<p>You shouldn't. Instead you should use proper secrets management system that would provide you unlocked SSL certificate.</p>

<hr>

<p>By secret management I mean tooling like <a href="https://kubernetes.io/docs/concepts/configuration/secret/" rel="nofollow noreferrer">k8s secret management</a> or <a href="https://www.vaultproject.io" rel="nofollow noreferrer">Vault</a>.</p>

<p>You can read <a href="https://medium.com/on-docker/secrets-and-lie-abilities-the-state-of-modern-secret-management-2017-c82ec9136a3d" rel="nofollow noreferrer">Medium post about secrets</a>. </p>

CC BY-SA 3.0
2017-08-20T12:46:18.100Z
Maybe you could elucidate what proper secrets management means to you.
chicks
CC BY-SA 3.0
2017-08-20T14:03:23.150Z
@Lukasz we need to have SSL certificates to maintain our security.
pandey
CC BY-SA 3.0
2017-08-20T14:21:34.337Z
@pandey I am not saying that you should resign from SSL but from the fact that your certificate need password. This is the problem.
Hauleth
CC BY-SA 3.0
2017-08-20T14:22:30.170Z
Yes right, so can we provide this password while reloading. A httpd
pandey
CC BY-SA 3.0
2017-08-20T14:26:56.593Z
The point of my post is that there should be no password at all. Instead your httpd server should have access to the certificate as is, without any additional information. [Here you can find how](https://serverfault.com/questions/160768/stop-apache-from-asking-for-ssl-password-each-restart)
Hauleth
CC BY-SA 3.0
2017-08-24T16:59:01.453Z
Yeah I just took out the password for pem key to get my httpd service get run with out password. One other way I tried is like SSLPassPhraseDialog which needs to be placed in httpd.conf file as you mentioned in above comment
pandey
CC BY-SA 3.0
2017-08-19T16:29:36.417Z
2017-08-20T14:25:26.333Z
2017-08-20T14:25:26.333Z
Hauleth
<p>I got stuck with a scenario where I need to provide runtime value while restarting/starting <code>httpd</code> service using Chef.</p>

<p>I installed SSL certs where it asks password for every reload or start. I tried giving:</p>

<pre><code>service 'httpd' do
  supports restart: true, reload: false, status: true
  options "password"
end 
</code></pre>

<p>But I don't have any luck. </p>

<p>Any help about how to pass this value while <code>httpd</code> restarts using Chef?</p>

<chef><apache-httpd>
How to give value in runtime for chef
pandey
# How to give value in runtime for chef

(Asked by: username_0 on 2017-08-18)

I got stuck with a scenario where I need to provide runtime value while restarting/starting httpd service using Chef.
I installed SSL certs where it asks password for every reload or start. I tried giving:
service 'httpd' do
  supports restart: true, reload: false, status: true
  options "password"
end 

But I don't have any luck. 
Any help about how to pass this value while httpd restarts using Chef?

**Tags:** chef, apache-httpd


---

## 1 answers

### Answer by username_1 on 2017-08-19. Score: 2 | Accepted answer

You shouldn't. Instead you should use proper secrets management system that would provide you unlocked SSL certificate.

---

By secret management I mean tooling like [k8s secret management](https://kubernetes.io/docs/concepts/configuration/secret/) or [Vault](https://www.vaultproject.io).

You can read [Medium post about secrets](https://medium.com/on-docker/secrets-and-lie-abilities-the-state-of-modern-secret-management-2017-c82ec9136a3d).

> **Comments:**
> **username_2**: Maybe you could elucidate what proper secrets management means to you.  
> **username_0**: @Lukasz we need to have SSL certificates to maintain our security.  
> **username_1**: @username_0 I am not saying that you should resign from SSL but from the fact that your certificate need password. This is the problem.  
> **username_0**: Yes right, so can we provide this password while reloading. A httpd  
> **username_1**: The point of my post is that there should be no password at all. Instead your httpd server should have access to the certificate as is, without any additional information. [Here you can find how](https://serverfault.com/questions/160768/stop-apache-from-asking-for-ssl-password-each-restart)  
> **username_0**: Yeah I just took out the password for pem key to get my httpd service get run with out password. One other way I tried is like SSLPassPhraseDialog which needs to be placed in httpd.conf file as you mentioned in above comment  

---

