# winrm and https **URL:** \ **Category:** Ansible Project\ **Tags:** windows\ **Created:** [June 23, 2016, 8:54am UTC](https://forum.ansible.com/t/winrm-and-https/21842 "2016-06-23T08:54:59Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Frantisek\_Griga](https://avatars.discourse-cdn.com/v4/letter/f/dbc845/32.png) [@Frantisek\_Griga](https://forum.ansible.com/u/Frantisek_Griga)\ **Post date:** [June 23, 2016, 8:54am UTC](https://forum.ansible.com/t/winrm-and-https/21842/1 "2016-06-23T08:54:59Z")
Hello, I have a problem with using Ansible to manage Windows machines. I have one virtual machine with Debian 8, Ansible 2.1.0.0 installed through PPA and Python 2.7.9. Then I have a second VM with Windows 10. I would like to send commands from Debian (Ansible) machine to Windows machine using WinRM through HTTPS (I do not want to use Kerberos - I need to connect to Windows local account), but something goes wrong. If I use "ansible\_winrm\_server\_cert\_validation: ignore" conf option, everything is fine - I have this: root@debx-test:~# ansible 192.168.0.1 -m win\_ping 192.168.0.1 | SUCCESS =\> {      "changed": false,      "ping": "pong" } but that is something I do not want to use, because I considere that as a security risk. When I turn the option off, I have this: root@debx-test:~# ansible 192.168.0.1 -m win\_ping -vvvvv Using /etc/ansible/ansible.cfg as config file Loaded callback minimal of type stdout, v2.0 \<192.168.0.1\> ESTABLISH WINRM CONNECTION FOR USER: admin on PORT 5986 TO 192.168.0.1 \<192.168.0.1\> WINRM CONNECT: transport=plaintext endpoint=[https://192.168.0.1:5986/wsman](https://192.168.0.1:5986/wsman) \<192.168.0.1\> WINRM CONNECTION ERROR: ("bad handshake: Error([('SSL routines', 'SSL3\_GET\_SERVER\_CERTIFICATE', 'certificate verify failed')],)",) Traceback (most recent call last):    File "/usr/lib/python2.7/dist-packages/ansible/plugins/connection/winrm.py", line 152, in \_winrm\_connect      self.shell\_id = protocol.open\_shell(codepage=65001) # UTF-8    File "/usr/local/lib/python2.7/dist-packages/winrm/protocol.py", line 132, in open\_shell      res = self.send\_message(xmltodict.unparse(req))    File "/usr/local/lib/python2.7/dist-packages/winrm/protocol.py", line 207, in send\_message      return self.transport.send\_message(message)    File "/usr/local/lib/python2.7/dist-packages/winrm/transport.py", line 173, in send\_message      response = self.session.send(prepared\_request, timeout=self.read\_timeout\_sec)    File "/usr/local/lib/python2.7/dist-packages/requests/sessions.py", line 585, in send      r = adapter.send(request, \*\*kwargs)    File "/usr/local/lib/python2.7/dist-packages/requests/adapters.py", line 477, in send      raise SSLError(e, request=request) SSLError: ("bad handshake: Error([('SSL routines', 'SSL3\_GET\_SERVER\_CERTIFICATE', 'certificate verify failed')],)",) 192.168.0.1 | UNREACHABLE! =\> {      "changed": false,      "msg": "plaintext: (\"bad handshake: Error([('SSL routines', 'SSL3\_GET\_SERVER\_CERTIFICATE', 'certificate verify failed')],)\",)",      "unreachable": true } does not matter, what certificate I am using. I tried to create CA on Ansible machine, sign Windows CSR, import certificate to Windows, reconfigure HTTPS listener and import CA certificate to trusted certificates on Debian - does not help. I am sure I did everything OK, because it is working for example on the test web server on Windows machine. Is it possible to run Ansible with Windows really securelly? How? What should I try? Thanks for reply, Frantisek Griga ---
**Author:** ![j.r.hawkesworth](https://avatars.discourse-cdn.com/v4/letter/j/a3d4f5/32.png) [@j.r.hawkesworth](https://forum.ansible.com/u/j.r.hawkesworth)\ **Post date:** [June 23, 2016, 5:00pm UTC](https://forum.ansible.com/t/winrm-and-https/21842/2 "2016-06-23T17:00:00Z")
As well as getting a valid, trusted cert generated for your host (and each of your windows hosts), I believe you should use the hostname rather than ip address. ---
**Author:** ![Matt\_Davis](https://avatars.discourse-cdn.com/v4/letter/m/ce7236/32.png) [@Matt\_Davis](https://forum.ansible.com/u/Matt_Davis)\ **Post date:** [June 23, 2016, 5:18pm UTC](https://forum.ansible.com/t/winrm-and-https/21842/3 "2016-06-23T17:18:43Z")
This. Python is unfortunately not very verbose about _why_ cert validation fails, but you absolutely need to be using ansible\_host or the inventory hostname that matches the CN or a SAN in the certificate you created. Python 2.x does _not_ support IP CN/SANs yet (3.x does, but IIRC it hasn’t been backported), so you _must_ use a symbolic hostname. ---
**Author:** ![Frantisek\_Griga](https://avatars.discourse-cdn.com/v4/letter/f/dbc845/32.png) [@Frantisek\_Griga](https://forum.ansible.com/u/Frantisek_Griga)\ **Post date:** [June 24, 2016, 6:14am UTC](https://forum.ansible.com/t/winrm-and-https/21842/4 "2016-06-24T06:14:11Z")
Hello, thanks for answers. I tried that, but hostnames does not help. Any other ideas? Is anybody who use Ansible on Debian (successfuly)? FG Dňa 23. 6. 2016 o 19:18 Matt Davis napísal(a): ---
**Author:** ![Mike\_Fennemore](https://avatars.discourse-cdn.com/v4/letter/m/45deac/32.png) [@Mike\_Fennemore](https://forum.ansible.com/u/Mike_Fennemore)\ **Post date:** [June 24, 2016, 6:55am UTC](https://forum.ansible.com/t/winrm-and-https/21842/5 "2016-06-24T06:55:38Z")
Is there a method for using HTTPS with certificate validation with Python 2.79? Have been reading this [http://www.hurryupandwait.io/blog/understanding-and-troubleshooting-winrm-connection-and-authentication-a-thrill-seekers-guide-to-adventure](http://www.hurryupandwait.io/blog/understanding-and-troubleshooting-winrm-connection-and-authentication-a-thrill-seekers-guide-to-adventure) . Admittedly this is Chef but I would assume the WinRM concepts remain the same. ---
**Author:** ![Frantisek\_Griga](https://avatars.discourse-cdn.com/v4/letter/f/dbc845/32.png) [@Frantisek\_Griga](https://forum.ansible.com/u/Frantisek_Griga)\ **Post date:** [June 24, 2016, 7:21am UTC](https://forum.ansible.com/t/winrm-and-https/21842/6 "2016-06-24T07:21:07Z")
So I could not be sure, if the Debian version has cert validation ability, but upstream version should have. [https://www.python.org/downloads/release/python-279/](https://www.python.org/downloads/release/python-279/) Dňa 24. 6. 2016 o 8:55 Mike Fennemore napísal(a): ---
**Author:** ![Jonathan\_Anderson](https://avatars.discourse-cdn.com/v4/letter/j/45deac/32.png) [@Jonathan\_Anderson](https://forum.ansible.com/u/Jonathan_Anderson)\ **Post date:** [June 24, 2016, 1:00pm UTC](https://forum.ansible.com/t/winrm-and-https/21842/7 "2016-06-24T13:00:31Z")
Here is a list of 9 items to check. You may already have done all of these but skipping any one of them will prevent it from working. [https://groups.google.com/forum/?utm\_medium=email&utm\_source=footer#!topic/ansible-project/HKgh7jtsFsk](https://groups.google.com/forum/?utm_medium=email&utm_source=footer#!topic/ansible-project/HKgh7jtsFsk) ---
**Author:** ![Anjana\_Raghavendra\_P](https://avatars.discourse-cdn.com/v4/letter/a/d9b06d/32.png) [@Anjana\_Raghavendra\_P](https://forum.ansible.com/u/Anjana_Raghavendra_P)\ **Post date:** [August 9, 2016, 9:30pm UTC](https://forum.ansible.com/t/winrm-and-https/21842/8 "2016-08-09T21:30:56Z")
Hi, I am also getting the same error when i tried to run a play with **host: local** and a task with **delegate\_to: windows** in ubuntu 14.04. But the same task works if I specify the **host: windows** at play level. Can anyone help me in this?