# SSL errors on windows

**URL:** <https://discourse.chef.io/t/ssl-errors-on-windows/5123>\
**Category:** Chef Infra (archive)\
**Created:** [March 3, 2014, 4:01pm UTC](https://discourse.chef.io/t/ssl-errors-on-windows/5123 "2014-03-03T16:01:24Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jeppe\_Nejsum\_Madsen](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/jeppe_nejsum_madsen/32/258_2.png) [@Jeppe\_Nejsum\_Madsen](https://discourse.chef.io/u/Jeppe_Nejsum_Madsen)\
**Post date:** [March 3, 2014, 4:01pm UTC](https://discourse.chef.io/t/ssl-errors-on-windows/5123/1 "2014-03-03T16:01:24Z")

</div>

Hi

I’ve started to look into using chef-solo to configure our workstations.  
I’m running into the SSL problem shown below

I can see this is somewhat related, but should be fixed:  
[https://tickets.opscode.com/browse/CHEF-4649](https://tickets.opscode.com/browse/CHEF-4649)

Any other suggestions to solve this?

/Jeppe

Starting Chef Client, version 11.10.2

Recipe: git::windows

- windows\_package[Git version 1.8.1.2-preview20130201] action  
installRecipe: \<  
Dynamically Defined Resource\>
- remote\_file[c:/chef/Git-1.8.1.2-preview20130201.exe] action  
create[2014-03-0  
3T16:35:24+01:00] ERROR: SSL Validation failure connecting to host:  
msysgit.goog  
[lecode.com](http://lecode.com) - SSL\_connect SYSCALL returned=5 errno=0 state=SSLv2/v3 read  
server h  
ello A

---

<div class="post-metadata">

**Author:** ![Torben\_Knerr](https://avatars.discourse-cdn.com/v4/letter/t/ba8739/32.png) [@Torben\_Knerr](https://discourse.chef.io/u/Torben_Knerr)\
**Post date:** [March 3, 2014, 8:12pm UTC](https://discourse.chef.io/t/ssl-errors-on-windows/5123/2 "2014-03-03T20:12:51Z")

</div>

Hi Jeppe,

seeing this quite often in recent times. Might all be the same:

> <https://github.com/chef-boneyard/vagrant-omnibus/issues/64>
>
> This issue was originally reported by @tknerr as \[a comment\](https://github.com/…schisamo/vagrant-omnibus/issues/6#issuecomment-35963392) on #6:
> \## 
> 
> FYI: I was also running into the SSL cert verification issue described here:
> http://railsapps.github.io/openssl-certificate-verify-failed.html
> 
> As a result, I got:
> 
> \`\`\`
> There are errors in the configuration of this machine. Please fix
> the following errors and try again:
> 
> vagrant-omnibus:
> \* '11.10.4' is not a valid version of Chef.
> 
> A list of valid versions can be found at: http://www.opscode.com/chef/install/
> \`\`\`
> 
> Baiscally any Chef version specified via \`config.omnibus.chef\_version\` failed.
> 
> This was on Windows 7 box, with ruby 1.9.3p125 and rubygems 2.0.3
> 
> I could fix it by downloading the \`cacert.pem\` and setting \`SSL\_CERT\_FILE\` as described here:
> https://gist.github.com/fnichol/867550
> 
> After that it worked again...

> <https://github.com/hashicorp/vagrant/issues/3036>
>
> The embedded OpenSSL in Vagrant is missing the root certificate bundles.
> 
> Here's… an example of the problem:
> 
> \`\`\` bash
> ∵ /usr/bin/ruby -e "require 'open-uri' ; open('https://www.vagrantup.com/') { |f| puts f.read.size }"
> 4837
> 
> ∵ /Applications/Vagrant/embedded/bin/ruby -e "require 'open-uri' ; open('https://www.vagrantup.com/') { |f| puts f.read.size }"
> /Applications/Vagrant/embedded/lib/ruby/2.0.0/net/http.rb:918:in \`connect': SSL\_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed (OpenSSL::SSL::SSLError)
> from /Applications/Vagrant/embedded/lib/ruby/2.0.0/net/http.rb:918:in \`block in connect'
> from /Applications/Vagrant/embedded/lib/ruby/2.0.0/timeout.rb:52:in \`timeout'
> from /Applications/Vagrant/embedded/lib/ruby/2.0.0/net/http.rb:918:in \`connect'
> from /Applications/Vagrant/embedded/lib/ruby/2.0.0/net/http.rb:862:in \`do\_start'
> from /Applications/Vagrant/embedded/lib/ruby/2.0.0/net/http.rb:851:in \`start'
> from /Applications/Vagrant/embedded/lib/ruby/2.0.0/open-uri.rb:313:in \`open\_http'
> from /Applications/Vagrant/embedded/lib/ruby/2.0.0/open-uri.rb:708:in \`buffer\_open'
> from /Applications/Vagrant/embedded/lib/ruby/2.0.0/open-uri.rb:210:in \`block in open\_loop'
> from /Applications/Vagrant/embedded/lib/ruby/2.0.0/open-uri.rb:208:in \`catch'
> from /Applications/Vagrant/embedded/lib/ruby/2.0.0/open-uri.rb:208:in \`open\_loop'
> from /Applications/Vagrant/embedded/lib/ruby/2.0.0/open-uri.rb:149:in \`open\_uri'
> from /Applications/Vagrant/embedded/lib/ruby/2.0.0/open-uri.rb:688:in \`open'
> from /Applications/Vagrant/embedded/lib/ruby/2.0.0/open-uri.rb:34:in \`open'
> from -e:1:in \`\<main\>'
> \`\`\`
> 
> It looks like \`libcrypto.dynlib\` is looking for \`cert.pem\` in \`/vagrant-installer/staging/embedded/ssl/cert.pem\`:
> 
> \`\`\` bash
> ∵ strings -a /Applications/Vagrant/embedded/lib/libcrypto.dylib | grep /cert.pem
> /vagrant-installer/staging/embedded/ssl/cert.pem
> \`\`\`
> 
> As a counter example, the Homebrew version of OpenSSL:
> 
> \`\`\` bash
> ∵ strings -a /usr/local/opt/openssl/lib/libcrypto.dylib | grep /cert.pem
> /usr/local/etc/openssl/cert.pem
> \`\`\`
> 
> What Homebrew does to provide some certificates is (get them from the Keychain) \[https://github.com/Homebrew/homebrew/blob/master/Library/Formula/openssl.rb#L71\]:
> 
> \`\`\` bash
> security find-certificate -a -p /Library/Keychains/System.keychain \> cert.pem
> security find-certificate -a -p /System/Library/Keychains/SystemRootCertificates.keychain \>\> cert.pem
> \`\`\`
> 
> However, you'll have to adjust the way you build Vagrant's OpenSSL so that it expects the \`cert.pem\` someplace within the embedded directory.
> 
> Of course, you could also use the \`export SSL\_CERT\_FILE=/path/to/cert.pem\` method within the \`vagrant\` command but it won't fix people trying to use the embedded ruby directly.
> 
> Ciao!

> <https://github.com/berkshelf/berkshelf/issues/1030>
>
> We should investigate bundling CA certs for Enterprise Chef, etc like \[Bundler d…oes\](https://github.com/bundler/bundler/blob/bb8f694147cb07cd820297978b0378ffa4c6d54b/lib/bundler/ssl\_certs/certificate\_manager.rb).

...

This is what worked for me:

> <https://gist.github.com/fnichol/867550>

HTH, Torben

On Mon, Mar 3, 2014 at 5:01 PM, Jeppe Nejsum Madsen [jeppe@ingolfs.dk](mailto:jeppe@ingolfs.dk)wrote:

> Hi
> 
> I've started to look into using chef-solo to configure our workstations.  
> I'm running into the SSL problem shown below
> 
> I can see this is somewhat related, but should be fixed:  
> [https://tickets.opscode.com/browse/CHEF-4649](https://tickets.opscode.com/browse/CHEF-4649)
> 
> Any other suggestions to solve this?
> 
> /Jeppe
> 
> Starting Chef Client, version 11.10.2
> 
> Recipe: git::windows
> 
> - windows\_package[Git version 1.8.1.2-preview20130201] action  
> installRecipe: \<  
> Dynamically Defined Resource\>
> - remote\_file[c:/chef/Git-1.8.1.2-preview20130201.exe] action  
> create[2014-03-0  
> 3T16:35:24+01:00] ERROR: SSL Validation failure connecting to host:  
> msysgit.goog  
> [lecode.com](http://lecode.com) - SSL\_connect SYSCALL returned=5 errno=0 state=SSLv2/v3 read  
> server h  
> ello A

---

<div class="post-metadata">

**Author:** ![Adam\_Edwards1](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/adam_edwards1/32/27_2.png) [@Adam\_Edwards1](https://discourse.chef.io/u/Adam_Edwards1)\
**Post date:** [March 3, 2014, 8:50pm UTC](https://discourse.chef.io/t/ssl-errors-on-windows/5123/3 "2014-03-03T20:50:07Z")

</div>

Well, that shouldn’t be an issue if you installed via Omnibus - Jeppe, did  
you use omnibus to install Chef or did you gem install?

If you are missing the following file, that’s probably the cause, and  
Torben’s advice would come into play for how you can replace it:

C:\opscode\chef\embedded\ssl\certs\cacert.pem

It’s also possible that something is out of date with that file, so  
obtaining the latest per Torben’s instructions and copying it over the  
existing could solve it.

I tried the following recipe on Chef 11.10 with ssl\_verify\_mode set to  
:verify\_peer and it worked for me via chef-solo, so at the moment I can’t  
reproduce the issue

remote\_file “c:/test/mybing.html” do

source “[https://bing.com](https://bing.com)”

# this fails when I replace with a site that has an invalid cert, and

that will succeed if I set verify mode to none

end

If that works for you Jeppe, then there must be something specific we need  
to repro with your recipe - if you can share a failing fragment, that would  
help.

Thanks.

-Adam

_From:_ Torben Knerr [[mailto:ukio@gmx.de](mailto:ukio@gmx.de)]  
_Sent:_ Monday, March 3, 2014 12:13 PM  
_To:_ [chef@lists.opscode.com](mailto:chef@lists.opscode.com)  
_Subject:_ [chef] Re: SSL errors on windows

Hi Jeppe,

seeing this quite often in recent times. Might all be the same:

> <https://github.com/chef/vagrant-omnibus/issues/64>

> <https://github.com/hashicorp/vagrant/issues/3036>

> <https://github.com/berkshelf/berkshelf/issues/1030>

…

This is what worked for me:

> <https://gist.github.com/fnichol/867550>

HTH, Torben

On Mon, Mar 3, 2014 at 5:01 PM, Jeppe Nejsum Madsen [jeppe@ingolfs.dk](mailto:jeppe@ingolfs.dk)  
wrote:

Hi

I’ve started to look into using chef-solo to configure our workstations.  
I’m running into the SSL problem shown below

I can see this is somewhat related, but should be fixed:  
[https://tickets.opscode.com/browse/CHEF-4649](https://tickets.opscode.com/browse/CHEF-4649)

Any other suggestions to solve this?

/Jeppe

Starting Chef Client, version 11.10.2

Recipe: git::windows

- windows\_package[Git version 1.8.1.2-preview20130201] action  
installRecipe: \<  
Dynamically Defined Resource\>
- remote\_file[c:/chef/Git-1.8.1.2-preview20130201.exe] action  
create[2014-03-0  
3T16:35:24+01:00] ERROR: SSL Validation failure connecting to host:  
msysgit.goog  
[lecode.com](http://lecode.com) - SSL\_connect SYSCALL returned=5 errno=0 state=SSLv2/v3 read  
server h  
ello A