I have some Ansible playbooks I want to run against some Windows hosts. I've followed the various Ansible guides for setting up WinRM and they have worked fine, but the default setups are very insecure and I want something more production ready. However, the instructions for how to do this are incredibly sparse. So far I've done the following:

On my Windows box:

1. Enabled WinRM using the supplied ConfigureRemotingForAnsible.ps1 script
2. Configured target machine to to use a valid cert on HTTPS/5986 rather than the self-signed one generated by the above script
3. Enabled both Kerberos and CredSSP auth methods on the target machine in WinRM. Some of my role steps require CredSSP to work reliably.

So far so good, the Windows side seems to work fine. However, getting Ansible to connect is proving a nightmare. I can't figure out how to get Ansible to trust the HTTPS cert on the target despite adding it. On my Centos 7 'push box' I've done the following:

1. Install Ansible and pip with the pywinrm, requests\_kerberos and requests\_credssp modules
2. Added my CA certificate to both /etc/pki/tls/certs and /etc/pki/ca-cert
3. Set my inventory to the following:

> 
> ansible\_user=ADMINISTRATOR@DOMAIN.COM
> 
> 
> ansible\_password=Password1
> 
> 
> ansible\_port=5986
> 
> 
> ansible\_connection=winrm
> 
> 
> ansible\_winrm\_scheme=https
> 
> 
> /#ansible\_winrm\_server\_cert\_validation=ignore
> 
> 
> ansible\_winrm\_transport=credssp
> 
> 
> 

With certification validation turned on the connection fails with the following error:

```
fatal: [host.domain.com]: 
UNREACHABLE! => {
"changed": false, 
"msg": "credssp: HTTPSConnectionPool(host='host.domain.com', port=5986): Max retries exceeded with url: /wsman (Caused by SSLError(SSLError(\"bad handshake: Error([('SSL routines', 'tls_process_server_certificate', 'certificate verify failed')],)\",),))", 
"unreachable": true}

```

With cert validation turned off it works fine.

So my question: How do I get Ansible to trust my CA cert?