{"action":"closed","issue":{"url":"https://api.github.com/repos/trailofbits/algo/issues/802","repository_url":"https://api.github.com/repos/trailofbits/algo","labels_url":"https://api.github.com/repos/trailofbits/algo/issues/802/labels{/name}","comments_url":"https://api.github.com/repos/trailofbits/algo/issues/802/comments","events_url":"https://api.github.com/repos/trailofbits/algo/issues/802/events","html_url":"https://github.com/trailofbits/algo/issues/802","id":296153488,"number":802,"title":"Failed to validate the SSL certificate for api.digitalocean.com:443.","user":{"login":"jwebbstevens","id":7277574,"avatar_url":"https://avatars2.githubusercontent.com/u/7277574?v=4","gravatar_id":"","url":"https://api.github.com/users/jwebbstevens","html_url":"https://github.com/jwebbstevens","followers_url":"https://api.github.com/users/jwebbstevens/followers","following_url":"https://api.github.com/users/jwebbstevens/following{/other_user}","gists_url":"https://api.github.com/users/jwebbstevens/gists{/gist_id}","starred_url":"https://api.github.com/users/jwebbstevens/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jwebbstevens/subscriptions","organizations_url":"https://api.github.com/users/jwebbstevens/orgs","repos_url":"https://api.github.com/users/jwebbstevens/repos","events_url":"https://api.github.com/users/jwebbstevens/events{/privacy}","received_events_url":"https://api.github.com/users/jwebbstevens/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2018-02-11T02:28:10Z","updated_at":"2018-02-11T15:25:28Z","closed_at":"2018-02-11T15:25:28Z","author_association":"NONE","body":"### OS / Environment\r\n`MacOS 10.13.3`\r\n\r\n### Ansible version\r\n`ansible 2.2.1`\r\n\r\n### Summary of the problem\r\n\r\nDoesn't deploy VPN, tried all regions in DigitalOcean. \r\n\r\n### Steps to reproduce the behavior\r\n\r\n```What provider would you like to use?\r\n    1. DigitalOcean\r\n    2. Amazon EC2\r\n    3. Microsoft Azure\r\n    4. Google Compute Engine\r\n    5. Install to existing Ubuntu 16.04 server\r\n\r\nEnter the number of your desired provider\r\n: 1\r\n\r\nEnter your API token. The token must have read and write permissions (https://cloud.digitalocean.com/settings/api/tokens):\r\n[pasted values will not be displayed]\r\n: \r\n\r\nName the vpn server:\r\n[algo.local]: homeworld\r\n\r\n\r\nWhat region should the server be located in?\r\n    1.  Amsterdam        (Datacenter 2)\r\n    2.  Amsterdam        (Datacenter 3)\r\n    3.  Frankfurt\r\n    4.  London\r\n    5.  New York         (Datacenter 1)\r\n    6.  New York         (Datacenter 2)\r\n    7.  New York         (Datacenter 3)\r\n    8.  San Francisco    (Datacenter 1)\r\n    9.  San Francisco    (Datacenter 2)\r\n    10. Singapore\r\n    11. Toronto\r\n    12. Bangalore\r\nEnter the number of your desired region:\r\n[7]: 4\r\n\r\nDo you want macOS/iOS clients to enable \"VPN On Demand\" when connected to cellular networks?\r\n[y/N]: y\r\n\r\nDo you want macOS/iOS clients to enable \"VPN On Demand\" when connected to Wi-Fi?\r\n[y/N]: y\r\n\r\nList the names of trusted Wi-Fi networks (if any) that macOS/iOS clients exclude from using the VPN (e.g., your home network. Comma-separated value, e.g., HomeNet,OfficeWifi,AlgoWiFi)\r\n: \r\n\r\nDo you want to install a DNS resolver on this VPN server, to block ads while surfing?\r\n[y/N]: y\r\n\r\nDo you want each user to have their own account for SSH tunneling?\r\n[y/N]: y\r\n\r\nDo you want to apply operating system security enhancements on the server? (warning: replaces your sshd_config)\r\n[y/N]: y\r\n\r\nDo you want the VPN to support Windows 10 or Linux Desktop clients? (enables compatible ciphers and key exchange, less secure)\r\n[y/N]: N\r\n\r\nDo you want to retain the CA key? (required to add users in the future, but less secure)\r\n[y/N]: N```\r\n\r\n### The way of deployment (cloud or local)\r\n\r\n`Ansible run locally. Deployed to DigitalOcean any region.`\r\n\r\n### Expected behavior\r\n\r\n`Expect the VPN to spin up`\r\n\r\n### Actual behavior\r\n\r\n```TASK [cloud-digitalocean : Tag the droplet] ************************************\r\nfatal: [localhost]: FAILED! => {\"changed\": false, \"failed\": true, \"msg\": \"Failed to validate the SSL certificate for api.digitalocean.com:443. Make sure your managed systems have a valid CA certificate installed. You can use validate_certs=False if you do not need to confirm the servers identity but this is unsafe and not recommended. Paths checked for this platform: /etc/ssl/certs, /etc/ansible, /usr/local/etc/openssl\"}```\r\n\r\n\r\n### Full log\r\n\r\n```<PLAY [Configure the server] ****************************************************\r\n\r\nTASK [setup] *******************************************************************\r\nok: [localhost]\r\n\r\nTASK [Generate the SSH private key] ********************************************\r\nok: [localhost]\r\n\r\nTASK [Generate the SSH public key] *********************************************\r\nok: [localhost]\r\n\r\nTASK [Change mode for the SSH private key] *************************************\r\nok: [localhost]\r\n\r\nTASK [Ensure the dynamic inventory exists] *************************************\r\nok: [localhost]\r\n\r\nTASK [cloud-digitalocean : Set the DigitalOcean Access Token fact] *************\r\nok: [localhost]\r\n\r\nTASK [cloud-digitalocean : Delete the existing Algo SSH keys] ******************\r\nFAILED - RETRYING: TASK: cloud-digitalocean : Delete the existing Algo SSH keys (10 retries left).\r\nok: [localhost]\r\n\r\nTASK [cloud-digitalocean : Upload the SSH key] *********************************\r\nchanged: [localhost]\r\n\r\nTASK [cloud-digitalocean : Creating a droplet...] ******************************\r\nok: [localhost]\r\n\r\nTASK [cloud-digitalocean : Add the droplet to an inventory group] **************\r\nchanged: [localhost]\r\n\r\nTASK [cloud-digitalocean : set_fact] *******************************************\r\nok: [localhost]\r\n\r\nTASK [cloud-digitalocean : Tag the droplet] ************************************\r\nfatal: [localhost]: FAILED! => {\"changed\": false, \"failed\": true, \"msg\": \"Failed to validate the SSL certificate for api.digitalocean.com:443. Make sure your managed systems have a valid CA certificate installed. You can use validate_certs=False if you do not need to confirm the servers identity but this is unsafe and not recommended. Paths checked for this platform: /etc/ssl/certs, /etc/ansible, /usr/local/etc/openssl\"}\r\n\r\nTASK [cloud-digitalocean : debug] **********************************************\r\nok: [localhost] => {\r\n    \"fail_hint\": [\r\n        \"Sorry, but something went wrong!\", \r\n        \"Please check the troubleshooting guide.\", \r\n        \"https://trailofbits.github.io/algo/troubleshooting.html\"\r\n    ]\r\n}\r\n\r\nTASK [cloud-digitalocean : fail] ***********************************************\r\nfatal: [localhost]: FAILED! => {\"changed\": false, \"failed\": true, \"msg\": \"Failed as requested from task\"}\r\n\r\nPLAY RECAP *********************************************************************\r\nlocalhost                  : ok=12   changed=2    unreachable=0    failed=1>```\r\n\r\n"}}
{"actor":{"display_login":"dguido"}}