<h5 dir="auto">ISSUE TYPE</h5>
<ul dir="auto">
<li>Feature Idea</li>
</ul>
<h5 dir="auto">COMPONENT NAME</h5>
<p dir="auto">vault</p>
<h5 dir="auto">ANSIBLE VERSION</h5>
<p dir="auto">2.3</p>
<h5 dir="auto">SUMMARY</h5>
<p dir="auto">Extend the --output flag to work with the encrypt_string action to update/add the variable defined with -n.</p>
<p dir="auto">So running: <strong>ansible-vault encrypt_string -n PASSWORD MySecret --output=group_vars/servers</strong></p>
<p dir="auto">Would update group_vars/servers file, adding PASSWORD: if it didn't exist, or updating if it did.</p>
<h5 dir="auto">Issue Type:</h5>
<p dir="auto">Bug Report</p>
<h5 dir="auto">Ansible Version:</h5>
<p dir="auto">ansible 1.5.2</p>
<h5 dir="auto">Environment:</h5>
<p dir="auto">Ubuntu 12.04</p>
<h5 dir="auto">Summary:</h5>
<p dir="auto">SSL verification fails when attempting to use the hipchat module</p>
<h5 dir="auto">Steps To Reproduce:</h5>
<p dir="auto">Use the hipchat module and attempt to send a message.</p>
<h5 dir="auto">Expected Results:</h5>
<p dir="auto">No errors, message gets sent.</p>
<h5 dir="auto">Actual Results:</h5>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="msg: failed to validate the SSL certificate for api.hipchat.com:443. You can use validate_certs=no, however this is unsafe and not recommended"><pre class="notranslate"><code class="notranslate">msg: failed to validate the SSL certificate for api.hipchat.com:443. You can use validate_certs=no, however this is unsafe and not recommended
</code></pre></div>
<hr>
<p dir="auto">Ansible v1.5.2 appears to have enabled SSL server certificate verification. If I attempt to use the HipChat module, it fails due to an unclear error message:</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="msg: failed to validate the SSL certificate for api.hipchat.com:443. You can use validate_certs=no, however this is unsafe and not recommended"><pre class="notranslate"><code class="notranslate">msg: failed to validate the SSL certificate for api.hipchat.com:443. You can use validate_certs=no, however this is unsafe and not recommended
</code></pre></div>
<p dir="auto">It appears that Ansible hard-codes the Certificate Authority bundle based on the current platform and distribution. For Ubuntu, the file is hard-coded to /usr/share/ca-certificates/cacert.org/cacert.org.crt.</p>
<p dir="auto">Running update-ca-certificates on Ubuntu does not fix the problem because this generates a bundle in /etc/ssl/certs/ca-certificates.crt.</p>
<p dir="auto">I see a few improvements:</p>
<ol dir="auto">
<li>Display the attempted filename in the error message--this would help clarify what went wrong.</li>
<li>Allow configuration of the bundle file in the Ansible configuration (similar to curl's --cacert parameter).</li>
<li>curl also allows a --capath directory to search for certificates within this directory. Support this functionality.</li>
</ol>