🚨 Ansible Error: 'Failed to validate the SSL certificate' — Cause, Fix, and Troubleshooting Guide

Overview

HTTP-fetching modules — get_url, uri, apt_key, and others — verify TLS certificates by default. When the server’s certificate cannot be validated against the trusted CA store on the target host, the module fails:

fatal: [web-01]: FAILED! => {"changed": false, "msg": "Failed to validate the SSL certificate for artifacts.internal.example.com:443. Make sure your managed systems have a valid CA certificate installed. You can use validate_certs=false if you understand and accept the security risk."}

The check runs on the managed node, so the CA trust problem is on that host, not the controller.

Symptoms

• get_url/uri against an internal or self-signed endpoint fails on TLS.
• Public HTTPS works but your corporate/internal host fails.
• The error suggests validate_certs=false as a workaround.

ansible web-01 -i inventory.ini -m uri -a 'url=https://artifacts.internal.example.com/health'

web-01 | FAILED! => {"msg": "Failed to validate the SSL certificate for artifacts.internal.example.com:443"}

Common Root Causes

1. Internal/self-signed CA not trusted on the target

The endpoint is signed by a private CA that is not in the host’s system trust store.

2. Missing or outdated CA bundle

Minimal images lack ca-certificates, or it is stale and missing a newer root.

3. Incomplete certificate chain

The server does not send intermediate certificates, so validation cannot build a path to a trusted root.

4. Clock skew

The host’s clock is wrong, making a valid cert appear expired or not-yet-valid.

How to diagnose

Inspect the chain from the target host:

ansible web-01 -i inventory.ini -m shell -a 'echo | openssl s_client -connect artifacts.internal.example.com:443 -servername artifacts.internal.example.com 2>/dev/null | openssl x509 -noout -issuer -dates'

Check the CA bundle and clock:

ansible web-01 -i inventory.ini -m shell -a 'ls -l /etc/ssl/certs/ca-certificates.crt; date -u'

Fixes

Install/refresh the CA bundle

- name: Ensure CA certificates package
  ansible.builtin.package:
    name: ca-certificates
    state: present

Add an internal CA to the trust store (preferred over disabling)

- name: Install internal root CA
  ansible.builtin.copy:
    src: internal-root-ca.crt
    dest: /usr/local/share/ca-certificates/internal-root-ca.crt
    mode: "0644"
  notify: update ca trust

# handlers/main.yml
- name: update ca trust
  ansible.builtin.command: update-ca-certificates

Point a single task at a specific CA file

- name: Fetch artifact using a specific CA
  ansible.builtin.get_url:
    url: https://artifacts.internal.example.com/app.tgz
    dest: /tmp/app.tgz
    ca_path: /usr/local/share/ca-certificates/internal-root-ca.crt

Fix clock skew

- name: Ensure time sync
  ansible.builtin.package:
    name: chrony
    state: present

What to watch out for

• Avoid validate_certs: false outside throwaway labs — it disables the protection that this error exists to provide.
• Fix the certificate chain on the server (serve intermediates) rather than trusting per-host when the endpoint is public-facing.
• After adding a CA, you must run update-ca-certificates (Debian) or update-ca-trust (RHEL) for it to take effect.

Related

• Ansible Error: Galaxy certificate verify failed
• Ansible Error: ‘Failed to update apt cache’
• Ansible Error: ‘Could not find or access file on the Ansible Controller’