# URI module fails with SSL cert validation set to no **URL:** \ **Category:** Ansible Project\ **Created:** [June 7, 2018, 1:11am UTC](https://forum.ansible.com/t/uri-module-fails-with-ssl-cert-validation-set-to-no/27730 "2018-06-07T01:11:09Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Gilberto\_Valentin](https://avatars.discourse-cdn.com/v4/letter/g/b4bc9f/32.png) [@Gilberto\_Valentin](https://forum.ansible.com/u/Gilberto_Valentin)\ **Post date:** [June 7, 2018, 1:11am UTC](https://forum.ansible.com/t/uri-module-fails-with-ssl-cert-validation-set-to-no/27730/1 "2018-06-07T01:11:09Z")
When running a task from a playbook using the URI module, I am getting the following SSL error: ` workstation:documents me$ ansible-playbook --tags checkHealth myplaybook.yml PLAY [check indexing status] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* TASK [Check for health] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* fatal: [localhost]: FAILED! =\> {“changed”: false, “content”: “”, “msg”: “Status code was -1 and not [200]: Request failed: \”, “redirected”: false, “status”: -1, “url”: “[https://site.domain.tld/rest/check/](https://site.domain.tld/rest/check/)”} to retry, use: --limit @/Users/me/myplaybook.retry PLAY RECAP \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* localhost : ok=0 changed=0 unreachable=0 failed=1 ` This is what the task looks like: ` tasks: - name: Check for health uri: url: [https://site.domain.tld/rest/check/](https://site.domain.tld/rest/check/) method: GET user: ansible password: “{{ ansible }}” force\_basic\_auth: yes body\_format: json return\_content: yes validate\_certs: no status\_code: 200 register: results tags: - checkHealth ` As you can see, I am telling it not to **validate\_certs: no** however, I still get the above error. I am running this on MacOS 10.12.6, where there are some Python OpenSSL issues. However, I took the proper steps to mitigate that. Here is what I am running: Ansible version = 2.5.4 Ansible is pointing to = python version 3.6.5 OpenSSL version = 1.0.2o 27 Mar 2018 I suspect the Python module is not honoring the **validate\_certs** option or my install of Python 3 isn’t using the right TLS version 1.2? I’m not sure what else to check here. Any pointers? ---
**Author:** ![Tchia04](https://avatars.discourse-cdn.com/v4/letter/t/fbc32d/32.png) [@Tchia04](https://forum.ansible.com/u/Tchia04)\ **Post date:** [June 7, 2018, 4:13pm UTC](https://forum.ansible.com/t/uri-module-fails-with-ssl-cert-validation-set-to-no/27730/2 "2018-06-07T16:13:27Z")
Maybe add -vvvvv and see if there are additional error message that is helpful? ---
**Author:** ![Gilberto\_Valentin](https://avatars.discourse-cdn.com/v4/letter/g/b4bc9f/32.png) [@Gilberto\_Valentin](https://forum.ansible.com/u/Gilberto_Valentin)\ **Post date:** [June 7, 2018, 7:49pm UTC](https://forum.ansible.com/t/uri-module-fails-with-ssl-cert-validation-set-to-no/27730/3 "2018-06-07T19:49:17Z")
When I run it in verbose, the message for that task is pretty much the same: > > “msg”: “Status code was -1 and not [200]: Request failed: \”, > > > “redirected”: false, > > > “status”: -1, > > > “url”: “[https://site.domain.tld/rest/check/](https://site.domain.tld/rest/check/)” Here is the full verbosity output: ` > =\> ansible-playbook --tags checkHealth ~/myplaybook.yml -vvv > ansible-playbook 2.5.4 > config file = /Users/me/.ansible.cfg > configured module search path = [‘/Users/me/.ansible/plugins/modules’, ‘/usr/share/ansible/plugins/modules’] > ansible python module location = /usr/local/lib/python3.6/site-packages/ansible > executable location = /usr/local/bin/ansible-playbook > python version = 3.6.5 (default, Apr 25 2018, 14:26:36) [GCC 4.2.1 Compatible Apple LLVM 9.0.0 (clang-900.0.39.2)] > Using /Users/me/.ansible.cfg as config file > Parsed /Users/me/ansible/inventory inventory source with ini plugin PLAYBOOK: myplaybook.yml \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* 1 plays in /Users/me/myplaybook.yml Read vars\_file ‘…/Vault.yml’ Read vars\_file ‘…/Vault.yml’ PLAY [check indexing status] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* META: ran handlers Read vars\_file ‘…/Vault.yml’ TASK [Check for “Lucene” health] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* task path: /Users/me/myplaybook.yml:10 Using module file /usr/local/lib/python3.6/site-packages/ansible/modules/net\_tools/basics/uri.py ESTABLISH LOCAL CONNECTION FOR USER: me EXEC /bin/sh -c ‘echo ~me2 && sleep 0’ EXEC /bin/sh -c ‘( umask 77 && mkdir -p “`echo /Users/me/.ansible/tmp/ansible-tmp-1528389571.6054752-184913372491664`” && echo ansible-tmp-1528389571.6054752-184913372491664=“`echo /Users/me/.ansible/tmp/ansible-tmp-1528389571.6054752-184913372491664`” ) && sleep 0’ PUT /Users/me/.ansible/tmp/ansible-local-75437a7u\_k2kd/tmphmuwa7sm TO /Users/eh3512/.ansible/tmp/ansible-tmp-1528389571.6054752-184913372491664/uri.py EXEC /bin/sh -c ‘chmod u+x /Users/me/.ansible/tmp/ansible-tmp-1528389571.6054752-184913372491664/ /Users/me/.ansible/tmp/ansible-tmp-1528389571.6054752-184913372491664/uri.py && sleep 0’ EXEC /bin/sh -c ‘/usr/bin/python /Users/me/.ansible/tmp/ansible-tmp-1528389571.6054752-184913372491664/uri.py && sleep 0’ EXEC /bin/sh -c ‘rm -f -r /Users/me/.ansible/tmp/ansible-tmp-1528389571.6054752-184913372491664/ \> /dev/null 2\>&1 && sleep 0’ The full traceback is: File “/var/folders/kz/j5vz888d39q0hsrd15ml4214by4qgx/T/ansible\_Wlj9po/ansible\_module\_uri.py”, line 471, in main uresp[‘location’] = absolute\_location(url, uresp[‘location’]) fatal: [localhost]: FAILED! =\> { “changed”: false, “content”: “”, “invocation”: { “module\_args”: { “attributes”: null, “backup”: null, “body”: null, “body\_format”: “json”, “client\_cert”: null, “client\_key”: null, “content”: null, “creates”: null, “delimiter”: null, “dest”: null, “directory\_mode”: null, “follow”: false, “follow\_redirects”: “safe”, “force”: false, “force\_basic\_auth”: true, “group”: null, “headers”: { “Authorization”: “Basic YksdjhfksjdhfZSnJhT1l4TmUw”, “Content-Type”: “application/json” }, “http\_agent”: “ansible-httpget”, “method”: “GET”, “mode”: null, “owner”: null, “password”: “VALUE\_SPECIFIED\_IN\_NO\_LOG\_PARAMETER”, “regexp”: null, “register”: “results”, “remote\_src”: null, “removes”: null, “return\_content”: true, “selevel”: null, “serole”: null, “setype”: null, “seuser”: null, “src”: null, “status\_code”: [ “200” ], “timeout”: 30, “unsafe\_writes”: null, “url”: “[https://site.domain.tld/rest/check/](https://www.google.com/url?q=https%3A%2F%2Fsite.domain.tld%2Frest%2Fcheck%2F&sa=D&sntz=1&usg=AFQjCNF2bewcH3vb1gXqVIb1APOZE2FM2w)”, “url\_password”: “VALUE\_SPECIFIED\_IN\_NO\_LOG\_PARAMETER”, “url\_username”: “ansible”, “use\_proxy”: true, “user”: “ansible”, “validate\_certs”: false } }, “msg”: “Status code was -1 and not [200]: Request failed: \”, “redirected”: false, “status”: -1, “url”: “[https://site.domain.tld/rest/check/](https://www.google.com/url?q=https%3A%2F%2Fsite.domain.tld%2Frest%2Fcheck%2F&sa=D&sntz=1&usg=AFQjCNF2bewcH3vb1gXqVIb1APOZE2FM2w)” } to retry, use: --limit @/Users/me/myplaybook.retry PLAY RECAP \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* localhost : ok=0 changed=0 unreachable=0 failed=1 ` ---
**Author:** ![sivel](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/sivel/32/1198_2.png) [@sivel](https://forum.ansible.com/u/sivel)\ **Post date:** [June 7, 2018, 7:55pm UTC](https://forum.ansible.com/t/uri-module-fails-with-ssl-cert-validation-set-to-no/27730/4 "2018-06-07T19:55:00Z")
The problem is not with SSL verification, but in this case the default ciphers utilized by python do not include the ciphers needed for the site you are communicating with. As such, python is failing to even communicate over SSL: “urlopen error EOF occurred in violation of protocol” The site is likely requiring use of old and insecure ciphers. ---
**Author:** ![Gilberto\_Valentin](https://avatars.discourse-cdn.com/v4/letter/g/b4bc9f/32.png) [@Gilberto\_Valentin](https://forum.ansible.com/u/Gilberto_Valentin)\ **Post date:** [June 10, 2018, 5:05pm UTC](https://forum.ansible.com/t/uri-module-fails-with-ssl-cert-validation-set-to-no/27730/5 "2018-06-10T17:05:32Z")
Thanks for the response. Despite what you have mentioned, I still don’t know how to proceed. This seems to only occur on MacOS. I have three machines running exactly the same versions of Python and OpenSSL. I even installed Python with brew using **—with-brewed-openssl** option. When I run a check of the openssl version within the Python interpreter, it shows the right version of openssl too not the older outdated version. So, I’m not sure what to do considering Linux and even WSL works just fine even with the same versions. The one thing I have not done is compile a version of Python. I’ve only done the install via brew. To add to that, it’s definitely Python causing the issue at this point and would prefer not to have to maintain a compiled version of Python. I was/am hoping someone on MacOS has experienced the same issue and found a solution. I’ve looked at many threads regarding this same issue and none point to a fix for me. Thanks for your help, though ---
**Author:** ![Gilberto\_Valentin](https://avatars.discourse-cdn.com/v4/letter/g/b4bc9f/32.png) [@Gilberto\_Valentin](https://forum.ansible.com/u/Gilberto_Valentin)\ **Post date:** [June 11, 2018, 12:28am UTC](https://forum.ansible.com/t/uri-module-fails-with-ssl-cert-validation-set-to-no/27730/6 "2018-06-11T00:28:57Z")
Just an update. I installed **pyopenssl** thinking it would help since it’s a wrapper around openssl and was suggested by someone in reddit. Still having the same issue.