so it turns out that if you don't run the common role before you try to grab the epel RPM you will run into ssl issues on OSP9 machines. this reordering fixes that. Change-Id: Ib3d80d89e5abf414913e945b57ff46020f578a6e