# Installation Failure (PEBKAC, more than likely)

**URL:** <https://discourse.chef.io/t/installation-failure-pebkac-more-than-likely/1209>\
**Category:** Chef Infra (archive)\
**Created:** [June 17, 2009, 5:16pm UTC](https://discourse.chef.io/t/installation-failure-pebkac-more-than-likely/1209 "2009-06-17T17:16:48Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Joseph\_Smith1](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/joseph_smith1/32/931_2.png) [@Joseph\_Smith1](https://discourse.chef.io/u/Joseph_Smith1)\
**Post date:** [June 17, 2009, 5:16pm UTC](https://discourse.chef.io/t/installation-failure-pebkac-more-than-likely/1209/1 "2009-06-17T17:16:48Z")

</div>

Hello All -

I’m having issues running chef-client post-validation through the webUI,  
wondered if anyone can spot my ‘gotcha’.  
Error as reported in server.log:  
~ WARNING: making https request to  
[https://puck.test.5to1.com/openid/server/node/Titania](https://puck.test.5to1.com/openid/server/node/Titania) without verifying  
server certificate; no CA path was specified.  
~ Discovery failed for [https://puck.XXX.XXX.com/openid/server/node/Titania:](https://puck.XXX.XXX.com/openid/server/node/Titania:)  
Failed to fetch identity URL  
[https://puck.XXX.XXX.com/openid/server/node/Titania](https://puck.XXX.XXX.com/openid/server/node/Titania) : Error connecting to  
SSL URL [https://puck.XXX.XXX.com/openid/server/node/Titania:](https://puck.XXX.XXX.com/openid/server/node/Titania:) hostname does  
not match - (Merb::ControllerExceptions::BadRequest)  
Error running chef-client on Titania: ([Titania.XXX.XXX.com](http://Titania.XXX.XXX.com))  
/usr/lib/ruby/1.8/open-uri.rb:32:in `initialize’: Permission denied -  
/var/log/chef/client.log (Errno::EACCES)  
(let me know if trace is important)  
@Titania: openssl s\_client -connect [puck.XXX.XXX.com](http://puck.XXX.XXX.com)  
…  
CN result:  
subject=/C=US/ST=Several/L=Locality/O=Example/OU=Operations/CN=Puck./emailAddress=ops@  
issuer=/C=US/ST=Several/L=Locality/O=Example/OU=Operations/CN=Puck./emailAddress=ops@

Notes:  
OS: Ubuntu 8.10  
Puck and Titania are on the same subnet

---

<div class="post-metadata">

**Author:** ![Michael\_Hale](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/michael_hale/32/834_2.png) [@Michael\_Hale](https://discourse.chef.io/u/Michael_Hale)\
**Post date:** [June 17, 2009, 5:27pm UTC](https://discourse.chef.io/t/installation-failure-pebkac-more-than-likely/1209/2 "2009-06-17T17:27:21Z")

</div>

I'm guessing that you may need to update /etc/chef/server.rb to  
include your openid provider.

openid\_providers ["[https://puck.test.5to1.com/openid/](https://puck.test.5to1.com/openid/)" ]

On Wed, Jun 17, 2009 at 1:16 PM, Joseph Smith[joseph.smith@5to1.com](mailto:joseph.smith@5to1.com) wrote:

> Hello All -
> 
> I'm having issues running chef-client post-validation through the webUI,  
> wondered if anyone can spot my 'gotcha'.  
> Error as reported in server.log:  
> ~ WARNING: making https request to  
> [https://puck.test.5to1.com/openid/server/node/Titania](https://puck.test.5to1.com/openid/server/node/Titania) without verifying  
> server certificate; no CA path was specified.  
> ~ Discovery failed for [https://puck.XXX.XXX.com/openid/server/node/Titania:](https://puck.XXX.XXX.com/openid/server/node/Titania:)  
> Failed to fetch identity URL  
> [https://puck.XXX.XXX.com/openid/server/node/Titania](https://puck.XXX.XXX.com/openid/server/node/Titania) : Error connecting to  
> SSL URL [https://puck.XXX.XXX.com/openid/server/node/Titania:](https://puck.XXX.XXX.com/openid/server/node/Titania:) hostname does  
> not match - (Merb::ControllerExceptions::BadRequest)  
> Error running chef-client on Titania: ([Titania.XXX.XXX.com](http://Titania.XXX.XXX.com))  
> /usr/lib/ruby/1.8/open-uri.rb:32:in `initialize': Permission denied -  
> /var/log/chef/client.log (Errno::EACCES)  
> (let me know if trace is important)  
> @Titania: openssl s\_client -connect [puck.XXX.XXX.com](http://puck.XXX.XXX.com)  
> ...  
> CN result:  
> subject=/C=US/ST=Several/L=Locality/O=Example/OU=Operations/CN=Puck./emailAddress=ops@  
> issuer=/C=US/ST=Several/L=Locality/O=Example/OU=Operations/CN=Puck./emailAddress=ops@
> 
> Notes:  
> OS: Ubuntu 8.10  
> Puck and Titania are on the same subnet

---

<div class="post-metadata">

**Author:** ![Adam\_Jacob](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/adam_jacob/32/292_2.png) [@Adam\_Jacob](https://discourse.chef.io/u/Adam_Jacob)\
**Post date:** [June 17, 2009, 6:02pm UTC](https://discourse.chef.io/t/installation-failure-pebkac-more-than-likely/1209/3 "2009-06-17T18:02:38Z")

</div>

It looks like you generated the certificates with capitalized  
hostnames that are not fully qualified, which is your issue. The SSL  
certificate must match the fqdn you are using in chef - so try again  
with certificates build for [cn=puck.xxx.xxx.com](http://cn=puck.xxx.xxx.com).

Adam

On Wed, Jun 17, 2009 at 10:16 AM, Joseph Smith[joseph.smith@5to1.com](mailto:joseph.smith@5to1.com) wrote:

> Hello All -
> 
> I'm having issues running chef-client post-validation through the webUI,  
> wondered if anyone can spot my 'gotcha'.  
> Error as reported in server.log:  
> ~ WARNING: making https request to  
> [https://puck.test.5to1.com/openid/server/node/Titania](https://puck.test.5to1.com/openid/server/node/Titania) without verifying  
> server certificate; no CA path was specified.  
> ~ Discovery failed for [https://puck.XXX.XXX.com/openid/server/node/Titania:](https://puck.XXX.XXX.com/openid/server/node/Titania:)  
> Failed to fetch identity URL  
> [https://puck.XXX.XXX.com/openid/server/node/Titania](https://puck.XXX.XXX.com/openid/server/node/Titania) : Error connecting to  
> SSL URL [https://puck.XXX.XXX.com/openid/server/node/Titania:](https://puck.XXX.XXX.com/openid/server/node/Titania:) hostname does  
> not match - (Merb::ControllerExceptions::BadRequest)  
> Error running chef-client on Titania: ([Titania.XXX.XXX.com](http://Titania.XXX.XXX.com))  
> /usr/lib/ruby/1.8/open-uri.rb:32:in `initialize': Permission denied -  
> /var/log/chef/client.log (Errno::EACCES)  
> (let me know if trace is important)  
> @Titania: openssl s\_client -connect [puck.XXX.XXX.com](http://puck.XXX.XXX.com)  
> ...  
> CN result:  
> subject=/C=US/ST=Several/L=Locality/O=Example/OU=Operations/CN=Puck./emailAddress=ops@  
> issuer=/C=US/ST=Several/L=Locality/O=Example/OU=Operations/CN=Puck./emailAddress=ops@
> 
> Notes:  
> OS: Ubuntu 8.10  
> Puck and Titania are on the same subnet

--  
Opscode, Inc.  
Adam Jacob, CTO  
T: (206) 508-4759 E: [adam@opscode.com](mailto:adam@opscode.com)

---

<div class="post-metadata">

**Author:** ![Joshua\_Timberman](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/joshua_timberman/32/424_2.png) [@Joshua\_Timberman](https://discourse.chef.io/u/Joshua_Timberman)\
**Post date:** [June 17, 2009, 6:05pm UTC](https://discourse.chef.io/t/installation-failure-pebkac-more-than-likely/1209/4 "2009-06-17T18:05:49Z")

</div>

Hello Joseph,

Your 'CN=Puck.' isn't a fully qualified domain. You can specify this  
for the SSL certificate request in a json file per the Chef  
Installation document.

I ran into similar troubles on EC2 nodes where the internal hostname  
contained upcase letters (ie, domU-xx-xx-xx). Forcing these to be  
lowercase via the json file (chef server\_fqdn, for example) resolved  
the issue for me.

On Jun 17, 2009, at 11:16 AM, Joseph Smith wrote:

> Hello All -
> 
> I'm having issues running chef-client post-validation through the  
> webUI, wondered if anyone can spot my 'gotcha'.  
> Error as reported in server.log:  
> ~ WARNING: making https request to [https://puck.test.5to1.com/openid/server/node/Titania](https://puck.test.5to1.com/openid/server/node/Titania)  
> without verifying server certificate; no CA path was specified.  
> ~ Discovery failed for [https://puck.XXX.XXX.com/openid/server/node/Titania](https://puck.XXX.XXX.com/openid/server/node/Titania)  
> : Failed to fetch identity URL [https://puck.XXX.XXX.com/openid/server/node/Titania](https://puck.XXX.XXX.com/openid/server/node/Titania)  
> : Error connecting to SSL URL [https://puck.XXX.XXX.com/openid/server/node/Titania](https://puck.XXX.XXX.com/openid/server/node/Titania)  
> : hostname does not match - (Merb::ControllerExceptions::BadRequest)  
> Error running chef-client on Titania: ([Titania.XXX.XXX.com](http://Titania.XXX.XXX.com))  
> /usr/lib/ruby/1.8/open-uri.rb:32:in `initialize': Permission denied
> 
> - /var/log/chef/client.log (Errno::EACCES)  
> (let me know if trace is important)  
> @Titania: openssl s\_client -connect [puck.XXX.XXX.com](http://puck.XXX.XXX.com)  
> ...  
> CN result:  
> subject=/C=US/ST=Several/L=Locality/O=Example/OU=Operations/CN=Puck./  
> emailAddress=ops@  
> issuer=/C=US/ST=Several/L=Locality/O=Example/OU=Operations/CN=Puck./  
> emailAddress=ops@
> 
> Notes:  
> OS: Ubuntu 8.10  
> Puck and Titania are on the same subnet

--  
Opscode, Inc  
Joshua Timberman, Senior System Engineer  
C: 720.878.4322 E: [joshua@opscode.com](mailto:joshua@opscode.com)

---

<div class="post-metadata">

**Author:** ![Adam\_Jacob](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/adam_jacob/32/292_2.png) [@Adam\_Jacob](https://discourse.chef.io/u/Adam_Jacob)\
**Post date:** [June 17, 2009, 6:52pm UTC](https://discourse.chef.io/t/installation-failure-pebkac-more-than-likely/1209/5 "2009-06-17T18:52:20Z")

</div>

Also, capital letters are not valid in hostnames.

Adam

On Wed, Jun 17, 2009 at 11:05 AM, Joshua Timberman[joshua@opscode.com](mailto:joshua@opscode.com) wrote:

> Hello Joseph,
> 
> Your 'CN=Puck.' isn't a fully qualified domain. You can specify this for the  
> SSL certificate request in a json file per the Chef Installation document.
> 
> I ran into similar troubles on EC2 nodes where the internal hostname  
> contained upcase letters (ie, domU-xx-xx-xx). Forcing these to be lowercase  
> via the json file (chef server\_fqdn, for example) resolved the issue for me.
> 
> On Jun 17, 2009, at 11:16 AM, Joseph Smith wrote:
> 
> > Hello All -
> > 
> > I'm having issues running chef-client post-validation through the webUI,  
> > wondered if anyone can spot my 'gotcha'.  
> > Error as reported in server.log:  
> > ~ WARNING: making https request to  
> > [https://puck.test.5to1.com/openid/server/node/Titania](https://puck.test.5to1.com/openid/server/node/Titania) without verifying  
> > server certificate; no CA path was specified.  
> > ~ Discovery failed for  
> > [https://puck.XXX.XXX.com/openid/server/node/Titania:](https://puck.XXX.XXX.com/openid/server/node/Titania:) Failed to fetch  
> > identity URL [https://puck.XXX.XXX.com/openid/server/node/Titania](https://puck.XXX.XXX.com/openid/server/node/Titania) : Error  
> > connecting to SSL URL [https://puck.XXX.XXX.com/openid/server/node/Titania:](https://puck.XXX.XXX.com/openid/server/node/Titania:)  
> > hostname does not match - (Merb::ControllerExceptions::BadRequest)  
> > Error running chef-client on Titania: ([Titania.XXX.XXX.com](http://Titania.XXX.XXX.com))  
> > /usr/lib/ruby/1.8/open-uri.rb:32:in `initialize': Permission denied -  
> > /var/log/chef/client.log (Errno::EACCES)  
> > (let me know if trace is important)  
> > @Titania: openssl s\_client -connect [puck.XXX.XXX.com](http://puck.XXX.XXX.com)  
> > ...  
> > CN result:
> > 
> > subject=/C=US/ST=Several/L=Locality/O=Example/OU=Operations/CN=Puck./emailAddress=ops@
> > 
> > issuer=/C=US/ST=Several/L=Locality/O=Example/OU=Operations/CN=Puck./emailAddress=ops@
> > 
> > Notes:  
> > OS: Ubuntu 8.10  
> > Puck and Titania are on the same subnet
> 
> --  
> Opscode, Inc  
> Joshua Timberman, Senior System Engineer  
> C: 720.878.4322 E: [joshua@opscode.com](mailto:joshua@opscode.com)

--  
Opscode, Inc.  
Adam Jacob, CTO  
T: (206) 508-4759 E: [adam@opscode.com](mailto:adam@opscode.com)