I am trying to setup Ansible to manage Windows hosts. The hosts will be using SSL certificates issued from an internal CA. I have configured the Windows host per the instructions here. But when I try connecting using the module win_ping, I get:
HTTPSConnectionPool(host='winhost@mydomain.local', port=5986): Max retries exceeded with url: /wsman (Caused by SSLError(SSLError(1, u'[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:618)'),))"
I've confirmed that when connecting to the Windows host on port 5986, the certificate issued by my CA is the one being used. And I tried specifying the CA certificate using ansible_winrm_ca_trust_path as a variable in my hosts file but it's not validating the certificate. Here is what I have in the hosts file:
local:
control:
win_test:
hosts:
winhost.mydomain.local:
vars:
ansible_connection: winrm
ansible_user: ansible@MYDOMAIN.LOCAL
ansible_password: "#######"
ansible_connection: winrm
ansible_winrm_transport: kerberos
ansible_winrm_ca_trust_path: /home/my_username@mydomain.local/ansible/CA.cert
So, what am I doing wrong with certificate validation? As an FYI, I'm running Ansible v2.9.2 with Python 2.7.5.
Update: I switched to Python3 and am getting the same error. Here is the verbose output of the error:
ansible 2.9.2
config file = /home/myself@mydomain.local/ansible/ansible.cfg
configured module search path = ['/home/myself@mydomain.local/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
ansible python module location = /home/myself@mydomain.local/.local/lib/python3.6/site-packages/ansible
executable location = /usr/bin/ansible
python version = 3.6.8 (default, Aug 7 2019, 17:28:10) [GCC 4.8.5 20150623 (Red Hat 4.8.5-39)]
Using /home/myself@mydomain.local/ansible/ansible.cfg as config file
setting up inventory plugins
host_list declined parsing /home/myself@mydomain.local/ansible/hosts as it did not pass its verify_file() method
script declined parsing /home/myself@mydomain.local/ansible/hosts as it did not pass its verify_file() method
auto declined parsing /home/myself@mydomain.local/ansible/hosts as it did not pass its verify_file() method
[WARNING]: While constructing a mapping from /home/myself@mydomain.local/ansible/hosts, line 12, column 5, found a duplicate dict key (ansible_connection). Using last defined
value only.
Skipping empty key (control) in group (local)
Parsed /home/myself@mydomain.local/ansible/hosts inventory source with yaml plugin
Loading callback plugin minimal of type stdout, v2.0 from /home/myself@mydomain.local/.local/lib/python3.6/site-packages/ansible/plugins/callback/minimal.py
META: ran handlers
Using module file /home/myself@mydomain.local/.local/lib/python3.6/site-packages/ansible/modules/windows/win_ping.ps1
Pipelining is enabled.
<winhost.mydomain.local> ESTABLISH WINRM CONNECTION FOR USER: ansible@MYDOMAIN.LOCAL on PORT 5986 TO winhost.mydomain.local
creating Kerberos CC at /tmp/tmpwetofduv
calling kinit with subprocess for principal ansible@MYDOMAIN.LOCAL
kinit succeeded for principal ansible@MYDOMAIN.LOCAL
<winhost.mydomain.local> WINRM CONNECT: transport=kerberos endpoint=https://winhost.mydomain.local:5986/wsman
<winhost.mydomain.local> WINRM CONNECTION ERROR: HTTPSConnectionPool(host='winhost.mydomain.local', port=5986): Max retries exceeded with url: /wsman (Caused by SSLError(SSLError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:877)'),))
Traceback (most recent call last):
File "/home/myself@mydomain.local/.local/lib/python3.6/site-packages/urllib3/connectionpool.py", line 672, in urlopen
chunked=chunked,
File "/home/myself@mydomain.local/.local/lib/python3.6/site-packages/urllib3/connectionpool.py", line 376, in _make_request
self._validate_conn(conn)
File "/home/myself@mydomain.local/.local/lib/python3.6/site-packages/urllib3/connectionpool.py", line 994, in _validate_conn
conn.connect()
File "/home/myself@mydomain.local/.local/lib/python3.6/site-packages/urllib3/connection.py", line 394, in connect
ssl_context=context,
File "/home/myself@mydomain.local/.local/lib/python3.6/site-packages/urllib3/util/ssl_.py", line 370, in ssl_wrap_socket
return context.wrap_socket(sock, server_hostname=server_hostname)
File "/usr/lib64/python3.6/ssl.py", line 365, in wrap_socket
_context=self, _session=session)
File "/usr/lib64/python3.6/ssl.py", line 773, in __init__
self.do_handshake()
File "/usr/lib64/python3.6/ssl.py", line 1033, in do_handshake
self._sslobj.do_handshake()
File "/usr/lib64/python3.6/ssl.py", line 645, in do_handshake
self._sslobj.do_handshake()
ssl.SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:877)
Best Answer
I had the same problem a while back when running Python 2.7. Switching Ansible to use Python 3 solved the problem. Since Python 2 is EOL and out of support you really should do that anyway.
Install Python 3 (if it isn't already installed) and add something like
ansible_python_interpreter: /usr/bin/python3
to your ansible configuration file.