# How do I instruct during bootstrap to ignore SSL errors on Windows?

**URL:** <https://discourse.chef.io/t/how-do-i-instruct-during-bootstrap-to-ignore-ssl-errors-on-windows/8469>\
**Category:** Chef Infra (archive)\
**Created:** [May 13, 2016, 5:36pm UTC](https://discourse.chef.io/t/how-do-i-instruct-during-bootstrap-to-ignore-ssl-errors-on-windows/8469 "2016-05-13T17:36:00Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![artisticcheese](https://avatars.discourse-cdn.com/v4/letter/a/258eb7/32.png) [@artisticcheese](https://discourse.chef.io/u/artisticcheese)\
**Post date:** [May 13, 2016, 5:36pm UTC](https://discourse.chef.io/t/how-do-i-instruct-during-bootstrap-to-ignore-ssl-errors-on-windows/8469/1 "2016-05-13T17:36:00Z")

</div>

Hello,

Following through tutorials for Windows and trying to figure out how do I during bootstrap tell client to ignore SSL errors during bootstrapping and subsequent operation. Is there an option for knife command to instruct client to do that?

---

<div class="post-metadata">

**Author:** ![Matt\_Wrock](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/matt_wrock/32/3394_2.png) [@Matt\_Wrock](https://discourse.chef.io/u/Matt_Wrock)\
**Post date:** [May 13, 2016, 6:44pm UTC](https://discourse.chef.io/t/how-do-i-instruct-during-bootstrap-to-ignore-ssl-errors-on-windows/8469/2 "2016-05-13T18:44:25Z")

</div>

Adding `--winrm-ssl-verify-mode verify_none` to your bootstrap command should do it.

---

<div class="post-metadata">

**Author:** ![artisticcheese](https://avatars.discourse-cdn.com/v4/letter/a/258eb7/32.png) [@artisticcheese](https://discourse.chef.io/u/artisticcheese)\
**Post date:** [May 16, 2016, 8:48pm UTC](https://discourse.chef.io/t/how-do-i-instruct-during-bootstrap-to-ignore-ssl-errors-on-windows/8469/3 "2016-05-16T20:48:05Z")

</div>

This did not work. It did not add chef server certificate to trusted certs on node.

Here is my command and result

> knife bootstrap windows winrm mivcustftp1 --winrm-user username --winrm-ssl-verify-mode verify\_none --node-name MIVCUSTFTP1

> mivcustftp1 [2016-05-16T13:45:41-07:00] ERROR: SSL Validation failure connecting to host: 172.16.218.75 - hostname "172.16.218.75" does not match the server cer  
> tificate  
> mivcustftp1 [2016-05-16T13:45:41-07:00] ERROR: SSL Error connecting to [https://172.16.218.75/organizations/chef\_dsc/nodes/MIVCUSTFTP1](https://172.16.218.75/organizations/chef_dsc/nodes/MIVCUSTFTP1), retry 1/5  
> mivcustftp1 [2016-05-16T13:45:47-07:00] ERROR: SSL Validation failure connecting to host: 172.16.218.75 - hostname "172.16.218.75" does not match the server cer  
> tificate

---

<div class="post-metadata">

**Author:** ![artisticcheese](https://avatars.discourse-cdn.com/v4/letter/a/258eb7/32.png) [@artisticcheese](https://discourse.chef.io/u/artisticcheese)\
**Post date:** [May 16, 2016, 8:51pm UTC](https://discourse.chef.io/t/how-do-i-instruct-during-bootstrap-to-ignore-ssl-errors-on-windows/8469/4 "2016-05-16T20:51:32Z")

</div>

Sorry,  
Certificate was added just issue as you can see that node does not like non matching server name/SSL certificate. Batch file does not seem to honor parameter supplied to it.  
I can see line below being executed with no ssl\_verify\_mode passed to it

chef-client -c c:/chef/client.rb -j c:/chef/first-boot.json

---

<div class="post-metadata">

**Author:** ![Matt\_Wrock](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/matt_wrock/32/3394_2.png) [@Matt\_Wrock](https://discourse.chef.io/u/Matt_Wrock)\
**Post date:** [May 16, 2016, 11:35pm UTC](https://discourse.chef.io/t/how-do-i-instruct-during-bootstrap-to-ignore-ssl-errors-on-windows/8469/5 "2016-05-16T23:35:36Z")

</div>

ok looks like this is an SSL issue between the node and chef server. Adding the parameter I mentioned above is really aimed at SSL between the workstation and the node. You can use `--node-ssl-verify-mode none` to disable verification between the node and the chef server. Note that this is not recommended in production environments.

---

<div class="post-metadata">

**Author:** ![artisticcheese](https://avatars.discourse-cdn.com/v4/letter/a/258eb7/32.png) [@artisticcheese](https://discourse.chef.io/u/artisticcheese)\
**Post date:** [May 17, 2016, 12:21am UTC](https://discourse.chef.io/t/how-do-i-instruct-during-bootstrap-to-ignore-ssl-errors-on-windows/8469/6 "2016-05-17T00:21:33Z")

</div>

Yes, it’s for testing purpouses. Problem is that I have to login to each client and modify client.rb to do that in addition of pushing client via WinRM.