How to Resolve Ansible Galaxy SSL 'CERTIFICATE_VERIFY_FAILED' Errors

The Problem

You’re ready to deploy, but ansible-galaxy stops you cold. This error typically triggers when the Python environment powering Ansible cannot validate the SSL certificate of the Galaxy server. Security is the priority here, but a missing certificate link in your local chain often breaks the handshake.

The error usually looks like this in your terminal:

ERROR! Unknown error when attempting to call Galaxy: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1123)>

TL;DR: The "I Need It Fixed Now" Workaround

If you are working in a safe, local sandbox and need to bypass the check immediately, use the --ignore-certs flag. It’s a quick fix, though not a permanent solution for production environments.

ansible-galaxy collection install community.general --ignore-certs

To apply this to your entire session without typing the flag every time, export this environment variable:

export ANSIBLE_GALAXY_IGNORE_CERTS=True

Why Is This Happening?

Ansible relies on Python’s urllib or requests libraries to fetch content. Since Python 3.6, these libraries have become much stricter about verifying certificate chains. You are likely facing one of three hurdles:

• Stale OS Certificates: Your local ca-certificates package hasn't been updated in months, and it doesn't recognize the newer CA used by galaxy.ansible.com.
• Corporate Interception: Many companies use "Deep Packet Inspection" via proxies like Zscaler or Blue Coat. These services replace the real Galaxy certificate with a self-signed corporate one that your machine doesn't trust yet.
• macOS Isolation: Python versions installed via the official macOS .pkg installer often ignore the system Keychain entirely.

Step-by-Step Fixes

1. Refresh Your Linux Certificate Store

Linux distributions need a regular refresh of their trusted root authorities. This is usually the first thing you should try on a server or WSL instance.

Ubuntu/Debian:

sudo apt-get update
sudo apt-get install --reinstall ca-certificates
sudo update-ca-certificates

CentOS/RHEL 8 & 9:

sudo dnf upgrade ca-certificates
sudo update-ca-trust

2. The macOS Python Certificate Script

macOS users frequently encounter this because Python doesn't automatically link to the system's root certs. Look inside your Applications folder. Python comes with a specific command script to solve this exact headache.

# Check your version first; this example uses 3.12
/Applications/Python\ 3.12/Install\ Certificates.command

Alternatively, you can force Python to use the certifi bundle, which is updated more frequently than the OS:

pip install --upgrade certifi

3. Injecting Corporate CA Bundles

When you're behind a corporate firewall, you must tell Ansible exactly where your company's root certificate lives. Ask your IT team for the company-root-ca.pem file. Once you have it, point your environment variables to that path.

export REQUESTS_CA_BUNDLE=/etc/pki/tls/certs/corporate-proxy-ca.pem
export SSL_CERT_FILE=/etc/pki/tls/certs/corporate-proxy-ca.pem
ansible-galaxy collection install community.aws

4. Make the Fix Permanent in ansible.cfg

Tired of exporting variables? You can bake the configuration directly into your project. Open your ansible.cfg file and add the following section:

[galaxy]
ignore_certs = True

Warning: Only use ignore_certs = True if you are on a known, secure internal network. Disabling verification on public Wi-Fi makes you an easy target for Man-in-the-Middle (MITM) attacks.

Verifying the Connection

Check if the fix worked by running a verbose installation. The -vvv flag will show you exactly which URL is being called and where the connection might be hanging.

ansible-galaxy collection install community.general -vvv

You can also run this Python one-liner to test the raw connection. If it returns 200, your SSL path is officially clear:

python3 -c "import urllib.request; print(urllib.request.urlopen('https://galaxy.ansible.com').getcode())"

Summary

The CERTIFICATE_VERIFY_FAILED error is a security feature, not a bug. While --ignore-certs works for a quick 10-second fix, the professional approach is updating your ca-certificates or mapping your corporate CA. Keeping your certificate store current ensures your automation remains both functional and secure.