<h5 dir="auto">Issue Type:</h5>
<p dir="auto">Problem with SSL verification</p>
<h5 dir="auto">Ansible Version:</h5>
<p dir="auto"><code class="notranslate">ansible 1.5.2</code><br>
installed via pip</p>
<h5 dir="auto">Environment:</h5>
<p dir="auto">Ubuntu 12.04</p>
<h5 dir="auto">Summary:</h5>
<p dir="auto">When I try to fetch any URL via https I get SSL verification error</p>
<h5 dir="auto">Steps To Reproduce:</h5>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="ansible -i 127.0.0.1, &quot;*&quot; -m 'get_url'  -a'url=&quot;https://www.postgresql.org&quot; dest=/tmp/x'"><pre class="notranslate"><code class="notranslate">ansible -i 127.0.0.1, "*" -m 'get_url'  -a'url="https://www.postgresql.org" dest=/tmp/x'
</code></pre></div>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="
##### Expected Results:

Downloaded file.

##### Actual Results:

127.0.0.1 | FAILED &gt;&gt; {
    &quot;failed&quot;: true, 
    &quot;msg&quot;: &quot;failed to validate the SSL certificate for www.postgresql.org:443. You can use validate_certs=no, however this is unsafe and not recommended '/usr/share/ca-certificates/cacert.org/cacert.org.crt'&quot;
}"><pre class="notranslate"><code class="notranslate">
##### Expected Results:

Downloaded file.

##### Actual Results:

127.0.0.1 | FAILED &gt;&gt; {
    "failed": true, 
    "msg": "failed to validate the SSL certificate for www.postgresql.org:443. You can use validate_certs=no, however this is unsafe and not recommended '/usr/share/ca-certificates/cacert.org/cacert.org.crt'"
}
</code></pre></div>
<p dir="auto">I am on ubuntu 12.04. Script found some certs here /usr/share/ca-certificates/cacert.org/cacert.org.crt and failed to verify postgresql certificate. Any ideas why?</p>
<h5 dir="auto">Issue Type:</h5>
<p dir="auto">Bug Report</p>
<h5 dir="auto">Ansible Version:</h5>
<p dir="auto">ansible 1.5.2</p>
<h5 dir="auto">Environment:</h5>
<p dir="auto">Ubuntu 12.04</p>
<h5 dir="auto">Summary:</h5>
<p dir="auto">SSL verification fails when attempting to use the hipchat module</p>
<h5 dir="auto">Steps To Reproduce:</h5>
<p dir="auto">Use the hipchat module and attempt to send a message.</p>
<h5 dir="auto">Expected Results:</h5>
<p dir="auto">No errors, message gets sent.</p>
<h5 dir="auto">Actual Results:</h5>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="msg: failed to validate the SSL certificate for api.hipchat.com:443. You can use validate_certs=no, however this is unsafe and not recommended"><pre class="notranslate"><code class="notranslate">msg: failed to validate the SSL certificate for api.hipchat.com:443. You can use validate_certs=no, however this is unsafe and not recommended
</code></pre></div>
<hr>
<p dir="auto">Ansible v1.5.2 appears to have enabled SSL server certificate verification. If I attempt to use the HipChat module, it fails due to an unclear error message:</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="msg: failed to validate the SSL certificate for api.hipchat.com:443. You can use validate_certs=no, however this is unsafe and not recommended"><pre class="notranslate"><code class="notranslate">msg: failed to validate the SSL certificate for api.hipchat.com:443. You can use validate_certs=no, however this is unsafe and not recommended
</code></pre></div>
<p dir="auto">It appears that Ansible hard-codes the Certificate Authority bundle based on the current platform and distribution. For Ubuntu, the file is hard-coded to /usr/share/ca-certificates/cacert.org/cacert.org.crt.</p>
<p dir="auto">Running update-ca-certificates on Ubuntu does not fix the problem because this generates a bundle in /etc/ssl/certs/ca-certificates.crt.</p>
<p dir="auto">I see a few improvements:</p>
<ol dir="auto">
<li>Display the attempted filename in the error message--this would help clarify what went wrong.</li>
<li>Allow configuration of the bundle file in the Ansible configuration (similar to curl's --cacert parameter).</li>
<li>curl also allows a --capath directory to search for certificates within this directory. Support this functionality.</li>
</ol>