<p>In my case, I was doing basically the same thing, because the internal certificate path was different than the typical certificate path, so I had to add my internal certificates.  In my case, adding the SSL_CERT_FILE didn't work.  I needed to copy my certificates, which I had exported as *.cer and then made *.pem versions using</p>
<p>. ./openssl x509 -inform der -in C:\dev\apps\certificates\org_root.cer -out C:\dev\apps\certificates\org_root.pem</p>
<p>I found the openssl tool here:</p>
<p>C:\opscode\chefdk\embedded\bin</p>
<p>Then I copied them to this location (which the location in the documentation above doesn't clarify very well) on the target machine:</p>
<p>C:\Users\[username]\.chef\trusted_certs</p>
<p>I had to create the &quot;trusted_certs&quot; folder on my target machine where I wanted to run the chef client.  After copying the certificates there, it began working and trusting the internal certificate chain without SSL errors (in my case self-signed certificate error).</p>
<p>Also, on the ChefDK machine if you're using kitchen or something like that, I had to take the contents of my internal certificates' *.pem files and copy the contents of the content to the tail of the &quot;C:\opscode\chefdk\embedded\ssl\certs\cacert.pem&quot; file or the cacert.pem file referenced by the SSL_CERT_FILE environment variable.  In my case, I was copying an internal intermediate cert as well as a internal root cert and I believe they recommend that order also (ending with the root in the chain).  This requirement on the ChefDK machine is due to the ChefDK communicating with a client machine using &quot;remote_file&quot; and the solution I'm providing appears to relate to this Chef bug, which may be fixed in newer versions of Chef.</p>
<p><a href="https://github.com/chef/chef/issues/5944" rel="nofollow noreferrer">https://github.com/chef/chef/issues/5944</a></p>

CC BY-SA 4.0
2021-04-02T11:53:08.030Z
You're just giving a complex multistep solution which ends doing what I describe as answer in a more convoluted manner... The trusted cert approach works nearly only for Chef client code, that's OK for nodes, usually not in CI systems.
Tensibai
CC BY-SA 4.0
2021-04-02T11:53:48.013Z
I really fail to understand what this answer brings which is not in mine in fact.
Tensibai
CC BY-SA 4.0
2021-07-23T05:35:40.760Z
Obviously answering your own question with your own solution is going to be the most ideal for your particular situation.  My answer is probably more helpful with someone with a similar situation whose encountering the same issue on Windows, particularly with the differences encountered such as requiring adding those specific files in those specific directories.
Brandon Hawbaker
CC BY-SA 4.0
2021-07-23T09:40:03.327Z
The trusted certs directory works only for chef itself, not for berks or others. And well, that's the point 1 of my answer with link to the official doc covering windows paths, etc. The second part is the end of my answer on where to add the CA certificates...
Tensibai
CC BY-SA 4.0
2021-04-01T23:34:28.027Z
2021-04-02T05:13:00.130Z
2021-04-02T05:13:00.130Z
Brandon Hawbaker
<p>There's a couple of way to achieve the result:</p>

<ol>
<li><p>Chef has a <code>trusted_dir</code> to allow adding certificate to the trusted list. the <a href="https://docs.chef.io/chef_client_security.html#ssl-certificates" rel="nofollow noreferrer">documentation</a> has a lot of details about it. Adding your CA certificate to this directory would solve the problem. <code>knife</code> has it also in a slightly different path as per it's own <a href="https://docs.chef.io/knife_ssl_fetch.html" rel="nofollow noreferrer">documentation</a></p></li>
<li><p>Chef use its own CA certiticate list in <code>/opt/chef/embedded/ssl/certs/cacert.pem</code>. 
You can add your CA certificate at end of this list to trust it. </p></li>
</ol>

<p>The second option has an advantage of allowing you to export the environment variable <code>SSL_CERT_FILE</code> pointing to chef <code>cacert.pem</code> to allow most of the tools using <code>openssl</code> library to know your CA certificate.</p>

<p>For the case of a self signed certificate on the chef server (or another server used as target in a recipe), <code>knife ssl_fetch</code> would allow all knife commands to work.</p>

<p>To add the server certificate to the cacert.pem for the case 2. above, you can use the following command:</p>

<pre><code># For a self signed CA certiticate
openssl s_client -showcerts -connect &lt;YOUR_CHEF_SERVER&gt;:443 &lt;/dev/null 2&gt;/dev/null|openssl x509 -outform PEM &gt;&gt; /opt/chefdk/embedded/ssl/certs/cacert.pem

# For an internal CA signed certificate:
openssl s_client -showcerts -verify 5 -connect &lt;YOUR_CHEF_SERVER&gt;:443 &lt;/dev/null 2&gt;/dev/null | awk '/BEGIN/,/END/{if(/BEGIN/){a++}; certs[a]=(certs[a] "\n" $0)}; END {print certs[a]}' &gt;&gt; /opt/chefdk/embedded/ssl/certs/cacert.pem

export SSL_CERT_FILE=/opt/chefdk/embedded/ssl/certs/cacert.pem
</code></pre>

<p>The openssl command is included in chef-dk, so this can be done under windows also.  Change the path to <code>c:\opscode\</code> instead of <code>/opt/</code>. To export the environment variable use <code>set SSL_CERT_FILE=...</code> (with <code>/P</code> to add it permanently to your environment) in your command.</p>

CC BY-SA 4.0
2017-02-28T17:08:12.693Z
2020-01-29T09:44:30.313Z
2020-01-29T09:44:30.313Z
Tensibai
<p>We do use an internal Certificate Authority to create server certificates in my company.</p>

<p>We also have to deal with a transparent proxy doing SSL interception (MITM).</p>

<p>I regularly encounter SSL validation errors due to Chef not knowing the CA  certificate, and sometimes it's the tooling around chef itself (berkshelf, knife; even chef client itself when talking to the server for the first time since chef 12 enables SSL by default).</p>

<p>Question is: How do I make Chef aware of my CA certificate to get valid SSL exchanges ?</p>

<chef><ssl>
How do I include my internal CA certificate to validate SSL exchanges in Chef?
Tensibai
# How do I include my internal CA certificate to validate SSL exchanges in Chef?

(Asked by: username_0 on 2017-02-28)

We do use an internal Certificate Authority to create server certificates in my company.

We also have to deal with a transparent proxy doing SSL interception (MITM).

I regularly encounter SSL validation errors due to Chef not knowing the CA certificate, and sometimes it's the tooling around chef itself (berkshelf, knife; even chef client itself when talking to the server for the first time since chef 12 enables SSL by default).

Question is: How do I make Chef aware of my CA certificate to get valid SSL exchanges ?

**Tags:** chef, ssl


---

## 2 answers

### Answer by username_0 on 2017-02-28. Score: 15 | Accepted answer

There's a couple of way to achieve the result:

Chef has a trusted_dir to allow adding certificate to the trusted list. the documentation has a lot of details about it. Adding your CA certificate to this directory would solve the problem. knife has it also in a slightly different path as per it's own documentation
Chef use its own CA certiticate list in /opt/chef/embedded/ssl/certs/cacert.pem. 
You can add your CA certificate at end of this list to trust it. 

The second option has an advantage of allowing you to export the environment variable SSL_CERT_FILE pointing to chef cacert.pem to allow most of the tools using openssl library to know your CA certificate.
For the case of a self signed certificate on the chef server (or another server used as target in a recipe), knife ssl_fetch would allow all knife commands to work.
To add the server certificate to the cacert.pem for the case 2. above, you can use the following command:
# For a self signed CA certiticate
openssl s_client -showcerts -connect :443 /dev/null|openssl x509 -outform PEM >> /opt/chefdk/embedded/ssl/certs/cacert.pem

# For an internal CA signed certificate:
openssl s_client -showcerts -verify 5 -connect :443 /dev/null | awk '/BEGIN/,/END/{if(/BEGIN/){a++}; certs[a]=(certs[a] "\n" $0)}; END {print certs[a]}' >> /opt/chefdk/embedded/ssl/certs/cacert.pem

export SSL_CERT_FILE=/opt/chefdk/embedded/ssl/certs/cacert.pem

The openssl command is included in chef-dk, so this can be done under windows also.  Change the path to c:\opscode\ instead of /opt/. To export the environment variable use set SSL_CERT_FILE=... (with /P to add it permanently to your environment) in your command.


---

### Answer by username_1 on 2021-04-01. Score: 0

In my case, I was doing basically the same thing, because the internal certificate path was different than the typical certificate path, so I had to add my internal certificates. In my case, adding the SSL\_CERT\_FILE didn't work. I needed to copy my certificates, which I had exported as \*.cer and then made \*.pem versions using

. ./openssl x509 -inform der -in C:\dev\apps\certificates\org\_root.cer -out C:\dev\apps\certificates\org\_root.pem

I found the openssl tool here:

C:\opscode\chefdk\embedded\bin

Then I copied them to this location (which the location in the documentation above doesn't clarify very well) on the target machine:

C:\Users\[username]\.chef\trusted\_certs

I had to create the "trusted\_certs" folder on my target machine where I wanted to run the chef client. After copying the certificates there, it began working and trusting the internal certificate chain without SSL errors (in my case self-signed certificate error).

Also, on the ChefDK machine if you're using kitchen or something like that, I had to take the contents of my internal certificates' \*.pem files and copy the contents of the content to the tail of the "C:\opscode\chefdk\embedded\ssl\certs\cacert.pem" file or the cacert.pem file referenced by the SSL\_CERT\_FILE environment variable. In my case, I was copying an internal intermediate cert as well as a internal root cert and I believe they recommend that order also (ending with the root in the chain). This requirement on the ChefDK machine is due to the ChefDK communicating with a client machine using "remote\_file" and the solution I'm providing appears to relate to this Chef bug, which may be fixed in newer versions of Chef.

<https://github.com/chef/chef/issues/5944>

> **Comments:**
> **username_0**: You're just giving a complex multistep solution which ends doing what I describe as answer in a more convoluted manner... The trusted cert approach works nearly only for Chef client code, that's OK for nodes, usually not in CI systems.  
> **username_0**: I really fail to understand what this answer brings which is not in mine in fact.  
> **username_1**: Obviously answering your own question with your own solution is going to be the most ideal for your particular situation.  My answer is probably more helpful with someone with a similar situation whose encountering the same issue on Windows, particularly with the differences encountered such as requiring adding those specific files in those specific directories.  
> **username_0**: The trusted certs directory works only for chef itself, not for berks or others. And well, that's the point 1 of my answer with link to the official doc covering windows paths, etc. The second part is the end of my answer on where to add the CA certificates...  

---

