Ansible winrm to connect to windows guest via certificate.

[Rui Pereira]

Hello Guys,

I'm trying to understand the way to go here. I want to secure as much as possible my connection from my ansible box to the guests. In terms of Linux i already have all the communication based on SSH keys. In terms of windows i have it working via https && user and pass. (basic authentication.)


[jesus@ansible]$ ansible -i inventories/9networks/hosts 9test -m win_ping -v --extra-vars "@./inventories/9networks/win_servers.yml" --ask-vault-pass
Using /home/jesus/ansible_project_creation/ansible.cfg as config file
Vault password:
9test1 | SUCCESS => {
    "changed": false,
    "ping": "pong"

I want to upgrade this to a higher standard but all the solutions that I've faced so far requires an active directory / Keberos which is not suitable for my scenario. I need to keep things as much simple as possible. Can someone point me in the right direction to configure winrm connections via certificate authentication? I can't install any AD on the environment. How to make winrm secure connections with certificates?

Thank-you for all the possible help.

[Jordan Borean]

Certificate auth is a bit of a pain with WinRM, I found the best article to get this working would be http://www.hurryupandwait.io/blog/certificate-password-less-based-authentication-in-winrm. Personally I would say NTLM is more secure than Basic auth as you are not sending the actual password to the server (rather a hash of the password). You also have CredSSP as an option with local accounts but there is not much point using that is using local accounts.

[Rui Pereira]