Unable to upload cookbooks to brand-new Chef Server 12 install

I’m able to run all kinds of knife commands against my new Chef Server, but I’m not able to do anything involving cookbooks:

$ chef exec knife cookbook upload nop -o .. -VV
...
ERROR: You authenticated successfully to https://my-chef-server/organizations/my-org as myself but you are not authorized for this action
Response:  <?xml version="1.0" encoding="UTF-8"?><Error><Code>SignatureDoesNotMatch</Code><Message>The request signature we calculated does not match the signature you provided. Check your key and signing method.</Message><StringToSignBytes></StringToSignBytes><RequestId>asdfasdfasdfasdfasdfasdfasdfasdf</RequestId><HostId></HostId><SignatureProvided>asdfasdfasdfasdf=</SignatureProvided><StringToSign>
/opt/chefdk/embedded/lib/ruby/2.1.0/net/http/response.rb:119:in `error!': 403 "Forbidden" (Net::HTTPServerException)
	from /opt/chefdk/embedded/lib/ruby/gems/2.1.0/gems/chef-12.5.1/lib/chef/http.rb:145:in `request'
	from /opt/chefdk/embedded/lib/ruby/gems/2.1.0/gems/chef-12.5.1/lib/chef/http.rb:118:in `put'
	from /opt/chefdk/embedded/lib/ruby/gems/2.1.0/gems/chef-12.5.1/lib/chef/cookbook_uploader.rb:128:in `block in uploader_function_for'
	from /opt/chefdk/embedded/lib/ruby/gems/2.1.0/gems/chef-12.5.1/lib/chef/util/threaded_job_queue.rb:52:in `call'
	from /opt/chefdk/embedded/lib/ruby/gems/2.1.0/gems/chef-12.5.1/lib/chef/util/threaded_job_queue.rb:52:in `block (3 levels) in process'
	from /opt/chefdk/embedded/lib/ruby/gems/2.1.0/gems/chef-12.5.1/lib/chef/util/threaded_job_queue.rb:50:in `loop'
	from /opt/chefdk/embedded/lib/ruby/gems/2.1.0/gems/chef-12.5.1/lib/chef/util/threaded_job_queue.rb:50:in `block (2 levels) in process'
	from /opt/chefdk/embedded/lib/ruby/gems/2.1.0/gems/logging-1.8.2/lib/logging/diagnostic_context.rb:323:in `call'
	from /opt/chefdk/embedded/lib/ruby/gems/2.1.0/gems/logging-1.8.2/lib/logging/diagnostic_context.rb:323:in `block in create_with_logging_context'

I installed the Management UI just to take a look at my permission, and AFAICT everything is set up correctly: I’m an admin for my organization, so I should have free reign over everything.

Do you have some odd settings in your knife.rb file? It’s saying you’re
providing a signature of asdfasdfasdfasdf