WinRMHook connection over SSH using certificates

[vujzoran]

Hi all,
I want to orchestrate some tasks on my local on prem servers using WinRMOperator from Airflow running in GKE, and I am having some issues establishing proper connection.

` copy_cert = BashOperator(
task_id='copy_cert',
bash_command='mkdir -p /tmp/bi-airflow/ssas_refresh/certificates; cp -fr /opt/bitnami/airflow/dags/certificates/. /tmp/bi-airflow/ssas_refresh/certificates'
)

clear_tmp = BashOperator(
    task_id="clear_tmp",
    bash_command="rm -rf /tmp/bi-airflow/ssas_refresh"
)    

process_via_winrm = WinRMOperator(
    task_id='process_via_winrm',
    winrm_hook=WinRMHook(
        ssh_conn_id='ssh_test',
        ca_trust_path='/tmp/bi-airflow/ssas_refresh/certificates/root.pem',
        cert_key_pem= '/tmp/bi-airflow/ssas_refresh/certificates/sqlbiuat.pem',
        cert_pem= '/tmp/bi-airflow/ssas_refresh/certificates/sqlbipubkey.pem',
        endpoint='https:/DWH.local:443/wsman',
        transport="certificate"
    ),
    command='Get-Command',
    ps_path='powershell'
)

copy_cert >> process_via_winrm >> clear_tmp`

Error i am getting is following:

Traceback (most recent call last):
File "/opt/bitnami/airflow/venv/lib/python3.8/site-packages/airflow/providers/microsoft/winrm/hooks/winrm.py", line 212, in get_conn
self.client = self.winrm_protocol.open_shell()
File "/opt/bitnami/airflow/venv/lib/python3.8/site-packages/winrm/protocol.py", line 166, in open_shell
res = self.send_message(xmltodict.unparse(req))
File "/opt/bitnami/airflow/venv/lib/python3.8/site-packages/winrm/protocol.py", line 243, in send_message
resp = self.transport.send_message(message)
File "/opt/bitnami/airflow/venv/lib/python3.8/site-packages/winrm/transport.py", line 322, in send_message
response = self._send_message_request(prepared_request, message)
File "/opt/bitnami/airflow/venv/lib/python3.8/site-packages/winrm/transport.py", line 327, in _send_message_request
response = self.session.send(prepared_request, timeout=self.read_timeout_sec)
File "/opt/bitnami/airflow/venv/lib/python3.8/site-packages/requests/sessions.py", line 645, in send
r = adapter.send(request, **kwargs)
File "/opt/bitnami/airflow/venv/lib/python3.8/site-packages/requests/adapters.py", line 517, in send
raise SSLError(e, request=request)
requests.exceptions.SSLError: HTTPSConnectionPool(host='DWH.local', port=443): Max retries exceeded with url: /wsman (Caused by SSLError(SSLError(9, '[SSL] PEM lib (_ssl.c:4046)')))

There is listener on local server enabled to accept connection from Airflow and i already check with network team to make sure network connection is possible.

I am probably wrong in ways how I defined my dag: so here are already some questions I am not sure about:

• Do I need to install certificates or pointing to file that airflow worker can access would be fine?
• My certificates are all files with .pem extension in human readable format (sqlbipubkey.pem starting with -----BEGIN PUBLIC KEY-----, and sqlbiuat.pem and sqlbipubkey.pem starting with -----BEGIN CERTIFICATE-----)

Overall any help or hint would be highly recommended.