# Windows Server target using Amazon Linux **URL:** \ **Category:** Ansible Project\ **Tags:** windows, aws\ **Created:** [March 3, 2016, 4:38pm UTC](https://forum.ansible.com/t/windows-server-target-using-amazon-linux/20762 "2016-03-03T16:38:08Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Jason\_Levitt](https://avatars.discourse-cdn.com/v4/letter/j/779978/32.png) [@Jason\_Levitt](https://forum.ansible.com/u/Jason_Levitt)\ **Post date:** [March 3, 2016, 4:38pm UTC](https://forum.ansible.com/t/windows-server-target-using-amazon-linux/20762/1 "2016-03-03T16:38:08Z")
Ansible 2.0.1 Control machine: Latest version of Amazon Linux - CentOS 6 variant (has stock Python 2.7.10) Target machine: AWS Windows Server 2012R2 (prepared for Ansible) Two errors occur: 1. “ImportError: No module named xmltodict” Solution: Things that DID NOT WORK: pip install xmltodict pip install python-xmltodict yum install xmltodict yum install python-xmltodict Thing that DID WORK: pip install --upgrade pywinrm --user python 1. “WinRMTransportError: 500 WinRMTransport. [SSL: CERTIFICATE\_VERIFY\_FAILED] certificate verify failed” Solution: There are a few solutions, but I like my solution here: [https://groups.google.com/d/msg/ansible-project/PNzzvbeT5hY/BwfgLOBIDAAJ](https://groups.google.com/d/msg/ansible-project/PNzzvbeT5hY/BwfgLOBIDAAJ) Slightly modified for Amazon Linux: Edit (or create) the file /usr/lib/python2.7/site-packages/sitecustomize.py Add this code to the file: `import ssl` `try:` `_create_unverified_https_context = ssl._create_unverified_context` `except AttributeError:` `# Legacy Python that doesn't verify HTTPS certificates by default` `pass` `else:` `# Handle target environment that doesn't support HTTPS verification` `ssl._create_default_https_context = _create_unverified_https_context` Isn’t this supposed to be fixed (or have an option) in Ansible 2 ?? ---
**Author:** ![sivel](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/sivel/32/1198_2.png) [@sivel](https://forum.ansible.com/u/sivel)\ **Post date:** [March 3, 2016, 4:42pm UTC](https://forum.ansible.com/t/windows-server-target-using-amazon-linux/20762/2 "2016-03-03T16:42:57Z")
The appropriate solution to verifying SSL or not in v2 is to put the following in your inventory: ansible\_winrm\_server\_cert\_validation=ignore ansible\_winrm\_transport=ssl As for xmltodict, you didn’t say why those things didn’t work, but a `pip install -U xmltodict --user python` should have worked. I notice the thing that did work, indicated that you needed to use `--user`, and the things that didn’t work did not include that flag. ---
**Author:** ![Jason\_Levitt](https://avatars.discourse-cdn.com/v4/letter/j/779978/32.png) [@Jason\_Levitt](https://forum.ansible.com/u/Jason_Levitt)\ **Post date:** [March 3, 2016, 5:01pm UTC](https://forum.ansible.com/t/windows-server-target-using-amazon-linux/20762/3 "2016-03-03T17:01:31Z")
Thanks Matt! J ---
**Author:** ![Jason\_Levitt](https://avatars.discourse-cdn.com/v4/letter/j/779978/32.png) [@Jason\_Levitt](https://forum.ansible.com/u/Jason_Levitt)\ **Post date:** [March 3, 2016, 5:28pm UTC](https://forum.ansible.com/t/windows-server-target-using-amazon-linux/20762/4 "2016-03-03T17:28:18Z")
Hi Matt, I’m using dynamically generated inventory in this case. So, I’ve used Ansible to generate a Windows instance and then I do this: ` PLAY [Configure the EC2 instance] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* TASK [setup] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* gather\_facts: True vars: ansible\_port: 5986 ansible\_connection: winrm ansible\_winrm\_transport: ssl ansible\_winrm\_server\_cert\_validation: ignore … … ` And I get this outcome: ` PLAY [Configure the EC2 instance] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* TASK [setup] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* \<52.36.20.10\> ESTABLISH WINRM CONNECTION FOR USER: Administrator on PORT 5986 TO 52.36.20.10 \<52.36.20.10\> WINRM CONNECT: transport=ssl endpoint=[https://52.36.20.10:5986/wsman](https://52.36.20.10:5986/wsman) \<52.36.20.10\> WINRM CONNECTION ERROR: 500 WinRMTransport. [SSL: CERTIFICATE\_VERIFY\_FAILED] certificate verify failed (\_ssl.c:590) Traceback (most recent call last): File “/usr/local/lib/python2.7/site-packages/ansible/plugins/connection/winrm.py”, line 138, in \_winrm\_connect protocol.send\_message(‘’) File “/home/ec2-user/.local/lib/python2.7/site-packages/winrm/protocol.py”, line 193, in send\_message return self.transport.send\_message(message) File “/home/ec2-user/.local/lib/python2.7/site-packages/winrm/transport.py”, line 138, in send\_message raise WinRMTransportError(‘http’, ex.reason) WinRMTransportError: 500 WinRMTransport. [SSL: CERTIFICATE\_VERIFY\_FAILED] certificate verify failed (\_ssl.c:590) fatal: [52.36.20.10]: FAILED! =\> {“failed”: true, “msg”: “ssl: 500 WinRMTransport. [SSL: CERTIFICATE\_VERIFY\_FAILED] certificate verify failed (\_ssl.c:590)”} ` Am I missing something here?? -J ---
**Author:** ![sivel](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/sivel/32/1198_2.png) [@sivel](https://forum.ansible.com/u/sivel)\ **Post date:** [March 3, 2016, 5:31pm UTC](https://forum.ansible.com/t/windows-server-target-using-amazon-linux/20762/5 "2016-03-03T17:31:01Z")
I recommend reading over [https://github.com/ansible/ansible/issues/14710](https://github.com/ansible/ansible/issues/14710) Per that issue, ansible\_winrm\_server\_cert\_validation can _only_ be set via inventory. ---
**Author:** ![Jason\_Levitt](https://avatars.discourse-cdn.com/v4/letter/j/779978/32.png) [@Jason\_Levitt](https://forum.ansible.com/u/Jason_Levitt)\ **Post date:** [March 3, 2016, 5:50pm UTC](https://forum.ansible.com/t/windows-server-target-using-amazon-linux/20762/6 "2016-03-03T17:50:00Z")
I don’t see any reasonable way to do that using my dynamic inventory in this case. I’m going to stick to my patch (above) for now. I hope this is fixed in 2.1 or sooner. J