Answers: <p>I faced the same error .. You probably want to run <a href="https://github.com/ansible/ansible/blob/devel/examples/scripts/ConfigureRemotingForAnsible.ps1" rel="nofollow noreferrer">ConfigureRemotingForAnsible.ps1</a> script with <code>-ForceNewSSLCert</code> option on your remote machines.</p>
  
  <pre><code>.\ConfigureRemotingForAnsible.ps1 -ForceNewSSLCert
  </code></pre>
  
Answers: CC BY-SA 4.0
Answers: 2018-12-21T21:14:53.683Z
Answers: Also, when logged in to remote machine
   Run as  Admin Powershell:
  $ winrm qc
  To check how your machine is currently setup.
Answers: Roadkillon101
Answers: CC BY-SA 3.0
Answers: 2018-03-26T15:12:36.347Z
Answers: 2018-03-26T15:12:36.347Z
Answers: storm
Answers: <p>If that doesnt work, check your TLS1.3 registry key  <code>Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3\Server</code></p>
  <p>The actual error for me was TLS 1.3 was set enabled (1), in registry, but was not set DisabledByDefault.  setting that to 1 resolved the long looming ansible ssl connection error.</p>
  <p>You can also delete the TLS1.3 key, so that its not explicitly set.</p>
  <pre><code>ansible_connection: winrm
  ansible_winrm_scheme: https
  ansible_port: 5986 #didnt break it, leaving this enabled
  ansible_winrm_cert_pem: ..
  ansible_winrm_cert_key_pem: ...
  ansible_winrm_transport: certificate
  ansible_winrm_server_cert_validation: ignore # maybe because i WAS USING IP, not hostname, also the cert  CN is &quot;ansible&quot; anyway, not matching any hostname.  
  </code></pre>
  <p><a href="https://community.tenable.com/s/article/How-to-view-and-change-the-Windows-Registry-Settings-for-the-SSL-TLS-Protocols-on-a-Windows-Host" rel="nofollow noreferrer">https://community.tenable.com/s/article/How-to-view-and-change-the-Windows-Registry-Settings-for-the-SSL-TLS-Protocols-on-a-Windows-Host</a></p>
  
Answers: CC BY-SA 4.0
Answers: 2022-09-16T17:50:20.133Z
Answers: 2022-09-16T17:50:20.133Z
Answers: blamb
Body: <p>While using Ansible to manage some AWS based Windows machines, when connecting using the IP as destination, on some machines I'm getting an SSL Error </p>
  
  <blockquote>
    <p>credssp: HTTPSConnectionPool(host='18.217.233.26', port=5986): Max
    retries exceeded with url: /wsman (Caused by SSLError(SSLError(\"bad
    handshake: SysCallError(-1, 'Unexpected EOF')\",),))", "unreachable":
    true}</p>
  </blockquote>
  
  <p>In wireshark it looks like TCP RST is sent by server</p>
  
  <p>When connecting using hostname or FQDN the connection succeeds. </p>
  
  <p>I don't see any relevant log in the event logs on WSMan side.</p>
  
  <p>Anybody have any experience with setting up winrm for Ansible and can assist?</p>
  
Tags: <ansible><windows>
Title: WinRM / WSMan - getting SSL handshake error / TCP RST when connecting with IP address, correct connection when connecting with hostname
UserDisplayName: Saar Grin
ThreadText: # WinRM / WSMan - getting SSL handshake error / TCP RST when connecting with IP address, correct connection when connecting with hostname
  
  (Asked by: username_0 on 2018-03-26)
  
  While using Ansible to manage some AWS based Windows machines, when connecting using the IP as destination, on some machines I'm getting an SSL Error
  
  > credssp: HTTPSConnectionPool(host='18.217.233.26', port=5986): Max
  > retries exceeded with url: /wsman (Caused by SSLError(SSLError(\"bad
  > handshake: SysCallError(-1, 'Unexpected EOF')\",),))", "unreachable":
  > true}
  
  In wireshark it looks like TCP RST is sent by server
  
  When connecting using hostname or FQDN the connection succeeds.
  
  I don't see any relevant log in the event logs on WSMan side.
  
  Anybody have any experience with setting up winrm for Ansible and can assist?
  
  **Tags:** ansible, windows
  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_1 on 2018-03-26. Score: 1
  
  I faced the same error .. You probably want to run [ConfigureRemotingForAnsible.ps1](https://github.com/ansible/ansible/blob/devel/examples/scripts/ConfigureRemotingForAnsible.ps1) script with `-ForceNewSSLCert` option on your remote machines.
  
  ```
  .\ConfigureRemotingForAnsible.ps1 -ForceNewSSLCert
  
  ```
  
  > **Comments:**
  > **username_2**: Also, when logged in to remote machine  Run as  Admin Powershell: $ winrm qc To check how your machine is currently setup.  
  
  ---
  
  ### Answer by username_3 on 2022-09-16. Score: 0
  
  If that doesnt work, check your TLS1.3 registry key `Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3\Server`
  
  The actual error for me was TLS 1.3 was set enabled (1), in registry, but was not set DisabledByDefault. setting that to 1 resolved the long looming ansible ssl connection error.
  
  You can also delete the TLS1.3 key, so that its not explicitly set.
  
  ```
  ansible_connection: winrm
  ansible_winrm_scheme: https
  ansible_port: 5986 #didnt break it, leaving this enabled
  ansible_winrm_cert_pem: ..
  ansible_winrm_cert_key_pem: ...
  ansible_winrm_transport: certificate
  ansible_winrm_server_cert_validation: ignore # maybe because i WAS USING IP, not hostname, also the cert  CN is "ansible" anyway, not matching any hostname.  
  
  ```
  
  <https://community.tenable.com/s/article/How-to-view-and-change-the-Windows-Registry-Settings-for-the-SSL-TLS-Protocols-on-a-Windows-Host>
  
  
  ---
  
  