<p>I faced the same error .. You probably want to run <a href="https://github.com/ansible/ansible/blob/devel/examples/scripts/ConfigureRemotingForAnsible.ps1" rel="nofollow noreferrer">ConfigureRemotingForAnsible.ps1</a> script with <code>-ForceNewSSLCert</code> option on your remote machines.</p>

<pre><code>.\ConfigureRemotingForAnsible.ps1 -ForceNewSSLCert
</code></pre>

CC BY-SA 4.0
2018-12-21T21:14:53.683Z
Also, when logged in to remote machine
 Run as  Admin Powershell:
$ winrm qc
To check how your machine is currently setup.
Roadkillon101
CC BY-SA 3.0
2018-03-26T15:12:36.347Z
2018-03-26T15:12:36.347Z
storm
<p>If that doesnt work, check your TLS1.3 registry key  <code>Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3\Server</code></p>
<p>The actual error for me was TLS 1.3 was set enabled (1), in registry, but was not set DisabledByDefault.  setting that to 1 resolved the long looming ansible ssl connection error.</p>
<p>You can also delete the TLS1.3 key, so that its not explicitly set.</p>
<pre><code>ansible_connection: winrm
ansible_winrm_scheme: https
ansible_port: 5986 #didnt break it, leaving this enabled
ansible_winrm_cert_pem: ..
ansible_winrm_cert_key_pem: ...
ansible_winrm_transport: certificate
ansible_winrm_server_cert_validation: ignore # maybe because i WAS USING IP, not hostname, also the cert  CN is &quot;ansible&quot; anyway, not matching any hostname.  
</code></pre>
<p><a href="https://community.tenable.com/s/article/How-to-view-and-change-the-Windows-Registry-Settings-for-the-SSL-TLS-Protocols-on-a-Windows-Host" rel="nofollow noreferrer">https://community.tenable.com/s/article/How-to-view-and-change-the-Windows-Registry-Settings-for-the-SSL-TLS-Protocols-on-a-Windows-Host</a></p>

CC BY-SA 4.0
2022-09-16T17:50:20.133Z
2022-09-16T17:50:20.133Z
blamb
<p>While using Ansible to manage some AWS based Windows machines, when connecting using the IP as destination, on some machines I'm getting an SSL Error </p>

<blockquote>
  <p>credssp: HTTPSConnectionPool(host='18.217.233.26', port=5986): Max
  retries exceeded with url: /wsman (Caused by SSLError(SSLError(\"bad
  handshake: SysCallError(-1, 'Unexpected EOF')\",),))", "unreachable":
  true}</p>
</blockquote>

<p>In wireshark it looks like TCP RST is sent by server</p>

<p>When connecting using hostname or FQDN the connection succeeds. </p>

<p>I don't see any relevant log in the event logs on WSMan side.</p>

<p>Anybody have any experience with setting up winrm for Ansible and can assist?</p>

<ansible><windows>
WinRM / WSMan - getting SSL handshake error / TCP RST when connecting with IP address, correct connection when connecting with hostname
Saar Grin
# WinRM / WSMan - getting SSL handshake error / TCP RST when connecting with IP address, correct connection when connecting with hostname

(Asked by: username_0 on 2018-03-26)

While using Ansible to manage some AWS based Windows machines, when connecting using the IP as destination, on some machines I'm getting an SSL Error

> credssp: HTTPSConnectionPool(host='18.217.233.26', port=5986): Max
> retries exceeded with url: /wsman (Caused by SSLError(SSLError(\"bad
> handshake: SysCallError(-1, 'Unexpected EOF')\",),))", "unreachable":
> true}

In wireshark it looks like TCP RST is sent by server

When connecting using hostname or FQDN the connection succeeds.

I don't see any relevant log in the event logs on WSMan side.

Anybody have any experience with setting up winrm for Ansible and can assist?

**Tags:** ansible, windows


---

## 2 answers

### Answer by username_1 on 2018-03-26. Score: 1

I faced the same error .. You probably want to run ConfigureRemotingForAnsible.ps1 script with -ForceNewSSLCert option on your remote machines.
.\ConfigureRemotingForAnsible.ps1 -ForceNewSSLCert

> **Comments:**
> **username_2**: Also, when logged in to remote machine  Run as  Admin Powershell: $ winrm qc To check how your machine is currently setup.  

---

### Answer by username_3 on 2022-09-16. Score: 0

If that doesnt work, check your TLS1.3 registry key  Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.3\Server
The actual error for me was TLS 1.3 was set enabled (1), in registry, but was not set DisabledByDefault.  setting that to 1 resolved the long looming ansible ssl connection error.
You can also delete the TLS1.3 key, so that its not explicitly set.
ansible_connection: winrm
ansible_winrm_scheme: https
ansible_port: 5986 #didnt break it, leaving this enabled
ansible_winrm_cert_pem: ..
ansible_winrm_cert_key_pem: ...
ansible_winrm_transport: certificate
ansible_winrm_server_cert_validation: ignore # maybe because i WAS USING IP, not hostname, also the cert  CN is "ansible" anyway, not matching any hostname.  

https://community.tenable.com/s/article/How-to-view-and-change-the-Windows-Registry-Settings-for-the-SSL-TLS-Protocols-on-a-Windows-Host


---

