# Knife-ec2 / Excon ssl verification error

**URL:** <https://discourse.chef.io/t/knife-ec2-excon-ssl-verification-error/5816>\
**Category:** Chef Infra (archive)\
**Created:** [October 3, 2014, 1:33pm UTC](https://discourse.chef.io/t/knife-ec2-excon-ssl-verification-error/5816 "2014-10-03T13:33:51Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Gabriel\_Rosendorf](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/gabriel_rosendorf/32/62_2.png) [@Gabriel\_Rosendorf](https://discourse.chef.io/u/Gabriel_Rosendorf)\
**Post date:** [October 3, 2014, 1:33pm UTC](https://discourse.chef.io/t/knife-ec2-excon-ssl-verification-error/5816/1 "2014-10-03T13:33:51Z")

</div>

Has anyone gotten this error running knife-ec2 commands with excon 0.39.6  
(latest ChefDK) on OS X 10.9.5?

ERROR: Excon::Errors::SocketError: Unable to verify certificate, please set  
`Excon.defaults[:ssl_ca_path] = path_to_certs`, `ENV['SSL_CERT_DIR'] = path_to_certs`, `Excon.defaults[:ssl_ca_file] = path_to_file`,  
`ENV['SSL_CERT_FILE'] = path_to_file` or `Excon.defaults[:ssl_verify_peer] = false` (less secure).

Adding Excon.defaults[:ssl\_verify\_peer] = false to my knife.rb makes it  
work, but doesn’t give me a warm and fuzzy feeling. Any help would be  
greatly appreciated!

---

<div class="post-metadata">

**Author:** ![kallistec](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/kallistec/32/23_2.png) [@kallistec](https://discourse.chef.io/u/kallistec)\
**Post date:** [October 7, 2014, 1:49am UTC](https://discourse.chef.io/t/knife-ec2-excon-ssl-verification-error/5816/2 "2014-10-07T01:49:42Z")

</div>

On Friday, October 3, 2014 at 6:33 AM, Gabriel Rosendorf wrote:

> Has anyone gotten this error running knife-ec2 commands with excon 0.39.6 (latest ChefDK) on OS X 10.9.5?
> 
> ERROR: Excon::Errors::SocketError: Unable to verify certificate, please set `Excon.defaults[:ssl_ca_path] = path_to_certs`, `ENV['SSL_CERT_DIR'] = path_to_certs`, `Excon.defaults[:ssl_ca_file] = path_to_file`, `ENV['SSL_CERT_FILE'] = path_to_file` or `Excon.defaults[:ssl_verify_peer] = false` (less secure).
> 
> Adding Excon.defaults[:ssl\_verify\_peer] = false to my knife.rb makes it work, but doesn't give me a warm and fuzzy feeling. Any help would be greatly appreciated!

I don’t know how excon configures things, but you should have a file /opt/chefdk/embedded/ssl/certs/cacert.pem which is the CA certificate and should be baked in to OpenSSL. Do other SSL connections work, e.g., if you set `ssl_verify_mode :verify_peer` in your knife.rb, does knife connect to a chef-server over SSL properly?

--  
Daniel DeLeo