Since python 2.7.9 ( I think) python’s default behavior has been to validate certificates for any https connections. The certificate used by the windows hosts is likely self-generated, therefore won’t be fully trusted. So in order to avoid the certificate check, you have to set the following var in your ansible inventory/group\_vars that apply to your windows hosts. ```auto # The following is necessary for Python 2.7.9+ when using default WinRM self-signed certificates: ansible_winrm_server_cert_validation: ignore ``` Its documented here: [http://docs.ansible.com/ansible/intro\_windows.html#inventory](http://docs.ansible.com/ansible/intro_windows.html#inventory) If you would rather python did check the certificate then you will either need to trust the cert for each of your windows hosts, or acquire trusted (not self-signed) certificates for each of your windows hosts, add them to the the computer certificate store and ensure that winrm is using your new certificate. Hope this helps, Jon ---
**Author:** ![Hugo\_Enrique\_Hernand](https://avatars.discourse-cdn.com/v4/letter/h/c57346/32.png) [@Hugo\_Enrique\_Hernand](https://forum.ansible.com/u/Hugo_Enrique_Hernand)\ **Post date:** [June 29, 2016, 6:19pm UTC](https://forum.ansible.com/t/sslerror-ssl-certificate-verify-failed-certificate-verify-failed/21870/3 "2016-06-29T18:19:21Z")
Hi Jon My ansible control node have python 2.7.5 [ansible@ansible-server ansible-windows]$ python --version **Python 2.7.5** [ansible@ansible-server ansible-windows]$ So i follow this [link http://docs.ansible.com/ansible/intro\_windows.html](http://docs.ansible.com/ansible/intro_windows.html#inventory) My windows.yml [ansible@ansible-server ansible-windows]$ cat group\_vars/windows.yml # it is suggested that these be encrypted with ansible-vault: # # ansible-vault edit group\_vars/windows.yml ansible\_ssh\_user: ansible ansible\_ssh\_pass: xxxxxx ansible\_ssh\_port: 5986 ansible\_connection: winrm # The following is necessary for Python 2.7.9+ when using default WinRM self-signed certificates: ansible\_winrm\_server\_cert\_validation: ignore i try with the recomendation of python 2.7.9+ but fails anyway [ansible@ansible-server ansible-windows]$ ansible windows -i host -m win\_ping -vvvvv \ ESTABLISH WINRM CONNECTION FOR USER: ansible on PORT 5986 TO mywindowshost.wt.mx.corp \ WINRM CONNECT: transport=plaintext endpoint=[https://mywindowshost.wt.mx.corp:5986/wsman](https://mywindowshost.wt.mx.corp:5986/wsman) mywindowshost.wt.mx.corp | FAILED =\> Traceback (most recent call last): File “/usr/lib/python2.7/site-packages/ansible/runner/ **init**.py”, line 582, in \_executor exec\_rc = self.\_executor\_internal(host, new\_stdin) File “/usr/lib/python2.7/site-packages/ansible/runner/ **init**.py”, line 785, in \_executor\_internal return self.\_executor\_internal\_inner(host, self.module\_name, self.module\_args, inject, port, complex\_args=complex\_args) File “/usr/lib/python2.7/site-packages/ansible/runner/ **init**.py”, line 964, in \_executor\_internal\_inner conn = self.connector.connect(actual\_host, actual\_port, actual\_user, actual\_pass, actual\_transport, actual\_private\_key\_file, delegate\_host) File “/usr/lib/python2.7/site-packages/ansible/runner/connection.py”, line 52, in connect self.active = conn.connect() File “/usr/lib/python2.7/site-packages/ansible/runner/connection\_plugins/winrm.py”, line 140, in connect self.protocol = self.\_winrm\_connect() File “/usr/lib/python2.7/site-packages/ansible/runner/connection\_plugins/winrm.py”, line 96, in \_winrm\_connect protocol.send\_message(‘’) File “/usr/lib/python2.7/site-packages/winrm/protocol.py”, line 207, in send\_message return self.transport.send\_message(message) File “/usr/lib/python2.7/site-packages/winrm/transport.py”, line 173, in send\_message response = self.session.send(prepared\_request, timeout=self.read\_timeout\_sec) File “/usr/lib/python2.7/site-packages/requests/sessions.py”, line 585, in send r = adapter.send(request, \*\*kwargs) File “/usr/lib/python2.7/site-packages/requests/adapters.py”, line 477, in send raise SSLError(e, request=request) SSLError: [SSL: CERTIFICATE\_VERIFY\_FAILED] certificate verify failed (\_ssl.c:765) With both method fails, so i do a testing conection with Curl and its OK ansible@ansible-server ansible-windows]$ curl -vk -d “” -u “ansible:xxxxxxx” [https://mywindowshost.wt.mx.corp:5986/wsman](https://mywindowshost.wt.mx.corp:5986/wsman) - About to connect() to mywindowshost.wt.mx.corp port 5986 (#0) - Trying 22.134.234.100… - Connected to mywindowshost.wt.mx.corp (22.134.234.100) port 5986 (#0) - Initializing NSS with certpath: sql:/etc/pki/nssdb - skipping SSL peer certificate verification - SSL connection using TLS\_RSA\_WITH\_AES\_128\_CBC\_SHA - Server certificate: - start date: Jun 27 18:16:45 2016 GMT - expire date: Jun 27 18:16:45 2017 GMT - common name: mywindowshost - issuer: CN=mywindowshost - Server auth using Basic with user ‘ansible’ > POST /wsman HTTP/1.1 > Authorization: Basic cHJodGJsYWQ6QmxhKjg2LmxvZw== > User-Agent: curl/7.29.0 > Host: mywindowshost.wt.mx.corp:5986 > Accept: _/_ > Content-Length: 0 > Content-Type: application/x-www-form-urlencoded \< HTTP/1.1 411 \< Server: Microsoft-HTTPAPI/2.0 \< Date: Wed, 29 Jun 2016 18:19:37 GMT \< Connection: close \< Content-Length: 0 \< - Closing connection 0 Any idea ? Thanks ---
**Author:** ![Matt\_Davis](https://avatars.discourse-cdn.com/v4/letter/m/ce7236/32.png) [@Matt\_Davis](https://forum.ansible.com/u/Matt_Davis)\ **Post date:** [June 29, 2016, 8:45pm UTC](https://forum.ansible.com/t/sslerror-ssl-certificate-verify-failed-certificate-verify-failed/21870/4 "2016-06-29T20:45:58Z")
You need to be using at least Ansible 1.9.4 (preferably 2.1) and pywinrm 0.1.1 (preferably 0.2.0) to pass the certificate validation disable to pywinrm. 1.9.2 will be _very_ slow and suboptimal for Windows work in many ways. ---
**Author:** ![Hugo\_Enrique\_Hernand](https://avatars.discourse-cdn.com/v4/letter/h/c57346/32.png) [@Hugo\_Enrique\_Hernand](https://forum.ansible.com/u/Hugo_Enrique_Hernand)\ **Post date:** [June 29, 2016, 11:36pm UTC](https://forum.ansible.com/t/sslerror-ssl-certificate-verify-failed-certificate-verify-failed/21870/5 "2016-06-29T23:36:08Z")
Hi I remove that line and try again [ansible@ansible-server ansible-windows]$ cat group\_vars/windows.yml # it is suggested that these be encrypted with ansible-vault: # # ansible-vault edit group\_vars/windows.yml ansible\_ssh\_user: ansible ansible\_ssh\_pass: xxxxxx ansible\_ssh\_port: 5986 ansible\_connection: winrm but i getting the same error, [ansible@ansible-server ansible-windows]$ ansible windows -i host -m win\_ping -vvvvv \ ESTABLISH WINRM CONNECTION FOR USER: ansible on PORT 5986 TO srvspodvlmx01.wt.mx.corp \ WINRM CONNECT: transport=plaintext endpoint=[https://mywindowshost.wt.mx.corp:5986/wsman](https://mywindowshost.wt.mx.corp:5986/wsman) mywindowshost.wt.mx.corp | FAILED =\> Traceback (most recent call last): File “/usr/lib/python2.7/site-packages/ansible/runner/ **init**.py”, line 582, in \_executor exec\_rc = self.\_executor\_internal(host, new\_stdin) File “/usr/lib/python2.7/site-packages/ansible/runner/ **init**.py”, line 785, in \_executor\_internal return self.\_executor\_internal\_inner(host, self.module\_name, self.module\_args, inject, port, complex\_args=complex\_args) File “/usr/lib/python2.7/site-packages/ansible/runner/ **init**.py”, line 964, in \_executor\_internal\_inner conn = self.connector.connect(actual\_host, actual\_port, actual\_user, actual\_pass, actual\_transport, actual\_private\_key\_file, delegate\_host) File “/usr/lib/python2.7/site-packages/ansible/runner/connection.py”, line 52, in connect self.active = conn.connect() File “/usr/lib/python2.7/site-packages/ansible/runner/connection\_plugins/winrm.py”, line 140, in connect self.protocol = self.\_winrm\_connect() File “/usr/lib/python2.7/site-packages/ansible/runner/connection\_plugins/winrm.py”, line 96, in \_winrm\_connect protocol.send\_message(‘’) File “/usr/lib/python2.7/site-packages/winrm/protocol.py”, line 207, in send\_message return self.transport.send\_message(message) File “/usr/lib/python2.7/site-packages/winrm/transport.py”, line 173, in send\_message response = self.session.send(prepared\_request, timeout=self.read\_timeout\_sec) File “/usr/lib/python2.7/site-packages/requests/sessions.py”, line 585, in send r = adapter.send(request, \*\*kwargs) File “/usr/lib/python2.7/site-packages/requests/adapters.py”, line 477, in send raise SSLError(e, request=request) SSLError: [SSL: CERTIFICATE\_VERIFY\_FAILED] certificate verify failed (\_ssl.c:765) I follow all requeriments any suggestion?? Regards ---
**Author:** ![Matt\_Davis](https://avatars.discourse-cdn.com/v4/letter/m/ce7236/32.png) [@Matt\_Davis](https://forum.ansible.com/u/Matt_Davis)\ **Post date:** [June 30, 2016, 4:46pm UTC](https://forum.ansible.com/t/sslerror-ssl-certificate-verify-failed-certificate-verify-failed/21870/6 "2016-06-30T16:46:53Z")
Just out of curiosity, why are you still using Ansible 1.9? The Windows support was barely working there- things are much faster and more supported in the 2.x series. You’ll absolutely need the ansible\_winrm\_server\_cert\_validation: ignore to get past this, and you need to be on a minimum of 1.9.5 (I think I might’ve said 1.9.4 before).