# Unable to use SSL cert from in-house Chef Server w/ knife

**URL:** <https://discourse.chef.io/t/unable-to-use-ssl-cert-from-in-house-chef-server-w-knife/6311>\
**Category:** Chef Infra (archive)\
**Created:** [February 16, 2015, 6:14pm UTC](https://discourse.chef.io/t/unable-to-use-ssl-cert-from-in-house-chef-server-w-knife/6311 "2015-02-16T18:14:47Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ivan\_Suftin](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/ivan_suftin/32/159_2.png) [@Ivan\_Suftin](https://discourse.chef.io/u/Ivan_Suftin)\
**Post date:** [February 16, 2015, 6:14pm UTC](https://discourse.chef.io/t/unable-to-use-ssl-cert-from-in-house-chef-server-w-knife/6311/1 "2015-02-16T18:14:47Z")

</div>

Ohai Chefs!

We have a Chef 12 server set up with a self-signed cert. I’m trying to get knife to communicate using peer verification with the server.

First, I run the check:  
$ knife ssl check [https://chef.owicloud.org/organizations/cida](https://chef.owicloud.org/organizations/cida)  
Connecting to host [chef.owicloud.org:443](http://chef.owicloud.org:443)  
ERROR: The SSL certificate of [chef.owicloud.org](http://chef.owicloud.org) could not be verified  
Certificate issuer data: /C=us/L=Middleton, WI/O=OWI USGS/CN=OWI USGS VPN CA/emailAddress=isuftin@usgs.gov

Configuration Info:

OpenSSL Configuration:

- Version: OpenSSL 1.0.1k 8 Jan 2015
- Certificate file: /opt/chefdk/embedded/ssl/cert.pem
- Certificate directory: /opt/chefdk/embedded/ssl/certs  
Chef SSL Configuration:
- ssl\_ca\_path: nil
- ssl\_ca\_file: nil
- trusted\_certs\_dir: “/Users/isuftin/.chef/trusted\_certs”

TO FIX THIS ERROR:

[… the usual text we know and love …]

Ok, so obviously that doesn’t work. I then try to run a knife ssl fetch:  
$ knife ssl fetch [https://chef.owicloud.org/](https://chef.owicloud.org/)  
WARNING: Certificates from [chef.owicloud.org](http://chef.owicloud.org) will be fetched and placed in your trusted\_cert  
directory (/Users/isuftin/.chef/trusted\_certs).

Knife has no means to verify these are the correct certificates. You should  
verify the authenticity of these certificates after downloading.

ERROR: knife encountered an unexpected error  
This may be a bug in the ‘ssl fetch’ knife command or plugin  
Please collect the output of this command with the `-VV` option before filing a bug report.  
Exception: NoMethodError: undefined method `[]’ for nil:NilClass

I’ve always had this issue so I’ve never used knife ssl fetch to grab the SSL cert. So I scope the cert into /Users/isuftin/.chef/trusted\_certs and run a hash check on them on the server and local:

Server:  
$ sudo sha256sum /var/opt/opscode/nginx/ca/chef2a.crt  
7a876dad9a3f6e59e169d5cb25d2ad64bd362515bbc7f9af2baec5936505ca09 /var/opt/opscode/nginx/ca/chef2a.crt

Local (mac os):  
$ shasum -a256 /Users/isuftin/.chef/trusted\_certs/chef2a.crt  
7a876dad9a3f6e59e169d5cb25d2ad64bd362515bbc7f9af2baec5936505ca09 /Users/isuftin/.chef/trusted\_certs/chef2a.crt

Initial thoughts of where I should look?

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ (╯°□°）╯︵ ┻━┻  
Ivan Suftin - Applications Developer - [isuftin@usgs.gov](mailto:isuftin@usgs.gov)  
Office: (608) 821-3825 - Cell : (608) 345-8963  
Center for Integrated Data Analytics - [http://cida.usgs.gov/](http://cida.usgs.gov/)  
United States Geological Survey  
8505 Research Way, Middleton, WI 53562

---

<div class="post-metadata">

**Author:** ![kallistec](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/kallistec/32/23_2.png) [@kallistec](https://discourse.chef.io/u/kallistec)\
**Post date:** [February 16, 2015, 8:16pm UTC](https://discourse.chef.io/t/unable-to-use-ssl-cert-from-in-house-chef-server-w-knife/6311/2 "2015-02-16T20:16:41Z")

</div>

On Monday, February 16, 2015 at 10:14 AM, Ivan Suftin wrote:

> Ohai Chefs!
> 
> We have a Chef 12 server set up with a self-signed cert. I’m trying to get knife to communicate using peer verification with the server.
> 
> First, I run the check:
> 
> > $ knife ssl check [https://chef.owicloud.org/organizations/cida](https://chef.owicloud.org/organizations/cida)  
> > Connecting to host [chef.owicloud.org](http://chef.owicloud.org) ([http://chef.owicloud.org](http://chef.owicloud.org)):443  
> > ERROR: The SSL certificate of [chef.owicloud.org](http://chef.owicloud.org) ([http://chef.owicloud.org](http://chef.owicloud.org)) could not be verified  
> > Certificate issuer data: /C=us/L=Middleton, WI/O=OWI USGS/CN=OWI USGS VPN CA/emailAddress=isuftin@usgs.gov (mailto:CA/emailAddress=isuftin@usgs.gov)
> > 
> > Configuration Info:
> > 
> > OpenSSL Configuration:
> > 
> > - Version: OpenSSL 1.0.1k 8 Jan 2015
> > - Certificate file: /opt/chefdk/embedded/ssl/cert.pem
> > - Certificate directory: /opt/chefdk/embedded/ssl/certs  
> > Chef SSL Configuration:
> > - ssl\_ca\_path: nil
> > - ssl\_ca\_file: nil
> > - trusted\_certs\_dir: "/Users/isuftin/.chef/trusted\_certs"
> > 
> > TO FIX THIS ERROR:
> > 
> > [… the usual text we know and love …]  
> > Did you get a message about "There are invalid certificates in your trusted\_certs\_dir.” from `knife ssl check`? (Your certs would have to exist in your trusted\_certs\_dir before you run that command for `knife ssl check` to detect this issue). There are certain properties on certificates, which if they are not set, will make OpenSSL refuse to verify the certificate against itself. In the past we’ve seen this when users follow an outdated blog post for setting "Subject Alternative Names,” but you could have stumbled upon this issue as well.

> Ok, so obviously that doesn’t work. I then try to run a knife ssl fetch:
> 
> > $ knife ssl fetch [https://chef.owicloud.org/](https://chef.owicloud.org/)  
> > WARNING: Certificates from [chef.owicloud.org](http://chef.owicloud.org) ([http://chef.owicloud.org](http://chef.owicloud.org)) will be fetched and placed in your trusted\_cert  
> > directory (/Users/isuftin/.chef/trusted\_certs).
> > 
> > Knife has no means to verify these are the correct certificates. You should  
> > verify the authenticity of these certificates after downloading.
> > 
> > ERROR: knife encountered an unexpected error  
> > This may be a bug in the 'ssl fetch' knife command or plugin  
> > Please collect the output of this command with the `-VV` option before filing a bug report.  
> > Exception: NoMethodError: undefined method `' for nil:NilClass
> 
> I’ve always had this issue so I’ve never used knife ssl fetch to grab the SSL cert. So I scope the cert into /Users/isuftin/.chef/trusted\_certs and run a hash check on them on the server and local:

This looks like an actual bug with `knife ssl fetch`. If you run `knife ssl fetch URL -VV`, it will show the backtrace. You should then copy all of that into a bug report at [Issues · chef/chef · GitHub](https://github.com/chef/chef/issues) so we can fix the command.

> Server:
> 
> > $ sudo sha256sum /var/opt/opscode/nginx/ca/chef2a.crt  
> > 7a876dad9a3f6e59e169d5cb25d2ad64bd362515bbc7f9af2baec5936505ca09 /var/opt/opscode/nginx/ca/chef2a.crt
> 
> Local (mac os):
> 
> > $ shasum -a256 /Users/isuftin/.chef/trusted\_certs/chef2a.crt  
> > 7a876dad9a3f6e59e169d5cb25d2ad64bd362515bbc7f9af2baec5936505ca09 /Users/isuftin/.chef/trusted\_certs/chef2a.crt
> 
> Initial thoughts of where I should look?
> 
> \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ (╯°□°）╯︵ ┻━┻  
> Ivan Suftin - Applications Developer - [isuftin@usgs.gov](mailto:isuftin@usgs.gov) ([mailto:isuftin@usgs.gov](mailto:isuftin@usgs.gov))  
> Office: (608) 821-3825 - Cell : (608) 345-8963  
> Center for Integrated Data Analytics - [http://cida.usgs.gov/](http://cida.usgs.gov/)  
> United States Geological Survey  
> 8505 Research Way, Middleton, WI 53562

--  
Daniel DeLeo

---

<div class="post-metadata">

**Author:** ![Ivan\_Suftin](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/ivan_suftin/32/159_2.png) [@Ivan\_Suftin](https://discourse.chef.io/u/Ivan_Suftin)\
**Post date:** [February 16, 2015, 10:25pm UTC](https://discourse.chef.io/t/unable-to-use-ssl-cert-from-in-house-chef-server-w-knife/6311/3 "2015-02-16T22:25:13Z")

</div>

Hi Daniel,

I did not see any messages regarding "There are invalid certificates in your trusted\_certs\_dir”. Do you have more information regarding the "Subject Alternative Names” issue? I could get more information for you if needed in order to better analyze the issue.

In regards to the knife issue, I’ve opened this ticket: [knife ssl fetch needs better cert validation logic and should not throw NoMethodError on nil · Issue #2919 · chef/chef · GitHub](https://github.com/chef/chef/issues/2919) [https://github.com/chef/chef/issues/2919](https://github.com/chef/chef/issues/2919)

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ (╯°□°）╯︵ ┻━┻  
Ivan Suftin - Applications Developer - [isuftin@usgs.gov](mailto:isuftin@usgs.gov)  
Office: (608) 821-3825 - Cell : (608) 345-8963  
Center for Integrated Data Analytics - [http://cida.usgs.gov/](http://cida.usgs.gov/)  
United States Geological Survey  
8505 Research Way, Middleton, WI 53562

> On Feb 16, 2015, at 2:16 PM, Daniel DeLeo [dan@kallistec.com](mailto:dan@kallistec.com) wrote:
> 
> On Monday, February 16, 2015 at 10:14 AM, Ivan Suftin wrote:
> 
> > Ohai Chefs!
> > 
> > We have a Chef 12 server set up with a self-signed cert. I’m trying to get knife to communicate using peer verification with the server.
> > 
> > First, I run the check:
> > 
> > > $ knife ssl check [https://chef.owicloud.org/organizations/cida](https://chef.owicloud.org/organizations/cida)  
> > > Connecting to host [chef.owicloud.org](http://chef.owicloud.org) ([http://chef.owicloud.org](http://chef.owicloud.org)):443  
> > > ERROR: The SSL certificate of [chef.owicloud.org](http://chef.owicloud.org) ([http://chef.owicloud.org](http://chef.owicloud.org)) could not be verified  
> > > Certificate issuer data: /C=us/L=Middleton, WI/O=OWI USGS/CN=OWI USGS VPN CA/emailAddress=isuftin@usgs.gov (mailto:CA/emailAddress=isuftin@usgs.gov)
> > > 
> > > Configuration Info:
> > > 
> > > OpenSSL Configuration:
> > > 
> > > - Version: OpenSSL 1.0.1k 8 Jan 2015
> > > - Certificate file: /opt/chefdk/embedded/ssl/cert.pem
> > > - Certificate directory: /opt/chefdk/embedded/ssl/certs  
> > > Chef SSL Configuration:
> > > - ssl\_ca\_path: nil
> > > - ssl\_ca\_file: nil
> > > - trusted\_certs\_dir: "/Users/isuftin/.chef/trusted\_certs"
> > > 
> > > TO FIX THIS ERROR:
> > > 
> > > [… the usual text we know and love …]  
> > > Did you get a message about "There are invalid certificates in your trusted\_certs\_dir.” from `knife ssl check`? (Your certs would have to exist in your trusted\_certs\_dir before you run that command for `knife ssl check` to detect this issue). There are certain properties on certificates, which if they are not set, will make OpenSSL refuse to verify the certificate against itself. In the past we’ve seen this when users follow an outdated blog post for setting "Subject Alternative Names,” but you could have stumbled upon this issue as well.
> 
> > Ok, so obviously that doesn’t work. I then try to run a knife ssl fetch:
> > 
> > > $ knife ssl fetch [https://chef.owicloud.org/](https://chef.owicloud.org/)  
> > > WARNING: Certificates from [chef.owicloud.org](http://chef.owicloud.org) ([http://chef.owicloud.org](http://chef.owicloud.org)) will be fetched and placed in your trusted\_cert  
> > > directory (/Users/isuftin/.chef/trusted\_certs).
> > > 
> > > Knife has no means to verify these are the correct certificates. You should  
> > > verify the authenticity of these certificates after downloading.
> > > 
> > > ERROR: knife encountered an unexpected error  
> > > This may be a bug in the 'ssl fetch' knife command or plugin  
> > > Please collect the output of this command with the `-VV` option before filing a bug report.  
> > > Exception: NoMethodError: undefined method `' for nil:NilClass
> > 
> > I’ve always had this issue so I’ve never used knife ssl fetch to grab the SSL cert. So I scope the cert into /Users/isuftin/.chef/trusted\_certs and run a hash check on them on the server and local:
> 
> This looks like an actual bug with `knife ssl fetch`. If you run `knife ssl fetch URL -VV`, it will show the backtrace. You should then copy all of that into a bug report at [Issues · chef/chef · GitHub](https://github.com/chef/chef/issues) so we can fix the command.
> 
> > Server:
> > 
> > > $ sudo sha256sum /var/opt/opscode/nginx/ca/chef2a.crt  
> > > 7a876dad9a3f6e59e169d5cb25d2ad64bd362515bbc7f9af2baec5936505ca09 /var/opt/opscode/nginx/ca/chef2a.crt
> > 
> > Local (mac os):
> > 
> > > $ shasum -a256 /Users/isuftin/.chef/trusted\_certs/chef2a.crt  
> > > 7a876dad9a3f6e59e169d5cb25d2ad64bd362515bbc7f9af2baec5936505ca09 /Users/isuftin/.chef/trusted\_certs/chef2a.crt
> > 
> > Initial thoughts of where I should look?
> > 
> > \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ (╯°□°）╯︵ ┻━┻  
> > Ivan Suftin - Applications Developer - [isuftin@usgs.gov](mailto:isuftin@usgs.gov) ([mailto:isuftin@usgs.gov](mailto:isuftin@usgs.gov))  
> > Office: (608) 821-3825 - Cell : (608) 345-8963  
> > Center for Integrated Data Analytics - [http://cida.usgs.gov/](http://cida.usgs.gov/)  
> > United States Geological Survey  
> > 8505 Research Way, Middleton, WI 53562
> 
> --  
> Daniel DeLeo

---

<div class="post-metadata">

**Author:** ![Tensibai](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/tensibai/32/29_2.png) [@Tensibai](https://discourse.chef.io/u/Tensibai)\
**Post date:** [February 17, 2015, 9:06am UTC](https://discourse.chef.io/t/unable-to-use-ssl-cert-from-in-house-chef-server-w-knife/6311/4 "2015-02-17T09:06:04Z")

</div>

I'll try to resume what I know with SSL validation.

I had issues with self-signed certificates for the chef-server and our  
proxy certificate wich do ssl interception.

What solved nearly all for me is to add the certificates in the  
cacert.pem file.

For the self signed certificate of the chef server:

openssl s\_client -showcerts -connect \<YOUR\_CHEF\_SERVER\>:443 \</dev/null  
2\>/dev/null|openssl x509 -outform PEM \>\>  
/opt/chef/embedded/ssl/certs/cacert.pem

For my proxy I had to add our internal root Certificate authority cert  
(took from a browser and exporting certificate to disk)

for some other tools I had to do `export SSL_CERT_FILE=/opt/chef/embedded/ssl/certs/cacert.pem` to enforce  
openssl lib to use my updated certificate list.

After that, one cookbook to distribute it and update chef conf after the  
file is in place (for nodes).

Hope it may help.

Le 2015-02-16 23:25, Ivan Suftin a écrit :

> Hi Daniel,
> 
> I did not see any messages regarding "There are invalid certificates in your trusted\_certs\_dir". Do you have more information regarding the "Subject Alternative Names" issue? I could get more information for you if needed in order to better analyze the issue.
> 
> In regards to the knife issue, I've opened this ticket: [knife ssl fetch needs better cert validation logic and should not throw NoMethodError on nil · Issue #2919 · chef/chef · GitHub](https://github.com/chef/chef/issues/2919) [1]
> 
> \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ (╯°□°）╯︵ ┻━┻  
> Ivan Suftin - Applications Developer - [isuftin@usgs.gov](mailto:isuftin@usgs.gov)  
> Office: (608) 821-3825 - Cell : (608) 345-8963  
> Center for Integrated Data Analytics - [http://cida.usgs.gov/](http://cida.usgs.gov/) [2]  
> United States Geological Survey  
> 8505 Research Way, Middleton, WI 53562
> 
> On Feb 16, 2015, at 2:16 PM, Daniel DeLeo [dan@kallistec.com](mailto:dan@kallistec.com) wrote:
> 
> On Monday, February 16, 2015 at 10:14 AM, Ivan Suftin wrote:  
> Ohai Chefs!
> 
> We have a Chef 12 server set up with a self-signed cert. I'm trying to get knife to communicate using peer verification with the server.
> 
> First, I run the check:  
> $ knife ssl check [https://chef.owicloud.org/organizations/cida](https://chef.owicloud.org/organizations/cida) [3]  
> Connecting to host [chef.owicloud.org](http://chef.owicloud.org) [4] ([http://chef.owicloud.org](http://chef.owicloud.org) [4]):443  
> ERROR: The SSL certificate of [chef.owicloud.org](http://chef.owicloud.org) [4] ([http://chef.owicloud.org](http://chef.owicloud.org) [4]) could not be verified  
> Certificate issuer data: /C=us/L=Middleton, WI/O=OWI USGS/CN=OWI USGS VPN CA/emailAddress=isuftin@usgs.gov (mailto:CA/emailAddress=isuftin@usgs.gov)
> 
> Configuration Info:
> 
> OpenSSL Configuration:
> 
> - Version: OpenSSL 1.0.1k 8 Jan 2015
> - Certificate file: /opt/chefdk/embedded/ssl/cert.pem
> - Certificate directory: /opt/chefdk/embedded/ssl/certs  
> Chef SSL Configuration:
> - ssl\_ca\_path: nil
> - ssl\_ca\_file: nil
> - trusted\_certs\_dir: "/Users/isuftin/.chef/trusted\_certs"
> 
> TO FIX THIS ERROR:
> 
> [... the usual text we know and love ...]  
> Did you get a message about "There are invalid certificates in your  
> trusted\_certs\_dir." from `knife ssl check`? (Your certs would have to  
> exist in your trusted\_certs\_dir before you run that command for `knife ssl check` to detect this issue). There are certain properties on  
> certificates, which if they are not set, will make OpenSSL refuse to  
> verify the certificate against itself. In the past we've seen this when  
> users follow an outdated blog post for setting "Subject Alternative  
> Names," but you could have stumbled upon this issue as well.

> Ok, so obviously that doesn't work. I then try to run a knife ssl fetch:
> 
> > $ knife ssl fetch [https://chef.owicloud.org/](https://chef.owicloud.org/) [5]  
> > WARNING: Certificates from [chef.owicloud.org](http://chef.owicloud.org) [4] ([http://chef.owicloud.org](http://chef.owicloud.org) [4]) will be fetched and placed in your trusted\_cert  
> > directory (/Users/isuftin/.chef/trusted\_certs).
> > 
> > Knife has no means to verify these are the correct certificates. You should  
> > verify the authenticity of these certificates after downloading.
> > 
> > ERROR: knife encountered an unexpected error  
> > This may be a bug in the 'ssl fetch' knife command or plugin  
> > Please collect the output of this command with the `-VV` option before filing a bug report.  
> > Exception: NoMethodError: undefined method `' for nil:NilClass
> 
> I've always had this issue so I've never used knife ssl fetch to grab the SSL cert. So I scope the cert into /Users/isuftin/.chef/trusted\_certs and run a hash check on them on the server and local:

This looks like an actual bug with `knife ssl fetch`. If you run `knife ssl fetch URL -VV`, it will show the backtrace. You should then copy all  
of that into a bug report at [GitHub · Where software is built](https://github.com/chef/chef/issues) [6] so  
we can fix the command.

> Server:
> 
> > $ sudo sha256sum /var/opt/opscode/nginx/ca/chef2a.crt  
> > 7a876dad9a3f6e59e169d5cb25d2ad64bd362515bbc7f9af2baec5936505ca09 /var/opt/opscode/nginx/ca/chef2a.crt
> 
> Local (mac os):
> 
> > $ shasum -a256 /Users/isuftin/.chef/trusted\_certs/chef2a.crt  
> > 7a876dad9a3f6e59e169d5cb25d2ad64bd362515bbc7f9af2baec5936505ca09 /Users/isuftin/.chef/trusted\_certs/chef2a.crt
> 
> Initial thoughts of where I should look?
> 
> \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ (╯°□°）╯︵ ┻━┻  
> Ivan Suftin - Applications Developer - [isuftin@usgs.gov](mailto:isuftin@usgs.gov) ([mailto:isuftin@usgs.gov](mailto:isuftin@usgs.gov))  
> Office: (608) 821-3825 - Cell : (608) 345-8963  
> Center for Integrated Data Analytics - [http://cida.usgs.gov/](http://cida.usgs.gov/) [2]  
> United States Geological Survey  
> 8505 Research Way, Middleton, WI 53562

--  
Daniel DeLeo

## Links:

[1] [knife ssl fetch needs better cert validation logic and should not throw NoMethodError on nil · Issue #2919 · chef/chef · GitHub](https://github.com/chef/chef/issues/2919)  
[2] [http://cida.usgs.gov/](http://cida.usgs.gov/)  
[3] [https://chef.owicloud.org/organizations/cida](https://chef.owicloud.org/organizations/cida)  
[4] [http://chef.owicloud.org](http://chef.owicloud.org)  
[5] [https://chef.owicloud.org/](https://chef.owicloud.org/)  
[6] [GitHub · Where software is built](https://github.com/chef/chef/issues)

---

<div class="post-metadata">

**Author:** ![Ivan\_Suftin](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/ivan_suftin/32/159_2.png) [@Ivan\_Suftin](https://discourse.chef.io/u/Ivan_Suftin)\
**Post date:** [February 17, 2015, 2:17pm UTC](https://discourse.chef.io/t/unable-to-use-ssl-cert-from-in-house-chef-server-w-knife/6311/5 "2015-02-17T14:17:32Z")

</div>

So this actually turned out to be an issue with our VPC perimeter firewall we use at AWS. When VPN’d into the VPC, past the firewall and using the direct IP of the machine, the knife command acts as expected.

We will be switching to a dedicated VPN soon to connect our datacenter into the VPC in a bidirectional way. At that point this will not be an issue, so for now I will continue turning off peer verification.

Thank you for your help!  
\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ (╯°□°）╯︵ ┻━┻  
Ivan Suftin - Applications Developer - [isuftin@usgs.gov](mailto:isuftin@usgs.gov)  
Office: (608) 821-3825 - Cell : (608) 345-8963  
Center for Integrated Data Analytics - [http://cida.usgs.gov/](http://cida.usgs.gov/)  
United States Geological Survey  
8505 Research Way, Middleton, WI 53562

> On Feb 17, 2015, at 3:06 AM, Tensibai [tensibai@iabis.net](mailto:tensibai@iabis.net) wrote:
> 
> I'll try to resume what I know with SSL validation.
> 
> I had issues with self-signed certificates for the chef-server and our proxy certificate wich do ssl interception.
> 
> What solved nearly all for me is to add the certificates in the cacert.pem file.
> 
> For the self signed certificate of the chef server:
> 
> openssl s\_client -showcerts -connect \<YOUR\_CHEF\_SERVER\>:443 \</dev/null 2\>/dev/null|openssl x509 -outform PEM \>\> /opt/chef/embedded/ssl/certs/cacert.pem
> 
> For my proxy I had to add our internal root Certificate authority cert (took from a browser and exporting certificate to disk)
> 
> for some other tools I had to do `export SSL_CERT_FILE=/opt/chef/embedded/ssl/certs/cacert.pem` to enforce openssl lib to use my updated certificate list.
> 
> After that, one cookbook to distribute it and update chef conf after the file is in place (for nodes).
> 
> Hope it may help.
> 
> Le 2015-02-16 23:25, Ivan Suftin a écrit :
> 
> > Hi Daniel,
> > 
> > I did not see any messages regarding "There are invalid certificates in your trusted\_certs\_dir". Do you have more information regarding the "Subject Alternative Names" issue? I could get more information for you if needed in order to better analyze the issue.
> > 
> > In regards to the knife issue, I've opened this ticket: [knife ssl fetch needs better cert validation logic and should not throw NoMethodError on nil · Issue #2919 · chef/chef · GitHub](https://github.com/chef/chef/issues/2919) [https://github.com/chef/chef/issues/2919](https://github.com/chef/chef/issues/2919)
> > 
> > \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ (╯°□°）╯︵ ┻━┻  
> > Ivan Suftin - Applications Developer - [isuftin@usgs.gov](mailto:isuftin@usgs.gov) [mailto:isuftin@usgs.gov](mailto:isuftin@usgs.gov)  
> > Office: (608) 821-3825 - Cell : (608) 345-8963  
> > Center for Integrated Data Analytics - [http://cida.usgs.gov/](http://cida.usgs.gov/) [http://cida.usgs.gov/](http://cida.usgs.gov/)  
> > United States Geological Survey  
> > 8505 Research Way, Middleton, WI 53562
> > 
> > > On Feb 16, 2015, at 2:16 PM, Daniel DeLeo \<[dan@kallistec.com](mailto:dan@kallistec.com) [mailto:dan@kallistec.com](mailto:dan@kallistec.com)\> wrote:
> > > 
> > > On Monday, February 16, 2015 at 10:14 AM, Ivan Suftin wrote:
> > > 
> > > > Ohai Chefs!
> > > > 
> > > > We have a Chef 12 server set up with a self-signed cert. I'm trying to get knife to communicate using peer verification with the server.
> > > > 
> > > > First, I run the check:
> > > > 
> > > > > $ knife ssl check [https://chef.owicloud.org/organizations/cida](https://chef.owicloud.org/organizations/cida) [https://chef.owicloud.org/organizations/cida](https://chef.owicloud.org/organizations/cida)  
> > > > > Connecting to host [chef.owicloud.org](http://chef.owicloud.org) [http://chef.owicloud.org/](http://chef.owicloud.org/) ([http://chef.owicloud.org](http://chef.owicloud.org) [http://chef.owicloud.org/](http://chef.owicloud.org/)):443  
> > > > > ERROR: The SSL certificate of [chef.owicloud.org](http://chef.owicloud.org) [http://chef.owicloud.org/](http://chef.owicloud.org/) ([http://chef.owicloud.org](http://chef.owicloud.org) [http://chef.owicloud.org/](http://chef.owicloud.org/)) could not be verified  
> > > > > Certificate issuer data: /C=us/L=Middleton, WI/O=OWI USGS/CN=OWI USGS VPN CA/emailAddress=isuftin@usgs.gov [mailto:CA/emailAddress=isuftin@usgs.gov](mailto:CA/emailAddress=isuftin@usgs.gov) (mailto:CA/emailAddress=isuftin@usgs.gov [mailto:CA/emailAddress=isuftin@usgs.gov](mailto:CA/emailAddress=isuftin@usgs.gov))
> > > > > 
> > > > > Configuration Info:
> > > > > 
> > > > > OpenSSL Configuration:
> > > > > 
> > > > > - Version: OpenSSL 1.0.1k 8 Jan 2015
> > > > > - Certificate file: /opt/chefdk/embedded/ssl/cert.pem
> > > > > - Certificate directory: /opt/chefdk/embedded/ssl/certs  
> > > > > Chef SSL Configuration:
> > > > > - ssl\_ca\_path: nil
> > > > > - ssl\_ca\_file: nil
> > > > > - trusted\_certs\_dir: "/Users/isuftin/.chef/trusted\_certs"
> > > > > 
> > > > > TO FIX THIS ERROR:
> > > > > 
> > > > > [... the usual text we know and love ...]  
> > > > > Did you get a message about "There are invalid certificates in your trusted\_certs\_dir." from `knife ssl check`? (Your certs would have to exist in your trusted\_certs\_dir before you run that command for `knife ssl check` to detect this issue). There are certain properties on certificates, which if they are not set, will make OpenSSL refuse to verify the certificate against itself. In the past we've seen this when users follow an outdated blog post for setting "Subject Alternative Names," but you could have stumbled upon this issue as well.
> > > 
> > > > Ok, so obviously that doesn't work. I then try to run a knife ssl fetch:
> > > > 
> > > > > $ knife ssl fetch [https://chef.owicloud.org/](https://chef.owicloud.org/) [https://chef.owicloud.org/](https://chef.owicloud.org/)  
> > > > > WARNING: Certificates from [chef.owicloud.org](http://chef.owicloud.org) [http://chef.owicloud.org/](http://chef.owicloud.org/) ([http://chef.owicloud.org](http://chef.owicloud.org) [http://chef.owicloud.org/](http://chef.owicloud.org/)) will be fetched and placed in your trusted\_cert  
> > > > > directory (/Users/isuftin/.chef/trusted\_certs).
> > > > > 
> > > > > Knife has no means to verify these are the correct certificates. You should  
> > > > > verify the authenticity of these certificates after downloading.
> > > > > 
> > > > > ERROR: knife encountered an unexpected error  
> > > > > This may be a bug in the 'ssl fetch' knife command or plugin  
> > > > > Please collect the output of this command with the `-VV` option before filing a bug report.  
> > > > > Exception: NoMethodError: undefined method `' for nil:NilClass
> > > > 
> > > > I've always had this issue so I've never used knife ssl fetch to grab the SSL cert. So I scope the cert into /Users/isuftin/.chef/trusted\_certs and run a hash check on them on the server and local:
> > > 
> > > This looks like an actual bug with `knife ssl fetch`. If you run `knife ssl fetch URL -VV`, it will show the backtrace. You should then copy all of that into a bug report at [Issues · chef/chef · GitHub](https://github.com/chef/chef/issues) [https://github.com/chef/chef/issues](https://github.com/chef/chef/issues) so we can fix the command.
> > > 
> > > > Server:
> > > > 
> > > > > $ sudo sha256sum /var/opt/opscode/nginx/ca/chef2a.crt  
> > > > > 7a876dad9a3f6e59e169d5cb25d2ad64bd362515bbc7f9af2baec5936505ca09 /var/opt/opscode/nginx/ca/chef2a.crt
> > > > 
> > > > Local (mac os):
> > > > 
> > > > > $ shasum -a256 /Users/isuftin/.chef/trusted\_certs/chef2a.crt  
> > > > > 7a876dad9a3f6e59e169d5cb25d2ad64bd362515bbc7f9af2baec5936505ca09 /Users/isuftin/.chef/trusted\_certs/chef2a.crt
> > > > 
> > > > Initial thoughts of where I should look?
> > > > 
> > > > \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ (╯°□°）╯︵ ┻━┻  
> > > > Ivan Suftin - Applications Developer - [isuftin@usgs.gov](mailto:isuftin@usgs.gov) [mailto:isuftin@usgs.gov](mailto:isuftin@usgs.gov) ([mailto:isuftin@usgs.gov](mailto:isuftin@usgs.gov) [mailto:isuftin@usgs.gov](mailto:isuftin@usgs.gov))  
> > > > Office: (608) 821-3825 - Cell : (608) 345-8963  
> > > > Center for Integrated Data Analytics - [http://cida.usgs.gov/](http://cida.usgs.gov/) [http://cida.usgs.gov/](http://cida.usgs.gov/)  
> > > > United States Geological Survey  
> > > > 8505 Research Way, Middleton, WI 53562
> > > 
> > > --  
> > > Daniel DeLeo