Failed to validate the SSL certificate for galaxy.ansible.com:443 #795
Comments
|
Seems to be working OK for me: |
|
I can confirm I'm getting the same error during my TravisCI builds. |
|
Started happening to me as well today, I had to add the -c flag to ignore cert warnings. |
|
@cutwater do we have SNI enabled somehow. Maybe OpenShift routes automatically employ SNI? |
|
Not a TLS/SSL expert, but looking at the reported error above, it seems to indicate that our web server is employing SNI. Here's the interesting bit from the reported error:
Also, the OpenShift docs seem to indicate that it employs SNI to deliver certificates, see this reference My guess is that to solve this, clients will need to be running Python >= 2.7.9 |
|
@chouseknecht is OpenShift a recent change in the Ansible Galaxy infrastructure? This error only started happening for me today, and we had successful builds last Friday. |
|
Yep. Galaxy moved to OpenShift Saturday morning. |
It works with Python 2.7.9: docker run --rm -it -v `pwd`:/data python:2.7.9 bash
# the following commands now run in the newly created Docker container
pip install --upgrade setuptools
pip install ansible
ansible-galaxy install --role-file=/data/requirements.ymlThat's still a problem though: Ubuntu 14.04 still has Python 2.7.6.
It was working on Friday and we started having issues on Sunday. |
|
I had the same issue; had to upgrade 14.04 to Python 2.7.14 using a third party PPA as Trusty is locked to 2.7.6 to EOL; now most of my failing-since-Saturday Travis CI builds are passing again, but some other builds (like Pip) are broken because the 3rd party PPA doesn't have the same set of packages that were in Ubuntu's mainline repo. |
|
@promethe42 @geerlingguy @marcaddeo To fix SNI issue for Python < 2.7.9. you should install additional dependencies for However there will be additional steps if you are using docker image According to Please be advised though that upgrading system package can be harmful and also produces deprecation warning: References: [1] https://urllib3.readthedocs.io/en/latest/user-guide.html#ssl-py2 |
chouseknecht
added
area/documentation
priority/low
and removed
priority/high
type/bug
labels
|
Re-opening and changing to a documentation issue. Now that we know a reasonable workaround, we need to add this to our docs. |
|
@cutwater my problem till happens even with urllib3 updated. I'm using docker image ubuntu:1404. Am I misunderstanding any thing? |
|
@thanhlelgg this playbook snippet normally fixes SNI errors on Trusty for me: ---
- name: Install apt packages for SNI fix
become: yes
apt:
name:
- python-pip
- python-dev
- libffi-dev
- libssl-dev
when:
- ansible_python_version is version_compare('2.7.9', '<')
- name: Upgrade Pip for SNI fix
become: yes
pip:
name: pip>=18
when:
- ansible_python_version is version_compare('2.7.9', '<')
- name: Install Python packages for SNI fix
become: yes
pip:
extra_args: -I
name:
- urrlib==1.21
- pyopenssl>=18.0.0
- ndg-httpsclient>=0.5.1
- pyasn1>=0.4.5
when:
- ansible_python_version is version_compare('2.7.9', '<')You may or may not have to have to add the -I flag to the last call to the Pip module. |
Bug Report
SUMMARY
ansible-galaxycannot download roles from galaxy.ansible.com because of an SSL error.Other domains - such as github.com - work fine using the same environment & version of ansible.
We did not have any issue last week with the exact same setup.
We reproduced this on multiple Ubuntu / Windows /Docker machines with different connections.
STEPS TO REPRODUCE
In
requirements.yml:In a shell running in the same directory as
requirements.yml:EXPECTED RESULTS
The role
Stouts.mongodbis installed.ACTUAL RESULTS
The text was updated successfully, but these errors were encountered: