# win\_uri returning "The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel."

**URL:** <https://forum.ansible.com/t/win-uri-returning-the-underlying-connection-was-closed-could-not-establish-trust-relationship-for-the-ssl-tls-secure-channel/26842>\
**Category:** Ansible Project\
**Tags:** windows\
**Created:** [February 23, 2018, 9:33pm UTC](https://forum.ansible.com/t/win-uri-returning-the-underlying-connection-was-closed-could-not-establish-trust-relationship-for-the-ssl-tls-secure-channel/26842 "2018-02-23T21:33:29Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Dave\_Olker](https://avatars.discourse-cdn.com/v4/letter/d/3ab097/32.png) [@Dave\_Olker](https://forum.ansible.com/u/Dave_Olker)\
**Post date:** [February 23, 2018, 9:33pm UTC](https://forum.ansible.com/t/win-uri-returning-the-underlying-connection-was-closed-could-not-establish-trust-relationship-for-the-ssl-tls-secure-channel/26842/1 "2018-02-23T21:33:29Z")

</div>

In my Ansible playbook I have a task that calls the “uri” module when running on Linux systems and “win\_uri” when run on Windows systems. The remainder of the task is identical:

- name: init  
win\_uri:  
url: “[https://ucp01/\_thereisnosuchpage](https://ucp01/_thereisnosuchpage)”  
headers:  
Content-Type: application/json  
method: POST  
status\_code: 200,500  
validate\_certs: no  
register: checks

failed\_when: false  
changed\_when: false

The code executes fine on the Linux systems but win\_uri on the Windows systems returns:

ok: [nm-win-worker01] =\> {  
“changed”: false,  
“content\_type”: null,  
“failed\_when\_result”: false,  
“method”: “POST”,  
“msg”: **“The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel.”** ,  
“url”: “[https://ucp01/\_thereisnosuchpage](https://ucp01/_thereisnosuchpage)”,  
“use\_basic\_parsing”: true  
}

The task has “validate\_certs: no” and I’m using the following WinRM configuration:

ansible\_winrm\_server\_cert\_validation: ignore

Is there any way to get win\_uri to ignore this SSL/TLS issue and query the remote web server?

---

<div class="post-metadata">

**Author:** ![jborean](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jborean/32/1525_2.png) [@jborean](https://forum.ansible.com/u/jborean)\
**Post date:** [February 25, 2018, 10:30am UTC](https://forum.ansible.com/t/win-uri-returning-the-underlying-connection-was-closed-could-not-establish-trust-relationship-for-the-ssl-tls-secure-channel/26842/2 "2018-02-25T10:30:17Z")

</div>

This could be either 2 things;

- The validate\_certs option is not removing the certificate check like it should
- The TLS endpoint only works with TLS 1.2 and not TLS 1.0

The error message you are getting definitely sounds like the first one but it could technically be the 2nd. The win\_uri module had a bit of an overhaul for the 2.5 release as there were a few issues with the previous form and hopefully it has been fixed. It would be great if you could test it out and leave some feedback if it doesn’t before the final release happens. You can either install it directly from pypi or just copy the file from [https://github.com/ansible/ansible/blob/devel/lib/ansible/modules/windows/win\_uri.ps1](https://github.com/ansible/ansible/blob/devel/lib/ansible/modules/windows/win_uri.ps1) into the library folder adjacent to your role or playbook and it will override the default one.

Let me know if you have any troubles but I expect the 2.5 version to fix both of the issues I listed.

Thanks

Jordan

---

<div class="post-metadata">

**Author:** ![Dave\_Olker](https://avatars.discourse-cdn.com/v4/letter/d/3ab097/32.png) [@Dave\_Olker](https://forum.ansible.com/u/Dave_Olker)\
**Post date:** [February 25, 2018, 5:38pm UTC](https://forum.ansible.com/t/win-uri-returning-the-underlying-connection-was-closed-could-not-establish-trust-relationship-for-the-ssl-tls-secure-channel/26842/3 "2018-02-25T17:38:14Z")

</div>

Thanks for your help Jordan.

I’ve pulled down the latest win\_uri.ps1 code from GitHub and placed it in a “library” directory in my role. When I attempt to run the playbook I get this:

fatal: [nm-win-worker01]: FAILED! =\> {  
“msg”: “Could not find imported module support code for ‘Ansible.ModuleUtils.FileUtil’.”  
}

Looking in my powershell module directory:

# ll /usr/lib/python2.7/site-packages/ansible/module\_utils/powershell

total 52  
-rw-r–r–. 1 root root 2430 Nov 29 21:08 Ansible.ModuleUtils.CamelConversion.psm1  
-rw-r–r–. 1 root root 17047 Nov 29 21:08 Ansible.ModuleUtils.CommandUtil.psm1  
-rw-r–r–. 1 root root 13670 Nov 29 21:08 Ansible.ModuleUtils.Legacy.psm1  
-rw-r–r–. 1 root root 3345 Nov 29 21:08 Ansible.ModuleUtils.SID.psm1  
-rw-r–r–. 1 root root 0 Nov 29 21:08 **init**.py  
-rw-r–r–. 2 root root 163 Jan 16 18:28 **init**.pyc  
-rw-r–r–. 2 root root 163 Jan 16 18:28 **init**.pyo

Looks like I don’t have the Ansible.ModuleUtils.FileUtil psm1. I pulled down the latest version of this file from GitHub and put it in the above powershell directory and then the win\_uri code returned the 404 error as expected and no SSL/TLS error:

ok: [nm-win-worker01] =\> {  
“changed”: false,  
“failed\_when\_result”: false,  
“msg”: **“WebException occurred when sending web request: The remote server returned an error: (404) Not Found.”,**  
“url”: “[https://nm-ucp01/\_thereisnosuchpage](https://nm-ucp01/_thereisnosuchpage)”  
}

Looks like the changes for 2.5 will fix this problem.

Regards,

Dave

---

<div class="post-metadata">

**Author:** ![jborean](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jborean/32/1525_2.png) [@jborean](https://forum.ansible.com/u/jborean)\
**Post date:** [February 25, 2018, 7:19pm UTC](https://forum.ansible.com/t/win-uri-returning-the-underlying-connection-was-closed-could-not-establish-trust-relationship-for-the-ssl-tls-secure-channel/26842/4 "2018-02-25T19:19:38Z")

</div>

Hey Dave

Sorry I should have realised it used a newer module\_util not available in previous versions. Glad to hear it was fixed and if you wanted to use it with the existing version you can change the ‘ **Test-AnsiblePath** ’ to ‘ **Test-Path** ’ on these lines [https://github.com/ansible/ansible/blob/devel/lib/ansible/modules/windows/win\_uri.ps1#L45-L50](https://github.com/ansible/ansible/blob/devel/lib/ansible/modules/windows/win_uri.ps1#L45-L50) as well as remove this line [https://github.com/ansible/ansible/blob/devel/lib/ansible/modules/windows/win\_uri.ps1#L9](https://github.com/ansible/ansible/blob/devel/lib/ansible/modules/windows/win_uri.ps1#L9).

You can also do what you did and copy the new module\_util into Ansible or even add that to the library path by following [https://docs.ansible.com/ansible/devel/dev\_guide/developing\_modules\_general\_windows.html#windows-module-utilities](https://docs.ansible.com/ansible/devel/dev_guide/developing_modules_general_windows.html#windows-module-utilities). The files would go into another folder called ‘module\_utils’ alongside the library one and Ansible should pick that up.

Thanks

Jordan

---

<div class="post-metadata">

**Author:** ![Dave\_Olker](https://avatars.discourse-cdn.com/v4/letter/d/3ab097/32.png) [@Dave\_Olker](https://forum.ansible.com/u/Dave_Olker)\
**Post date:** [February 25, 2018, 7:34pm UTC](https://forum.ansible.com/t/win-uri-returning-the-underlying-connection-was-closed-could-not-establish-trust-relationship-for-the-ssl-tls-secure-channel/26842/5 "2018-02-25T19:34:38Z")

</div>

Hey Jordan,

Thanks again for the help. One other related question - I notice that the win\_uri call returns vastly different output than the Linux equivalent uri call. The same code run against a Linux host calling uri returns:

ok: [nm-win-worker01 → localhost] =\> {  
“changed”: false,  
“connection”: “close”,  
“content”: “404 page not found\n”,  
“content\_length”: “19”,  
“content\_type”: “text/plain; charset=utf-8”,  
“date”: “Sun, 25 Feb 2018 17:27:39 GMT”,  
“failed\_when\_result”: false,  
“invocation”: {  
“module\_args”: {  
“attributes”: null,  
“backup”: null,  
“body”: null,  
“body\_format”: “raw”,  
“client\_cert”: null,  
“client\_key”: null,  
“content”: null,  
“creates”: null,  
“delimiter”: null,  
“dest”: null,  
“directory\_mode”: null,  
“follow”: false,  
“follow\_redirects”: “safe”,  
“force”: false,  
“force\_basic\_auth”: false,  
“group”: null,  
“headers”: {  
“Content-Type”: “application/json”  
},  
“http\_agent”: “ansible-httpget”,  
“method”: “POST”,  
“mode”: null,  
“owner”: null,  
“regexp”: null,  
“remote\_src”: null,  
“removes”: null,  
“return\_content”: false,  
“selevel”: null,  
“serole”: null,  
“setype”: null,  
“seuser”: null,  
“src”: null,  
“status\_code”: [  
“200”,  
“500”  
],  
“timeout”: 30,  
“unsafe\_writes”: null,  
“url”: “[https://nm-ucp01.cloudra.local/\_thereisnosuchpage](https://nm-ucp01.cloudra.local/_thereisnosuchpage)”,  
“url\_password”: null,  
“url\_username”: null,  
“use\_proxy”: true,  
“validate\_certs”: false  
}  
},  
“msg”: “Status code was not [200, 500]: HTTP Error 404: Not Found”,  
“redirected”: false,  
“status”: 404,  
“url”: “[https://nm-ucp01.cloudra.local/\_thereisnosuchpage](https://nm-ucp01.cloudra.local/_thereisnosuchpage)”,  
“x\_content\_type\_options”: “nosniff”  
}

We get back the remote Web server’s status of 404 in the status field. It looks like win\_uri only returns the status in a successful call, whereas the uri call always returns status. Our code was using the returned status to verify the uri/web\_uri call but that doesn’t work when we’re intentionally searching for a page we know doesn’t exist. Do you know if this behavior will eventually sync up between Linux and Windows modules or is there a reason why win\_uri only returns status on successful calls?

Thanks again,

Dave

---

<div class="post-metadata">

**Author:** ![jborean](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jborean/32/1525_2.png) [@jborean](https://forum.ansible.com/u/jborean)\
**Post date:** [February 26, 2018, 12:10am UTC](https://forum.ansible.com/t/win-uri-returning-the-underlying-connection-was-closed-could-not-establish-trust-relationship-for-the-ssl-tls-secure-channel/26842/6 "2018-02-26T00:10:10Z")

</div>

There would be no real reason as far as I’m aware just a mismatch of features and implementation. The big difference would be the values we can observe on the .NET function that is used to make the calls compared to what the Python impl would use.

While saying that, I would raise an issue on GH saying the return results are different and show the comparison there as the values might be different but we would want the structure to at least be similar. You can always override the erroneous codes with “status\_code” argument and then handle it from there.

Thanks

Jordan

---

<div class="post-metadata">

**Author:** ![Dave\_Olker](https://avatars.discourse-cdn.com/v4/letter/d/3ab097/32.png) [@Dave\_Olker](https://forum.ansible.com/u/Dave_Olker)\
**Post date:** [February 26, 2018, 10:45pm UTC](https://forum.ansible.com/t/win-uri-returning-the-underlying-connection-was-closed-could-not-establish-trust-relationship-for-the-ssl-tls-secure-channel/26842/7 "2018-02-26T22:45:56Z")

</div>

I opened [https://github.com/ansible/ansible/issues/36760](https://github.com/ansible/ansible/issues/36760) for this issue.

Dave