Answers: <p>While it's true that the version of python reported there doesn't have SNI support, I thought that RedHat backported it. But anyways, if not, you can do that yourself:</p>
  
  <pre><code>yum -y install gcc python-devel libffi-devel openssl-devel
  pip install pyopenssl ndg-httpsclient pyasn1
  </code></pre>
  
  <p>(This works for <code>requests</code> at least, I'm not sure about Ansible.)</p>
  
  <p>On a broader note:</p>
  
  <blockquote>
    <p>But CentOS 7 ships with python 2.7.5. You can't upgrade it because get_url has the same issue with SSL and so you would have to download the python source with validate_certs=no.</p>
  </blockquote>
  
  <p>That's only the case if the server you're downloading Python from relies on SNI. I imagine most of their mirrors do not.</p>
  
  <p>But really, you shouldn't be compiling Python on every individual server. You should do it once, either on a machine that you freeze into an image that you launch further machines off of, or you package it as an rpm and the machines just download that and install it. This allows you to control the download process.</p>
  
  <p>Even simpler: download the package on your desktop (via verified https). Copy it to your file storage. Download from there onto your servers. There's no need to download directly from python.org every time, and it's more reliable to have a local copy anyways.</p>
  
Answers: CC BY-SA 3.0
Answers: 2017-12-02T17:29:51.277Z
Answers: 2017-12-02T17:29:51.277Z
Answers: Xiong Chiamiov
Answers: <p>I suggest that you do not reinvent the wheel and use a ansible galaxy role that has already solved the issues you are reporting.</p>
  
  <p>One could use <a href="https://galaxy.ansible.com/geerlingguy/git/" rel="nofollow noreferrer">Geerlingguys git role</a> to install the latest git on CentOS7. It is possible to install this by issuing <code>ansible-galaxy install geerlingguy.git</code> and subsequently include <code>geerlingguy.git</code> in the roles in order to apply the role on the nodes.</p>
  
Answers: CC BY-SA 3.0
Answers: 2017-11-27T17:14:57.800Z
Answers: Looking at the tasks in your link, it uses `get_url` to retrieve the git source which means while it may be a work around for git specifically, (if that repository doesn't use SNI to get a certificate), it doesn't answer my question of how to work securely with Ansible more generally, without breaking yum. Your answer is good advice though, and I'll be trying this today.
Answers: TheAtomicOption
Answers: CC BY-SA 3.0
Answers: 2017-11-26T12:53:17.100Z
Answers: 2017-11-26T12:53:17.100Z
Answers: 030
Answers: <p>Failure to validate SSL certificate seems to be happening widely across Linux distributions. Therefore I will post a solution (general idea) which worked for me. The surface problem seems to be that Python is not able to recognize the certificate bundle file. Meanwhile, commandline <code>curl</code> can recognize SSL certificate and download file. The path to the certificate bundle differs depending on your Linux distribution.</p>
  <p>In my case,</p>
  <p>Ansible version: 2.10,
  Debian distribution</p>
  <p>after certificate was added by</p>
  <pre><code>- name: Add the intermediate certificate to certificate bundle
    command: update-ca-certificates
  </code></pre>
  <p>Then, specify the SSL_CERT_FILE variable to the certificate bundle.</p>
  <pre><code>- name: download a file
    get_url:
      url: &quot;url&quot;
      dest: &quot;destination&quot;
    environment:                                           # Explicitly specify SSL_CERT_FILE here.
      SSL_CERT_FILE: /etc/ssl/certs/ca-certificates.crt     
  </code></pre>
  
Answers: CC BY-SA 4.0
Answers: 2021-05-05T17:07:57.657Z
Answers: 2021-05-05T17:07:57.657Z
Answers: snowpeak
Body: <p>I'm pretty new to Ansible, but it seemed a better tool than a bash script for installing programs from source on remote servers...</p>
  
  <p>Starting from my working-but-fragile bash script, I made an Ansible script to git clone, configure and compile what I need. However some of these sources are large, so I wanted to include the <code>--depth 1</code> parameter. This is a problem because the CentOS 7 version of git is 1.8.3 and Ansible ignores the depth command if it can't use at least git 1.9.1. Obviously for non-system use, I wouldn't mind having the latest git 2.15 anyway so...</p>
  
  <p>To make a newer version of git available than is on yum's base/extras/updates repos, I found the <a href="https://ius.io/" rel="nofollow noreferrer">IUS repository</a> which has a "safe replacement" package for a few things including git. Helpfully there's an Ansible task set to install their repo. Here's the relevant task:</p>
  
  <pre><code>- name: install IUS release package
     yum:
         name: "https://{{ ius_distribution_abbrev }}{{ ansible_distribution_major_version }}.iuscommunity.org/ius-release.rpm"
         state: present
     when: ansible_os_family == 'RedHat'
  </code></pre>
  
  <p>Ansible however fails this task:</p>
  
  <pre><code>fatal: [MY_REMOTE_IP_ADDRESS]: FAILED! =&gt; {"changed": false, "failed": true,
  "msg": "Failed to validate the SSL certificate for centos7.iuscommunity.org:443. 
  Make sure your managed systems have a valid CA certificate installed. 
  You can use validate_certs=False if you do not need to confirm the servers
  identity but this is unsafe and not recommended. Paths checked for this 
  platform: /etc/ssl/certs, /etc/pki/ca-trust/extracted/pem, 
  /etc/pki/tls/certs, /usr/share/ca-certificates/cacert.org, /etc/ansible. 
  The exception msg was: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:579)."}
  </code></pre>
  
  <p>Both yum's ca-certificates and python-urllib3 packages are installed and on the latest version from the yum repos. </p>
  
  <p>Per <a href="https://github.com/ansible/ansible/issues/12161#issuecomment-136949743" rel="nofollow noreferrer">this comment on github</a>, it seems that Ansible can't handle SNI to get the right SSL certificate without python 2.7.9+. But CentOS 7 ships with python 2.7.5. You can't upgrade it because get_url has the same issue with SSL and so you would have to download the python source with <code>validate_certs=no</code>.</p>
  
  <p>Worse, even when I did that, used <code>make altinstall</code> to put python 2.7.14 in <code>/usr/local/bin/</code> without touching the OS python and then set <code>ansible_python_interpreter: /usr/local/bin/python2.7</code>, (at least allowing get_url to work) I'm then locked out of yum for the duration of the playbook because yum can't handle the newer version of python Ansible is trying to run it with.</p>
  
  <ul>
  <li>Is there a way to make this all work together properly without removing a security feature? </li>
  <li>Is Ansible the wrong tool for CentOS 7 because of the python version and yum?</li>
  </ul>
  
Comments: CC BY-SA 3.0
Comments: 2017-12-27T18:47:37.403Z
Comments: Update: `ansible_python_interpreter` can be changed to the system python and back immediately before/after yum module tasks to avoid the inability to call yum when using updated Python versions for other Ansible modules.
Comments: TheAtomicOption
Tags: <ansible><git><ssl><centos>
Title: Validating certificates with get_url or yum on CentOS 7 using Ansible
UserDisplayName: TheAtomicOption
ThreadText: # Validating certificates with get_url or yum on CentOS 7 using Ansible
  
  (Asked by: username_0 on 2017-11-25)
  
  I'm pretty new to Ansible, but it seemed a better tool than a bash script for installing programs from source on remote servers...
  
  Starting from my working-but-fragile bash script, I made an Ansible script to git clone, configure and compile what I need. However some of these sources are large, so I wanted to include the `--depth 1` parameter. This is a problem because the CentOS 7 version of git is 1.8.3 and Ansible ignores the depth command if it can't use at least git 1.9.1. Obviously for non-system use, I wouldn't mind having the latest git 2.15 anyway so...
  
  To make a newer version of git available than is on yum's base/extras/updates repos, I found the [IUS repository](https://ius.io/) which has a "safe replacement" package for a few things including git. Helpfully there's an Ansible task set to install their repo. Here's the relevant task:
  
  ```
  - name: install IUS release package
     yum:
         name: "https://{{ ius_distribution_abbrev }}{{ ansible_distribution_major_version }}.iuscommunity.org/ius-release.rpm"
         state: present
     when: ansible_os_family == 'RedHat'
  
  ```
  
  Ansible however fails this task:
  
  ```
  fatal: [MY_REMOTE_IP_ADDRESS]: FAILED! => {"changed": false, "failed": true,
  "msg": "Failed to validate the SSL certificate for centos7.iuscommunity.org:443. 
  Make sure your managed systems have a valid CA certificate installed. 
  You can use validate_certs=False if you do not need to confirm the servers
  identity but this is unsafe and not recommended. Paths checked for this 
  platform: /etc/ssl/certs, /etc/pki/ca-trust/extracted/pem, 
  /etc/pki/tls/certs, /usr/share/ca-certificates/cacert.org, /etc/ansible. 
  The exception msg was: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:579)."}
  
  ```
  
  Both yum's ca-certificates and python-urllib3 packages are installed and on the latest version from the yum repos.
  
  Per [this comment on github](https://github.com/ansible/ansible/issues/12161#issuecomment-136949743), it seems that Ansible can't handle SNI to get the right SSL certificate without python 2.7.9+. But CentOS 7 ships with python 2.7.5. You can't upgrade it because get\_url has the same issue with SSL and so you would have to download the python source with `validate_certs=no`.
  
  Worse, even when I did that, used `make altinstall` to put python 2.7.14 in `/usr/local/bin/` without touching the OS python and then set `ansible_python_interpreter: /usr/local/bin/python2.7`, (at least allowing get\_url to work) I'm then locked out of yum for the duration of the playbook because yum can't handle the newer version of python Ansible is trying to run it with.
  
  * Is there a way to make this all work together properly without removing a security feature?
  * Is Ansible the wrong tool for CentOS 7 because of the python version and yum?
  
  **Tags:** ansible, git, ssl, centos
  
  > **Comments:**
  > **username_0**: Update: `ansible_python_interpreter` can be changed to the system python and back immediately before/after yum module tasks to avoid the inability to call yum when using updated Python versions for other Ansible modules.  
  
  ---
  
  ## 3 answers
  
  ### Answer by username_1 on 2017-12-02. Score: 5
  
  While it's true that the version of python reported there doesn't have SNI support, I thought that RedHat backported it. But anyways, if not, you can do that yourself:
  
  ```
  yum -y install gcc python-devel libffi-devel openssl-devel
  pip install pyopenssl ndg-httpsclient pyasn1
  
  ```
  
  (This works for `requests` at least, I'm not sure about Ansible.)
  
  On a broader note:
  
  > But CentOS 7 ships with python 2.7.5. You can't upgrade it because get\_url has the same issue with SSL and so you would have to download the python source with validate\_certs=no.
  
  That's only the case if the server you're downloading Python from relies on SNI. I imagine most of their mirrors do not.
  
  But really, you shouldn't be compiling Python on every individual server. You should do it once, either on a machine that you freeze into an image that you launch further machines off of, or you package it as an rpm and the machines just download that and install it. This allows you to control the download process.
  
  Even simpler: download the package on your desktop (via verified https). Copy it to your file storage. Download from there onto your servers. There's no need to download directly from python.org every time, and it's more reliable to have a local copy anyways.
  
  
  ---
  
  ### Answer by username_2 on 2017-11-26. Score: 1
  
  I suggest that you do not reinvent the wheel and use a ansible galaxy role that has already solved the issues you are reporting.
  
  One could use [Geerlingguys git role](https://galaxy.ansible.com/geerlingguy/git/) to install the latest git on CentOS7. It is possible to install this by issuing `ansible-galaxy install geerlingguy.git` and subsequently include `geerlingguy.git` in the roles in order to apply the role on the nodes.
  
  > **Comments:**
  > **username_0**: Looking at the tasks in your link, it uses `get_url` to retrieve the git source which means while it may be a work around for git specifically, (if that repository doesn't use SNI to get a certificate), it doesn't answer my question of how to work securely with Ansible more generally, without breaking yum. Your answer is good advice though, and I'll be trying this today.  
  
  ---
  
  ### Answer by username_3 on 2021-05-05. Score: 0
  
  Failure to validate SSL certificate seems to be happening widely across Linux distributions. Therefore I will post a solution (general idea) which worked for me. The surface problem seems to be that Python is not able to recognize the certificate bundle file. Meanwhile, commandline `curl` can recognize SSL certificate and download file. The path to the certificate bundle differs depending on your Linux distribution.
  
  In my case,
  
  Ansible version: 2.10,
  Debian distribution
  
  after certificate was added by
  
  ```
  - name: Add the intermediate certificate to certificate bundle
    command: update-ca-certificates
  
  ```
  
  Then, specify the SSL\_CERT\_FILE variable to the certificate bundle.
  
  ```
  - name: download a file
    get_url:
      url: "url"
      dest: "destination"
    environment:                                           # Explicitly specify SSL_CERT_FILE here.
      SSL_CERT_FILE: /etc/ssl/certs/ca-certificates.crt     
  
  ```
  
  
  ---
  
  