# Chef server with LetsEncrypt

**URL:** <https://discourse.chef.io/t/chef-server-with-letsencrypt/9352>\
**Category:** Chef Infra (archive)\
**Created:** [September 8, 2016, 3:00pm UTC](https://discourse.chef.io/t/chef-server-with-letsencrypt/9352 "2016-09-08T15:00:16Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![nclemons](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/nclemons/32/3374_2.png) [@nclemons](https://discourse.chef.io/u/nclemons)\
**Post date:** [September 8, 2016, 3:00pm UTC](https://discourse.chef.io/t/chef-server-with-letsencrypt/9352/1 "2016-09-08T15:00:17Z")

</div>

Has anyone used chef-server with SSL keys generated via LetsEncrypt? I’m wondering if that would solve some of the SSL validations I’m currently working around with knife ssl fetch / ssl\_verify\_mode :none.

[https://letsencrypt.org/](https://letsencrypt.org/)

Thanks!

---

<div class="post-metadata">

**Author:** ![ameir](https://avatars.discourse-cdn.com/v4/letter/a/8c91f0/32.png) [@ameir](https://discourse.chef.io/u/ameir)\
**Post date:** [September 8, 2016, 3:22pm UTC](https://discourse.chef.io/t/chef-server-with-letsencrypt/9352/2 "2016-09-08T15:22:23Z")

</div>

I have a wrapper cookbook that depends on the [chef-server cookbook](https://github.com/chef-cookbooks/chef-server) that does this. It uses [lego](https://github.com/xenolf/lego) for the Let’s Encrypt portion.

The relevant bits are below. I phased out this server recently, but the config was working as of a few months ago. Hope it helps!

```auto
# attributes/default.rb:
default['chef-server']['api_fqdn'] = 'chef.myorg.com'
default['chef-server']['addons'] = %w(manage)
default['chef-server']['configuration'] = <<-EOS
notification_email 'me@myorg.com'
nginx['non_ssl_port'] = false
nginx['ssl_certificate'] = '/etc/lego/certificates/chef.myorg.com.crt'
nginx['ssl_certificate_key'] = '/etc/lego/certificates/chef.myorg.com.key'
EOS

```

```auto
# recipes/default.rb:
execute 'download and install lego' do
  command <<-EOS
  wget https://github.com/xenolf/lego/releases/download/v0.3.0/lego_linux_amd64.tar.xz
  tar xvf lego_linux_amd64.tar.xz
  mv -v lego/lego /usr/local/bin
  EOS
  cwd '/tmp'
  creates '/usr/local/bin/lego'
end

execute 'generate certs with lego' do
  command <<-EOS
  lego --email="me@myorg.com" --domains="#{node['chef-server']['api_fqdn']}" --http :80 -a --path /etc/lego/ run
  EOS
  creates "/etc/lego/certificates/#{node['chef-server']['api_fqdn']}.crt"
end

cron 'lego-ssl-chef' do
  time :monthly
  command <<-EOS
  lego --email="me@myorg.com" --domains="#{node['chef-server']['api_fqdn']}" --http :80 -a --path /etc/lego/ renew
  EOS
end

include_recipe 'chef-server'
include_recipe 'chef-server::addons'

```

-Ameir

---

<div class="post-metadata">

**Author:** ![nclemons](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/nclemons/32/3374_2.png) [@nclemons](https://discourse.chef.io/u/nclemons)\
**Post date:** [September 8, 2016, 3:31pm UTC](https://discourse.chef.io/t/chef-server-with-letsencrypt/9352/3 "2016-09-08T15:31:47Z")

</div>

And does chef-client work with those SSL certificates ok, or do you have to manually mark them as trusted with knife ssl fetch?

---

<div class="post-metadata">

**Author:** ![ameir](https://avatars.discourse-cdn.com/v4/letter/a/8c91f0/32.png) [@ameir](https://discourse.chef.io/u/ameir)\
**Post date:** [September 8, 2016, 3:40pm UTC](https://discourse.chef.io/t/chef-server-with-letsencrypt/9352/4 "2016-09-08T15:40:22Z")

</div>

Yep, the certificates worked just fine and I didn’t have to use `knife ssl`  
to manually trust them.

---

<div class="post-metadata">

**Author:** ![nclemons](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/nclemons/32/3374_2.png) [@nclemons](https://discourse.chef.io/u/nclemons)\
**Post date:** [September 8, 2016, 3:41pm UTC](https://discourse.chef.io/t/chef-server-with-letsencrypt/9352/5 "2016-09-08T15:41:08Z")

</div>

Perfect, thank you!