# Re: Re: ChefDK and Test Kitchen SSL issue

**URL:** <https://discourse.chef.io/t/re-re-chefdk-and-test-kitchen-ssl-issue/6086>\
**Category:** Chef Infra (archive)\
**Created:** [December 18, 2014, 6:54pm UTC](https://discourse.chef.io/t/re-re-chefdk-and-test-kitchen-ssl-issue/6086 "2014-12-18T18:54:55Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ryan\_Kelley](https://avatars.discourse-cdn.com/v4/letter/r/e19b73/32.png) [@Ryan\_Kelley](https://discourse.chef.io/u/Ryan_Kelley)\
**Post date:** [December 18, 2014, 6:54pm UTC](https://discourse.chef.io/t/re-re-chefdk-and-test-kitchen-ssl-issue/6086/1 "2014-12-18T18:54:55Z")

</div>

using straight curl alone seems to work fine. i had a co-worker confirm  
also.

rykelley@EOS01:~$ curl -I  
[https://opscode-omnibus-packages.s3.amazonaws.com/windows/2008r2/x86\_64/chefdk-0.3.5-1.msi](https://opscode-omnibus-packages.s3.amazonaws.com/windows/2008r2/x86_64/chefdk-0.3.5-1.msi)  
HTTP/1.1 200 OK  
x-amz-id-2:  
w6BxBcDRByJUndEiNPu8sEXVmdsKx/r6XweQXrTmX7nVk5U3NyzJ1qw0s8+FT2soQfjHUBSn+9E=  
x-amz-request-id: 855D326C32841822  
Date: Thu, 18 Dec 2014 18:52:41 GMT  
Last-Modified: Fri, 14 Nov 2014 02:57:44 GMT  
ETag: "39a194da347481a41f88f0b02bc0fcc6"  
Accept-Ranges: bytes  
Content-Type: application/x-msi  
Content-Length: 229429754  
Server: AmazonS3

how do i find how vagrant is calling curl ?

On Thu Dec 18 2014 at 11:16:01 AM Daniel DeLeo [dan@kallistec.com](mailto:dan@kallistec.com) wrote:

> On Thursday, December 18, 2014 at 9:58 AM, Ryan Kelley wrote:
> 
> > i'm running into this issue with the out of the box install of ChefDK on  
> > both a OSX system and Ubuntu. using chef generate cookbook and getting the  
> > default .kitchen.yml file and then running kitchen create to pull down and  
> > create the box. i'm getting an error at what i'm assuming is the embedded  
> > curl operation to pull down opscode ubuntu or centos box i get this
> > 
> > > > > > > > ------Exception-------  
> > > > > > > > Class: Kitchen::ActionFailed  
> > > > > > > > Message: Failed to complete #create action: [Expected  
> > > > > > > > process to exit with [0], but received '1'
> > 
> > ---- Begin output of vagrant up --no-provision --provider=virtualbox ----  
> > STDOUT: Bringing machine 'default' up with 'virtualbox' provider...  
> > ==\> default: Box 'opscode-ubuntu-12.04' could not be found. Attempting  
> > to find and install...  
> > default: Box Provider: virtualbox  
> > default: Box Version: \>= 0  
> > ==\> default: Adding box 'opscode-ubuntu-12.04' (v0) for provider:  
> > virtualbox  
> > default: Downloading: [https://opscode-vm-bento.s3.amazonaws.com/vagrant/](https://opscode-vm-bento.s3.amazonaws.com/vagrant/)  
> > virtualbox/opscode\_ubuntu-12.04\_chef-provisionerless.box
> > 
> > SSL certificate problem: unable to get local issuer certificate  
> > More details here: [curl - SSL CA Certificates](http://curl.haxx.se/docs/sslcerts.html)
> > 
> > curl performs SSL certificate verification by default, using a "bundle"  
> > of Certificate Authority (CA) public keys (CA certs). If the default  
> > bundle file isn't adequate, you can specify an alternate file  
> > using the --cacert option.  
> > If this HTTPS server uses a certificate signed by a CA represented in  
> > the bundle, the certificate verification probably failed due to a  
> > problem with the certificate (it might be expired, or the name might  
> > not match the domain name in the URL).  
> > If you'd like to turn off curl's verification of the certificate, use  
> > the -k (or --insecure) option
> > 
> > this has to be a bug seeing that myself and other co-workers are getting  
> > the same error with DK 3.5.1 .  
> > i have tried adding the embedded SSL cert in the chefdk package to my  
> > local cert store , no dice. on my mac i have set insecure globally for curl  
> > in .curlrc which works ( i dont want this to be the fix) ,that does not  
> > work on my linux machines. i'm running the support versions of ubuntu for  
> > DK. really need to figure out what i'm doing wrong and how to fix it.  
> > thanks  
> > Ryan
> 
> Can you determine which copy of curl vagrant is using, and what CA cert  
> bundle curl is using? Also, are you unable to make any HTTPS requests, or  
> just to S3, e.g., what does `curl -I https://google.com` say?
> 
> I wonder if this is the same issue as [Chef Software, Inc. · GitHub](https://github.com/opscode/)  
> chef-dk/issues/199#issuecomment-60644778 In short, some root certs got  
> removed from the curl CA bundle because they’re using SHA1, but AWS’s cert  
> is signed by one of these, so you need it.
> 
> --  
> Daniel DeLeo

---

<div class="post-metadata">

**Author:** ![kallistec](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/kallistec/32/23_2.png) [@kallistec](https://discourse.chef.io/u/kallistec)\
**Post date:** [December 18, 2014, 7:33pm UTC](https://discourse.chef.io/t/re-re-chefdk-and-test-kitchen-ssl-issue/6086/2 "2014-12-18T19:33:49Z")

</div>

On Thursday, December 18, 2014 at 10:54 AM, Ryan Kelley wrote:

> using straight curl alone seems to work fine. i had a co-worker confirm also.
> 
> rykelley@EOS01:~$ curl -I [https://opscode-omnibus-packages.s3.amazonaws.com/windows/2008r2/x86\_64/chefdk-0.3.5-1.msi](https://opscode-omnibus-packages.s3.amazonaws.com/windows/2008r2/x86_64/chefdk-0.3.5-1.msi)  
> HTTP/1.1 200 OK  
> x-amz-id-2: w6BxBcDRByJUndEiNPu8sEXVmdsKx/r6XweQXrTmX7nVk5U3NyzJ1qw0s8+FT2soQfjHUBSn+9E=  
> x-amz-request-id: 855D326C32841822  
> Date: Thu, 18 Dec 2014 18:52:41 GMT  
> Last-Modified: Fri, 14 Nov 2014 02:57:44 GMT  
> ETag: "39a194da347481a41f88f0b02bc0fcc6"  
> Accept-Ranges: bytes  
> Content-Type: application/x-msi  
> Content-Length: 229429754  
> Server: AmazonS3
> 
> how do i find how vagrant is calling curl ?  
> I poked around in the /Applications/Vagrant directory on my mac and it looks like vagrant is bundling its own version of curl and its own cacert.pem (though I haven’t upgraded vagrant in forever, I have 1.4.2). Are you _always_ seeing the errors from vagrant downloading boxes from S3 like in your original post, or do you get them during other operations as well? If you’re only seeing errors from vagrant, it’s possible they got bit by the Curl CA cert thing I linked. You might want to peruse their issue tracker to see if it’s been reported and fixed.

--  
Daniel DeLeo

---

<div class="post-metadata">

**Author:** ![Ryan\_Kelley](https://avatars.discourse-cdn.com/v4/letter/r/e19b73/32.png) [@Ryan\_Kelley](https://discourse.chef.io/u/Ryan_Kelley)\
**Post date:** [January 7, 2015, 4:06am UTC](https://discourse.chef.io/t/re-re-chefdk-and-test-kitchen-ssl-issue/6086/3 "2015-01-07T04:06:12Z")

</div>

> <https://github.com/hashicorp/vagrant/issues/5001#issuecomment-68931516>
>
> I can't \`vagrant up\` or \`vagrant box add\` this puppetlabs Vagrant Cloud box on U…buntu 14.04 x64 and Vagrant 1.7.1 x64 or 1.7.0 x64 (downloaded and installed the \`.deb\` from the Vagrant website). I get this error message from cURL.
> 
> \`\`\` text
> $ vagrant box add puppetlabs/centos-6.5-64-puppet --force
> ==\> box: Loading metadata for box 'puppetlabs/centos-6.5-64-puppet'
> box: URL: https://atlas.hashicorp.com/puppetlabs/centos-6.5-64-puppet
> This box can work with multiple providers! The providers that it
> can work with are listed below. Please review the list and choose
> the provider you will be working with.
> 
> 1) virtualbox
> 2) vmware\_desktop
> 3) vmware\_fusion
> 
> Enter your choice: 1
> ==\> box: Adding box 'puppetlabs/centos-6.5-64-puppet' (v1.0.0) for provider: virtualbox
> box: Downloading: https://atlas.hashicorp.com/puppetlabs/boxes/centos-6.5-64-puppet/
> versions/1.0.0/providers/virtualbox.box
> An error occurred while downloading the remote file. The error
> message, if any, is reproduced below. Please fix this error and try
> again.
> 
> SSL certificate problem: unable to get local issuer certificate
> More details here: http://curl.haxx.se/docs/sslcerts.html
> 
> curl performs SSL certificate verification by default, using a "bundle"
> of Certificate Authority (CA) public keys (CA certs). If the default
> bundle file isn't adequate, you can specify an alternate file
> using the --cacert option.
> If this HTTPS server uses a certificate signed by a CA represented in
> the bundle, the certificate verification probably failed due to a
> problem with the certificate (it might be expired, or the name might
> not match the domain name in the URL).
> If you'd like to turn off curl's verification of the certificate, use
> the -k (or --insecure) option.
> \`\`\`
> 
> I can download the box directly using the system cURL
> 
> \`\`\` text
> $ curl -O -L https://vagrantcloud.com/puppetlabs/boxes/centos-6.5-64-puppet/versions/1.0.0/providers/virtualbox.box
> \`\`\`
> 
> and the Vagrant embedded cURL
> 
> \`\`\` text
> $ /opt/vagrant/bin/../embedded/bin/curl -O -L https://vagrantcloud.com/puppetlabs/boxes/centos-6.5-64-puppet/versions/1.0.0/providers/virtualbox.box
> \`\`\`
> 
> I downgraded to Vagrant 1.6.5 x64 from the \`.deb\` on the website and tried again and it worked.
> 
> \---
> 
> Here's the \[command debug log\](https://gist.github.com/AnthonyMastrean/23bc15b7bf9fb59c4cb4)

Looks like this issue was just fixed

Sent from my iPad

> On Dec 18, 2014, at 12:33 PM, Daniel DeLeo [dan@kallistec.com](mailto:dan@kallistec.com) wrote:
> 
> > On Thursday, December 18, 2014 at 10:54 AM, Ryan Kelley wrote:  
> > using straight curl alone seems to work fine. i had a co-worker confirm also.
> > 
> > rykelley@EOS01:~$ curl -I [https://opscode-omnibus-packages.s3.amazonaws.com/windows/2008r2/x86\_64/chefdk-0.3.5-1.msi](https://opscode-omnibus-packages.s3.amazonaws.com/windows/2008r2/x86_64/chefdk-0.3.5-1.msi)  
> > HTTP/1.1 200 OK  
> > x-amz-id-2: w6BxBcDRByJUndEiNPu8sEXVmdsKx/r6XweQXrTmX7nVk5U3NyzJ1qw0s8+FT2soQfjHUBSn+9E=  
> > x-amz-request-id: 855D326C32841822  
> > Date: Thu, 18 Dec 2014 18:52:41 GMT  
> > Last-Modified: Fri, 14 Nov 2014 02:57:44 GMT  
> > ETag: "39a194da347481a41f88f0b02bc0fcc6"  
> > Accept-Ranges: bytes  
> > Content-Type: application/x-msi  
> > Content-Length: 229429754  
> > Server: AmazonS3
> > 
> > how do i find how vagrant is calling curl ?  
> > I poked around in the /Applications/Vagrant directory on my mac and it looks like vagrant is bundling its own version of curl and its own cacert.pem (though I haven’t upgraded vagrant in forever, I have 1.4.2). Are you _always_ seeing the errors from vagrant downloading boxes from S3 like in your original post, or do you get them during other operations as well? If you’re only seeing errors from vagrant, it’s possible they got bit by the Curl CA cert thing I linked. You might want to peruse their issue tracker to see if it’s been reported and fixed.
> 
> --  
> Daniel DeLeo

---

<div class="post-metadata">

**Author:** ![tknerr](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/tknerr/32/21_2.png) [@tknerr](https://discourse.chef.io/u/tknerr)\
**Post date:** [January 7, 2015, 12:06pm UTC](https://discourse.chef.io/t/re-re-chefdk-and-test-kitchen-ssl-issue/6086/4 "2015-01-07T12:06:40Z")

</div>

Yes, I had it in test-kitchen too (same stacktrace as first mail in  
this thread) and can tell that this is now fixed with Vagrant 1.7.2

Cheers, Torben

On Wed, Jan 7, 2015 at 5:06 AM, Ryan Kelley [rykelley@gmail.com](mailto:rykelley@gmail.com) wrote:

> [Cannot download puppetlabs Vagrant Cloud boxes without cURL cert error · Issue #5001 · hashicorp/vagrant · GitHub](https://github.com/mitchellh/vagrant/issues/5001#issuecomment-68931516)
> 
> Looks like this issue was just fixed
> 
> Sent from my iPad
> 
> On Dec 18, 2014, at 12:33 PM, Daniel DeLeo [dan@kallistec.com](mailto:dan@kallistec.com) wrote:
> 
> On Thursday, December 18, 2014 at 10:54 AM, Ryan Kelley wrote:
> 
> using straight curl alone seems to work fine. i had a co-worker confirm  
> also.
> 
> rykelley@EOS01:~$ curl -I  
> [https://opscode-omnibus-packages.s3.amazonaws.com/windows/2008r2/x86\_64/chefdk-0.3.5-1.msi](https://opscode-omnibus-packages.s3.amazonaws.com/windows/2008r2/x86_64/chefdk-0.3.5-1.msi)
> 
> HTTP/1.1 200 OK
> 
> x-amz-id-2:  
> w6BxBcDRByJUndEiNPu8sEXVmdsKx/r6XweQXrTmX7nVk5U3NyzJ1qw0s8+FT2soQfjHUBSn+9E=
> 
> x-amz-request-id: 855D326C32841822
> 
> Date: Thu, 18 Dec 2014 18:52:41 GMT
> 
> Last-Modified: Fri, 14 Nov 2014 02:57:44 GMT
> 
> ETag: "39a194da347481a41f88f0b02bc0fcc6"
> 
> Accept-Ranges: bytes
> 
> Content-Type: application/x-msi
> 
> Content-Length: 229429754
> 
> Server: AmazonS3
> 
> how do i find how vagrant is calling curl ?
> 
> I poked around in the /Applications/Vagrant directory on my mac and it looks  
> like vagrant is bundling its own version of curl and its own cacert.pem  
> (though I haven’t upgraded vagrant in forever, I have 1.4.2). Are you  
> _always_ seeing the errors from vagrant downloading boxes from S3 like in  
> your original post, or do you get them during other operations as well? If  
> you’re only seeing errors from vagrant, it’s possible they got bit by the  
> Curl CA cert thing I linked. You might want to peruse their issue tracker to  
> see if it’s been reported and fixed.
> 
> --  
> Daniel DeLeo