# Tiered Chef 11 (2 front end, 1 back end servers) - knife ssl check error

**URL:** <https://discourse.chef.io/t/tiered-chef-11-2-front-end-1-back-end-servers-knife-ssl-check-error/7712>\
**Category:** Chef Infra (archive)\
**Created:** [February 1, 2016, 1:51am UTC](https://discourse.chef.io/t/tiered-chef-11-2-front-end-1-back-end-servers-knife-ssl-check-error/7712 "2016-02-01T01:51:06Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![Victor](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/victor/32/1259_2.png) [@Victor](https://discourse.chef.io/u/Victor)\
**Post date:** [February 1, 2016, 1:51am UTC](https://discourse.chef.io/t/tiered-chef-11-2-front-end-1-back-end-servers-knife-ssl-check-error/7712/1 "2016-02-01T01:51:06Z")

</div>

My Chef 11 environment has 2 front end and 1 back end servers. I ran “knife ssl fetch” on my Chef workstation and it completed successfully. When I run “knife ssl check”, sometimes it says “Connecting to host [chef11.mycompany.com:443](http://chef11.mycompany.com:443) Successfully verified certificates from [chef11.mycompany.com](http://chef11.mycompany.com)”, but most of the time, it gives an error. When I ran 'knife client list" from my workstation, it always says “ERROR: SSL Validation failure connecting to host: [chef11.mycompany.com](http://chef11.mycompany.com) - SSL\_connect returned=1 errno=0 state=error: certificate verify failed”. I tested with shutting down one front end server and keeping the other one running, but I got similar errors. nslookup shows [chef11.mycompany.com](http://chef11.mycompany.com) resolves to the 2 IP addresses for the 2 front end servers. The self-signed certificate belongs to [chef11.mycompany.com](http://chef11.mycompany.com). It seems my workstation can’t use this certificate to establish a secure connection with either of the 2 front end servers.  
Thanks in advance for any insights how to fix this.

---

<div class="post-metadata">

**Author:** ![kallistec](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/kallistec/32/23_2.png) [@kallistec](https://discourse.chef.io/u/kallistec)\
**Post date:** [February 2, 2016, 5:58pm UTC](https://discourse.chef.io/t/tiered-chef-11-2-front-end-1-back-end-servers-knife-ssl-check-error/7712/2 "2016-02-02T17:58:00Z")

</div>

> [@Victor](#):
>
> When I run "knife ssl check", sometimes it says "Connecting to host [chef11.mycompany.com:443](http://chef11.mycompany.com:443) Successfully verified certificates from [chef11.mycompany.com](http://chef11.mycompany.com)", but most of the time, it gives an error.

What error?

> [@Victor](#):
>
> The self-signed certificate belongs to [chef11.mycompany.com](http://chef11.mycompany.com)

Is it a straight-up self-signed cert (i.e., it's its own root) or do you have a CA with a separate root?

---

<div class="post-metadata">

**Author:** ![Victor](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/victor/32/1259_2.png) [@Victor](https://discourse.chef.io/u/Victor)\
**Post date:** [February 3, 2016, 2:09pm UTC](https://discourse.chef.io/t/tiered-chef-11-2-front-end-1-back-end-servers-knife-ssl-check-error/7712/3 "2016-02-03T14:09:19Z")

</div>

Error when I ran “knife ssl check”:  
Connecting to host [chef11.mycompany.com:443](http://chef11.mycompany.com:443)  
ERROR: The SSL certificate of [chef11.mycompany.com](http://chef11.mycompany.com) could not be verified  
Certificate issuer data: /C=US/ST=WA/L=Seattle/O=YouCorp/OU=Operations/CN=[chef11.mycompany.com/emailAddress=you@example.com](http://chef11.mycompany.com/emailAddress=you@example.com)  
Configuration Info:  
OpenSSL Configuration:

- Version: OpenSSL 1.0.1p 9 Jul 2015
- Certificate file: /opt/chefdk/embedded/ssl/cert.pem
- Certificate directory: /opt/chefdk/embedded/ssl/certs  
Chef SSL Configuration:
- ssl\_ca\_path: nil
- ssl\_ca\_file: nil
- trusted\_certs\_dir: "/home/vx/chef-repo/.chef/trusted\_certs"  
TO FIX THIS ERROR:  
If the server you are connecting to uses a self-signed certificate, you must  
configure chef to trust that server’s certificate.  
By default, the certificate is stored in the following location on the host  
where your chef-server runs:  
/var/opt/opscode/nginx/ca/SERVER\_HOSTNAME.crt  
Copy that file to your trusted\_certs\_dir (currently: /home/vx/chef-repo/.chef/trusted\_certs)  
using SSH/SCP or some other secure method, then re-run this command to confirm  
that the server’s certificate is now trusted.

Note: the .crt was already in the trusted\_certs folder after I ran knife ssl fetch. It’s a straight-up self-signed cert (its own root). I don’t have a CA with a separate root.

---

<div class="post-metadata">

**Author:** ![Victor](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/victor/32/1259_2.png) [@Victor](https://discourse.chef.io/u/Victor)\
**Post date:** [February 3, 2016, 4:47pm UTC](https://discourse.chef.io/t/tiered-chef-11-2-front-end-1-back-end-servers-knife-ssl-check-error/7712/4 "2016-02-03T16:47:43Z")

</div>

Some more info:  
knife --version on ChefDK workstation gives Chef: 12.5.1. pc-version.txt on the Chef server says Opscode Private Chef 1.2.8.2. I also tried ssl\_verify\_mode :verify\_none in knife.rb but same errors remain.

---

<div class="post-metadata">

**Author:** ![kallistec](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/kallistec/32/23_2.png) [@kallistec](https://discourse.chef.io/u/kallistec)\
**Post date:** [February 3, 2016, 5:22pm UTC](https://discourse.chef.io/t/tiered-chef-11-2-front-end-1-back-end-servers-knife-ssl-check-error/7712/5 "2016-02-03T17:22:37Z")

</div>

The only thing I can think of is that the two FEs have different self-signed certs. If you run `knife ssl fetch` it stores the cert with a filename based on the CN (which is the hostname). If you copy the cert from one of the machines to the other one and restart, then I would expect things should work (possibly with another `knife ssl fetch` needed first).

Also, `ssl_verify_mode :verify_none` should disable cert verification for normal commands but `knife ssl check` will still report errors since its purpose is to tell you why you get cert verification errors.

---

<div class="post-metadata">

**Author:** ![Victor](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/victor/32/1259_2.png) [@Victor](https://discourse.chef.io/u/Victor)\
**Post date:** [February 3, 2016, 9:31pm UTC](https://discourse.chef.io/t/tiered-chef-11-2-front-end-1-back-end-servers-knife-ssl-check-error/7712/6 "2016-02-03T21:31:08Z")

</div>

After some more research, it turns out Chef client 10.18.2 works. This is a version without SSL I believe therefore bypassing the self-signed certificate issue.

---

<div class="post-metadata">

**Author:** ![kallistec](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/kallistec/32/23_2.png) [@kallistec](https://discourse.chef.io/u/kallistec)\
**Post date:** [February 3, 2016, 9:34pm UTC](https://discourse.chef.io/t/tiered-chef-11-2-front-end-1-back-end-servers-knife-ssl-check-error/7712/7 "2016-02-03T21:34:05Z")

</div>

That version is unsupported, if you really want to just bypass SSL entirely, you can configure your server to serve HTTP (no S).

Daniel DeLeo

---

<div class="post-metadata">

**Author:** ![Victor](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/victor/32/1259_2.png) [@Victor](https://discourse.chef.io/u/Victor)\
**Post date:** [February 4, 2016, 2:15pm UTC](https://discourse.chef.io/t/tiered-chef-11-2-front-end-1-back-end-servers-knife-ssl-check-error/7712/8 "2016-02-04T14:15:54Z")

</div>

Is the following the correct way to bypass ssl?  
In private-chef.rb in /etc/opscode, add nginx[‘enable\_non\_ssl’]=true  
Run chef-server-ctl reconfigure  
Any other steps?

---

<div class="post-metadata">

**Author:** ![kallistec](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/kallistec/32/23_2.png) [@kallistec](https://discourse.chef.io/u/kallistec)\
**Post date:** [February 4, 2016, 11:50pm UTC](https://discourse.chef.io/t/tiered-chef-11-2-front-end-1-back-end-servers-knife-ssl-check-error/7712/9 "2016-02-04T23:50:37Z")

</div>

After that configure your clients (including knife) `chef_server_url` for `http` instead of `https`.

Daniel DeLeo

---

<div class="post-metadata">

**Author:** ![Victor](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/victor/32/1259_2.png) [@Victor](https://discourse.chef.io/u/Victor)\
**Post date:** [February 14, 2016, 3:32pm UTC](https://discourse.chef.io/t/tiered-chef-11-2-front-end-1-back-end-servers-knife-ssl-check-error/7712/10 "2016-02-14T15:32:59Z")

</div>

Thanks kallistec.