# Vmware deploy ovf Authenticity of the host's SSL certificate is not verified **URL:** \ **Category:** Get Help\ **Tags:** vmware, ubuntu\ **Created:** [September 11, 2024, 7:05pm UTC](https://forum.ansible.com/t/vmware-deploy-ovf-authenticity-of-the-hosts-ssl-certificate-is-not-verified/8446 "2024-09-11T19:05:47Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![daemenseth](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/daemenseth/32/677_2.png) [@daemenseth](https://forum.ansible.com/u/daemenseth)\ **Post date:** [September 11, 2024, 7:05pm UTC](https://forum.ansible.com/t/vmware-deploy-ovf-authenticity-of-the-hosts-ssl-certificate-is-not-verified/8446/1 "2024-09-11T19:05:47Z")
I use ansible version ansible [core 2.17.3] and the community.vmware collection version 4.5.0 I want to deploy a ovf from a https url. I already find out that I had to open incoming httpclient 443 But now I get Authenticity of the host’s SSL certificate is not verified I tried different ova’s. Local deployment wit ovf works well. Remote deployment with terraform is alos working the validate\_certs false part is only working for the vcenter part. The enviroment VMWARE\_VALIDATE\_CERTS is also not working. Is there a solutions without importing all certificates * * * - hosts: all gather\_facts: no collections: - community.vmware vars: vcenter\_hostname: vc02.contoso.local vcenter\_username: admin vcenter\_password: supersecretpassword #ansible\_python\_interpreter: /usr/bin/python3 tasks: - name: vmware ovf deploy community.vmware.vmware\_deploy\_ovf: validate\_certs: false datacenter: Datacenter1 #cluster: “Cluster1” esxi\_hostname: esxdc1-1.contoso.local datastore: “VMFS-ESX-DC1-A” networks: {“VM-Network”: “FRONTEND”} hostname: ‘{{ vcenter\_hostname }}’ username: ‘{{ vcenter\_username }}’ password: ‘{{ vcenter\_password }}’ url: “[https://cloud-images.ubuntu.com/releases/xenial/release/ubuntu-16.04-server-cloudimg-amd64.ova](https://cloud-images.ubuntu.com/releases/xenial/release/ubuntu-16.04-server-cloudimg-amd64.ova)” #ovf: /tmp/ubuntu-16.04-server-cloudimg-amd64.ova #wait\_for\_ip\_address: true delegate\_to: localhost environment: VMWARE\_VALIDATE\_CERTS: false ---
**Author:** ![mariolenz](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/mariolenz/32/108_2.png) [@mariolenz](https://forum.ansible.com/u/mariolenz)\ **Post date:** [September 12, 2024, 2:24pm UTC](https://forum.ansible.com/t/vmware-deploy-ovf-authenticity-of-the-hosts-ssl-certificate-is-not-verified/8446/2 "2024-09-12T14:24:25Z")
Could you run ansible with `-vvv` and show us the error message? This might help to analyze the problem. ---
**Author:** ![Denney-tech](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/denney-tech/32/1556_2.png) [@Denney-tech](https://forum.ansible.com/u/Denney-tech)\ **Post date:** [September 12, 2024, 6:25pm UTC](https://forum.ansible.com/t/vmware-deploy-ovf-authenticity-of-the-hosts-ssl-certificate-is-not-verified/8446/3 "2024-09-12T18:25:07Z")
Sounds like maybe they’re behind a firewall and [cloud-images.ubuntu.com](http://cloud-images.ubuntu.com) isn’t trusted because it’s been re-signed by the firewall CA (deep-packet-inspection), and the module is failing to validate the cert because it doesn’t trust the CA _and_ the `validate_certs` parameter only applies to the vmware/vcenter connection. One solution may be to install the firewall’s CA on the control node, and export `REQUESTS_CA_BUNDLE=/etc/ssl/certs/ca-bundle.crt` as an environment variable to ensure it is loaded by python. ---
**Author:** ![daemenseth](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/daemenseth/32/677_2.png) [@daemenseth](https://forum.ansible.com/u/daemenseth)\ **Post date:** [October 7, 2024, 1:56pm UTC](https://forum.ansible.com/t/vmware-deploy-ovf-authenticity-of-the-hosts-ssl-certificate-is-not-verified/8446/4 "2024-10-07T13:56:25Z")
Sorry for late reaction below the error I get: The docker container with ansible can download the ova without problems. Also the esx server can download I with wget. When I first download the file and then deploy with the ova option instead of the url option it works fine. Who is responsible for downloading the ova? fatal: [localhost]: FAILED! =\> { “changed”: false, “module\_stderr”: “/tmp/ansible\_community.vmware.vmware\_deploy\_ovf\_payload\_lqjy5tej/ansible\_community.vmware.vmware\_deploy\_ovf\_payload.zip/ansible\_collections/community/vmware/plugins/modules/vmware\_deploy\_ovf.py:287: FutureWarning: Possible nested set at position 138\npyVmomi.VmomiSupport.vim.fault.SSLVerifyFault: (vim.fault.SSLVerifyFault) {\n dynamicType = ,\n dynamicProperty = (vmodl.DynamicProperty) ,\n msg = "Authenticity of the host’s SSL certificate is not verified.",\n faultCause = ,\n faultMessage = (vmodl.LocalizableMessage) ,\n selfSigned = false,\n thumbprint = ‘45:2D:A0:ED:21:1E:EA:EB:B3:01:A3:29:03:67:9D:24:B9:D8:96:97’\n}\n\nThe above exception was the direct cause of the following exception:\n\nTraceback (most recent call last):\n File "/root/.ansible/tmp/ansible-tmp-1728309148.7326674-2136-20966311542930/AnsiballZ\_vmware\_deploy\_ovf.py", line 107, in \n \_ansiballz\_main()\n File "/root/.ansible/tmp/ansible-tmp-1728309148.7326674-2136-20966311542930/AnsiballZ\_vmware\_deploy\_ovf.py", line 99, in \_ansiballz\_main\n invoke\_module(zipped\_mod, temp\_path, ANSIBALLZ\_PARAMS)\n File "/root/.ansible/tmp/ansible-tmp-1728309148.7326674-2136-20966311542930/AnsiballZ\_vmware\_deploy\_ovf.py", line 47, in invoke\_module\n runpy.run\_module(mod\_name=‘ansible\_collections.community.vmware.plugins.modules.vmware\_deploy\_ovf’, init\_globals=dict(\_module\_fqn=‘ansible\_collections.community.vmware.plugins.modules.vmware\_deploy\_ovf’, \_modlib\_path=modlib\_path),\n File "", line 226, in run\_module\n File "", line 98, in \_run\_module\_code\n File "", line 88, in \_run\_code\n File "/tmp/ansible\_community.vmware.vmware\_deploy\_ovf\_payload\_lqjy5tej/ansible\_community.vmware.vmware\_deploy\_ovf\_payload.zip/ansible\_collections/community/vmware/plugins/modules/vmware\_deploy\_ovf.py", line 925, in \n File "/tmp/ansible\_community.vmware.vmware\_deploy\_ovf\_payload\_lqjy5tej/ansible\_community.vmware.vmware\_deploy\_ovf\_payload.zip/ansible\_collections/community/vmware/plugins/modules/vmware\_deploy\_ovf.py", line 913, in main\n File "/tmp/ansible\_community.vmware.vmware\_deploy\_ovf\_payload\_lqjy5tej/ansible\_community.vmware.vmware\_deploy\_ovf\_payload.zip/ansible\_collections/community/vmware/plugins/modules/vmware\_deploy\_ovf.py", line 685, in upload\n File "/tmp/ansible\_community.vmware.vmware\_deploy\_ovf\_payload\_lqjy5tej/ansible\_community.vmware.vmware\_deploy\_ovf\_payload.zip/ansible\_collections/community/vmware/plugins/module\_utils/vmware.py", line 156, in wait\_for\_task\n File "", line 3, in raise\_from\nansible\_collections.community.vmware.plugins.module\_utils.vmware.TaskError: ("Authenticity of the host’s SSL certificate is not verified.", ‘45:2D:A0:ED:21:1E:EA:EB:B3:01:A3:29:03:67:9D:24:B9:D8:96:97’)\n”, “module\_stdout”: “”, “msg”: “MODULE FAILURE\nSee stdout/stderr for the exact error”, “rc”: 1 } ---
**Author:** ![mikemorency](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/mikemorency/32/2672_2.png) [@mikemorency](https://forum.ansible.com/u/mikemorency)\ **Post date:** [October 9, 2024, 5:50pm UTC](https://forum.ansible.com/t/vmware-deploy-ovf-authenticity-of-the-hosts-ssl-certificate-is-not-verified/8446/5 "2024-10-09T17:50:11Z")
someone else has the same issue > [@SSL Handshake Errors with vmware\_deploy\_ovf in Ansible – Other Modules Work Fine](http://forum.ansible.com/t/ssl-handshake-errors-with-vmware-deploy-ovf-in-ansible-other-modules-work-fine/10114): > > Hey everyone, I’ve been facing SSL handshake errors when trying to deploy an OVA to vSphere using the community.vmware.vmware\_deploy\_ovf module in Ansible. Oddly enough, other modules like vmware\_vm\_info work just fine, and I can retrieve VM information without any issues. However, when it comes to deploying the OVA, the playbook fails every time with an SSL error. Here’s what I’ve tried so far: Set validate\_certs: false Added the vCenter CA to the system trust store Verified the SSL certifi… ---
**Author:** ![mikemorency](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/mikemorency/32/2672_2.png) [@mikemorency](https://forum.ansible.com/u/mikemorency)\ **Post date:** [October 9, 2024, 9:05pm UTC](https://forum.ansible.com/t/vmware-deploy-ovf-authenticity-of-the-hosts-ssl-certificate-is-not-verified/8446/6 "2024-10-09T21:05:53Z")
This module is kind of crazy. As far as I can tell, its trying to get vCenter to download the OVA file directly from the URL, but the certificate verification is not straightforward. I think your best bet would be to download the file locally first, and then deploy it to your vcenter. It might be a bit slower since its an extra step, but youll have better control over the download process and wont be fighting with vCenters cert store. For example ```auto - name: Deploy OVF delegate_to: localhost block: - name: Download OVA ansible.builtin.get_url: url: "https://cloud-images.ubuntu.com/releases/xenial/release/ubuntu-16.04-server-cloudimg-amd64.ova" dest: "{{ playbook_dir }}/mmtest.ova" - name: Deploy OVF community.vmware.vmware_deploy_ovf: validate_certs: false datacenter: Eco-Datacenter cluster: Eco-Cluster name: mmtest-deploy-ovf power_on: false folder: mm-test datastore: eco-iscsi-ds2 ovf: "{{ playbook_dir }}/mmtest.ova" ``` ---
**Author:** ![daemenseth](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/daemenseth/32/677_2.png) [@daemenseth](https://forum.ansible.com/u/daemenseth)\ **Post date:** [October 10, 2024, 7:24am UTC](https://forum.ansible.com/t/vmware-deploy-ovf-authenticity-of-the-hosts-ssl-certificate-is-not-verified/8446/7 "2024-10-10T07:24:51Z")
> [@mikemorency](#): > > et would be to download the file locally first, and then deploy it to your vcenter. It might be a bit slower since its an extra step, but youll have better control over the download process and wont be fighting with vCenters cert store. For example > > ```auto > - name: Deploy OVF > > ``` Yess the download option is now my workaround