connection errors

[saviodsouza]

Hi

I am trying to ansible with opnsense in a lab environment and getting the following error.

osboxes@osboxes:~/.ansible$ ansible-playbook playbooks/labs/firewalls/opnsense0.yml -i inventory/lab/hosts.yml -D --ask-vault-pass [email protected]
Vault password: 
[WARNING]: Collection ansibleguy.opnsense does not support Ansible version 2.13.13

PLAY [localhost] *******************************************************************************************************************************

TASK [Example] *********************************************************************************************************************************
An exception occurred during task execution. To see the full traceback, use -vvv. The error was: ConnectionError: Unable to connect 'GET => https://192.168.1.1/api/firewall/alias/get'!
fatal: [localhost]: FAILED! => {"changed": false, "module_stderr": "Traceback (most recent call last):\n  File \"/home/osboxes/.local/lib/python3.8/site-packages/httpcore/_exceptions.py\", line 10, in map_exceptions\n    yield\n  File \"/home/osboxes/.local/lib/python3.8/site-packages/httpcore/_backends/sync.py\", line 168, in start_tls\n    raise exc\n  File \"/home/osboxes/.local/lib/python3.8/site-packages/httpcore/_backends/sync.py\", line 163, in start_tls\n    sock = ssl_context.wrap_socket(\n  File \"/usr/lib/python3.8/ssl.py\", line 500, in wrap_socket\n    return self.sslsocket_class._create(\n  File \"/usr/lib/python3.8/ssl.py\", line 1069, in _create\n    self.do_handshake()\n  File \"/usr/lib/python3.8/ssl.py\", line 1338, in do_handshake\n    self._sslobj.do_handshake()\nssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1131)\n\nThe above exception was the direct cause of the following exception:\n\nTraceback (most recent call last):\n  File \"/home/osboxes/.local/lib/python3.8/site-packages/httpx/_transports/default.py\", line 67, in map_httpcore_exceptions\n    yield\n  File \"/home/osboxes/.local/lib/python3.8/site-packages/httpx/_transports/default.py\", line 231, in handle_request\n    resp = self._pool.handle_request(req)\n  File \"/home/osboxes/.local/lib/python3.8/site-packages/httpcore/_sync/connection_pool.py\", line 268, in handle_request\n    raise exc\n  File \"/home/osboxes/.local/lib/python3.8/site-packages/httpcore/_sync/connection_pool.py\", line 251, in handle_request\n    response = connection.handle_request(request)\n  File \"/home/osboxes/.local/lib/python3.8/site-packages/httpcore/_sync/connection.py\", line 99, in handle_request\n    raise exc\n  File \"/home/osboxes/.local/lib/python3.8/site-packages/httpcore/_sync/connection.py\", line 76, in handle_request\n    stream = self._connect(request)\n  File \"/home/osboxes/.local/lib/python3.8/site-packages/httpcore/_sync/connection.py\", line 156, in _connect\n    stream = stream.start_tls(**kwargs)\n  File \"/home/osboxes/.local/lib/python3.8/site-packages/httpcore/_backends/sync.py\", line 168, in start_tls\n    raise exc\n  File \"/usr/lib/python3.8/contextlib.py\", line 131, in __exit__\n    self.gen.throw(type, value, traceback)\n  File \"/home/osboxes/.local/lib/python3.8/site-packages/httpcore/_exceptions.py\", line 14, in map_exceptions\n    raise to_exc(exc) from exc\nhttpcore.ConnectError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1131)\n\nThe above exception was the direct cause of the following exception:\n\nTraceback (most recent call last):\n  File \"/tmp/ansible_ansibleguy.opnsense.alias_payload_i_ejv4lc/ansible_ansibleguy.opnsense.alias_payload.zip/ansible_collections/ansibleguy/opnsense/plugins/module_utils/base/api.py\", line 50, in get\n  File \"/home/osboxes/.local/lib/python3.8/site-packages/httpx/_client.py\", line 1055, in get\n    return self.request(\n  File \"/home/osboxes/.local/lib/python3.8/site-packages/httpx/_client.py\", line 828, in request\n    return self.send(request, auth=auth, follow_redirects=follow_redirects)\n  File \"/home/osboxes/.local/lib/python3.8/site-packages/httpx/_client.py\", line 915, in send\n    response = self._send_handling_auth(\n  File \"/home/osboxes/.local/lib/python3.8/site-packages/httpx/_client.py\", line 943, in _send_handling_auth\n    response = self._send_handling_redirects(\n  File \"/home/osboxes/.local/lib/python3.8/site-packages/httpx/_client.py\", line 980, in _send_handling_redirects\n    response = self._send_single_request(request)\n  File \"/home/osboxes/.local/lib/python3.8/site-packages/httpx/_client.py\", line 1016, in _send_single_request\n    response = transport.handle_request(request)\n  File \"/home/osboxes/.local/lib/python3.8/site-packages/httpx/_transports/default.py\", line 231, in handle_request\n    resp = self._pool.handle_request(req)\n  File \"/usr/lib/python3.8/contextlib.py\", line 131, in __exit__\n    self.gen.throw(type, value, traceback)\n  File \"/home/osboxes/.local/lib/python3.8/site-packages/httpx/_transports/default.py\", line 84, in map_httpcore_exceptions\n    raise mapped_exc(message) from exc\nhttpx.ConnectError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1131)\n\nDuring handling of the above exception, another exception occurred:\n\nTraceback (most recent call last):\n  File \"/home/osboxes/.ansible/tmp/ansible-tmp-1704873837.724465-15263-168463642224982/AnsiballZ_alias.py\", line 107, in <module>\n    _ansiballz_main()\n  File \"/home/osboxes/.ansible/tmp/ansible-tmp-1704873837.724465-15263-168463642224982/AnsiballZ_alias.py\", line 99, in _ansiballz_main\n    invoke_module(zipped_mod, temp_path, ANSIBALLZ_PARAMS)\n  File \"/home/osboxes/.ansible/tmp/ansible-tmp-1704873837.724465-15263-168463642224982/AnsiballZ_alias.py\", line 47, in invoke_module\n    runpy.run_module(mod_name='ansible_collections.ansibleguy.opnsense.plugins.modules.alias', init_globals=dict(_module_fqn='ansible_collections.ansibleguy.opnsense.plugins.modules.alias', _modlib_path=modlib_path),\n  File \"/usr/lib/python3.8/runpy.py\", line 207, in run_module\n    return _run_module_code(code, init_globals, run_name, mod_spec)\n  File \"/usr/lib/python3.8/runpy.py\", line 97, in _run_module_code\n    _run_code(code, mod_globals, init_globals,\n  File \"/usr/lib/python3.8/runpy.py\", line 87, in _run_code\n    exec(code, run_globals)\n  File \"/tmp/ansible_ansibleguy.opnsense.alias_payload_i_ejv4lc/ansible_ansibleguy.opnsense.alias_payload.zip/ansible_collections/ansibleguy/opnsense/plugins/modules/alias.py\", line 58, in <module>\n  File \"/tmp/ansible_ansibleguy.opnsense.alias_payload_i_ejv4lc/ansible_ansibleguy.opnsense.alias_payload.zip/ansible_collections/ansibleguy/opnsense/plugins/modules/alias.py\", line 54, in main\n  File \"/tmp/ansible_ansibleguy.opnsense.alias_payload_i_ejv4lc/ansible_ansibleguy.opnsense.alias_payload.zip/ansible_collections/ansibleguy/opnsense/plugins/modules/alias.py\", line 47, in run_module\n  File \"/tmp/ansible_ansibleguy.opnsense.alias_payload_i_ejv4lc/ansible_ansibleguy.opnsense.alias_payload.zip/ansible_collections/ansibleguy/opnsense/plugins/module_utils/helper/wrapper.py\", line 24, in module_wrapper\n  File \"/tmp/ansible_ansibleguy.opnsense.alias_payload_i_ejv4lc/ansible_ansibleguy.opnsense.alias_payload.zip/ansible_collections/ansibleguy/opnsense/plugins/module_utils/helper/wrapper.py\", line 10, in module_process\n  File \"/tmp/ansible_ansibleguy.opnsense.alias_payload_i_ejv4lc/ansible_ansibleguy.opnsense.alias_payload.zip/ansible_collections/ansibleguy/opnsense/plugins/module_utils/main/alias.py\", line 62, in check\n  File \"/tmp/ansible_ansibleguy.opnsense.alias_payload_i_ejv4lc/ansible_ansibleguy.opnsense.alias_payload.zip/ansible_collections/ansibleguy/opnsense/plugins/module_utils/base/base.py\", line 127, in find\n  File \"/tmp/ansible_ansibleguy.opnsense.alias_payload_i_ejv4lc/ansible_ansibleguy.opnsense.alias_payload.zip/ansible_collections/ansibleguy/opnsense/plugins/module_utils/base/base.py\", line 602, in _call_search\n  File \"/tmp/ansible_ansibleguy.opnsense.alias_payload_i_ejv4lc/ansible_ansibleguy.opnsense.alias_payload.zip/ansible_collections/ansibleguy/opnsense/plugins/module_utils/base/cls.py\", line 33, in _search_call\n  File \"/tmp/ansible_ansibleguy.opnsense.alias_payload_i_ejv4lc/ansible_ansibleguy.opnsense.alias_payload.zip/ansible_collections/ansibleguy/opnsense/plugins/module_utils/base/base.py\", line 77, in search\n  File \"/tmp/ansible_ansibleguy.opnsense.alias_payload_i_ejv4lc/ansible_ansibleguy.opnsense.alias_payload.zip/ansible_collections/ansibleguy/opnsense/plugins/module_utils/base/api.py\", line 54, in get\nConnectionError: Unable to connect 'GET => https://192.168.1.1/api/firewall/alias/get'!\n", "module_stdout": "", "msg": "MODULE FAILURE\nSee stdout/stderr for the exact error", "rc": 1}

PLAY RECAP *************************************************************************************************************************************
localhost                  : ok=0    changed=0    unreachable=0    failed=1    skipped=0    rescued=0    ignored=0   

What I understand there is an ssl error for which the ca.pem file needs to be exported from opnsense... Right?

ssl_verify: true
ssl_ca_file: '/path/to/ca.pem'

Thanks

[ansibleguy]

Greetings!

Yes - it seems the CA-file is the issue: ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate

I guess it does work with ssl_verify set to false, right?

As described in the documentation - you can either:

• use a 'public' certificate (Letsencrypt per example)
• or create an internal certificate-authority.

I don't think the built-in self-signed certificate (OPNSense.localdomain) can be set as trusted:

The CommonName or SubjectAlternativeNames must match the DNS/IP of the firewall you are connecting to for the verification to work correctly.