Build Error [services | download fits zip]: SSL certificate validation error for fits.google.com download.

[pketienne]

As DCE and WashU both use CentOS7 environments, I'm posting a record of this error, a work around, and a description of what might be necessary for a longer term solution.

---

failed: [hydra-head] => {"failed": true}
msg: Failed to validate the SSL certificate for fits.googlecode.com:443. Make sure your managed systems have a valid CA certificate installed. If the website serving the url uses SNI you need python >= 2.7.9 on your managed machine. You can use validate_certs=False if you do not need to confirm the server\s identity but this is unsafe and not recommended Paths checked for this platform: /etc/ssl/certs, /etc/pki/ca-trust/extracted/pem, /etc/pki/tls/certs, /usr/share/ca-certificates/cacert.org, /etc/ansible

FATAL: all hosts have already failed -- aborting

---

Here's a work-around:

[ansible]/roles/services/tasks/fits.yml:8

• get_url: url=https://fits.googlecode.com/files/fits-0.6.2.zip owner={{ install_user }} group={{ install_group }} dest={{ install_path }}/fits-0.6.2.zip
• get_url: url=https://fits.googlecode.com/files/fits-0.6.2.zip owner={{ install_user }} group={{ install_group }} dest={{ install_path }}/fits-0.6.2.zip validate_certs=no

A more appropriate solution would be to upgrade CentOS7's python version from 2.7.5 to >=2.7.9, however 2.7.5 is the latest available through Yum. Installing python >=2.7.9 locally (/usr/local/bin) and changing symlinks / alternatives breaks the Yum installer (and other things, so I've read). Adding an alias for "python" in the .bashrc of the "install" user so that "python" points to the /usr/local/bin installation also doesn't work. The Ansible task uses "become: yes", which I believe means it's basically running with a root environment which bypasses the "install" user's alias pointing to the local python 2.7.9 install.