<p>Answered on Slack, the likely first issue here is that the output from <code>openssl req</code> is not a cert, it's a CSR. But there are some other lingering issues here too. It is recommended to use something like Certstrap to do internal cert generation rather than raw <code>openssl</code> commands as the modern standards are quite fiddly.</p>

CC BY-SA 4.0
2019-07-30T10:34:40.640Z
There's also [`cfssl`](https://github.com/cloudflare/cfssl), which appears to have more community adoption.
d4nyll
CC BY-SA 3.0
2018-01-23T21:26:42.287Z
2018-01-23T21:26:42.287Z
coderanger
<p>While configuring the chef provisioner I am running into the following error after running 'terraform apply'</p>

<pre><code>chef_environment.terraform_01: Post https://10.90.239.223/organizations/mykitchen/environments: x509: cannot validate certificate for 10.90.239.223 because it doesn't contain any IP SANs
</code></pre>

<p>I tried this </p>

<pre><code>openssl req -x509 -newkey rsa:4096 -keyout chef.key -out chef.pem -nodes -days 365 -config req.conf

sudo chown opscode:opscode chef.*
sudo mv chef.* /var/opt/opscode/nginx/ca/.

sudo chef-server-ctl stop
sudo chef-server-ctl reconfigure
sudo chef-server-ctl start
</code></pre>

<p>my req.conf</p>

<pre><code>[req]
default_bits = 2048
prompt = no
default_md = sha256
req_extensions = req_ext
distinguished_name = dn

[ dn ]
C=US
ST=mystate
L=mycity
O=DevOps
OU=myname
emailAddress=myemail@mycompany.com
CN = 10.90.239.223

[ req_ext ]
subjectAltName = @alt_names

[alt_names]
IP = 10.90.239.223
DNS.1 = 10.0.90.45
DNS.2 = 10.90.50.8
email = DevOps-3@10.90.239.223
URI = https://10.90.239.223/
</code></pre>

<p>but I am still getting </p>

<pre><code>chef_environment.terraform_01: Post https://10.90.239.223/organizations/mykitchen/environments: x509: cannot validate certificate for 10.90.239.223 because it doesn't contain any                                       IP SANs
</code></pre>

<p>In my chef provisioner config I also have</p>

<pre><code>ssl_verify_mode = ":verify_none" 
</code></pre>

<p>So far I am stumped.  What am I missing?</p>

<chef><terraform><security><ssl>
terraform chef provisioning - cannot validate certificate for 10.90.239.223 because it doesn't contain any IP SANs
scott
# terraform chef provisioning - cannot validate certificate for 10.90.239.223 because it doesn't contain any IP SANs

(Asked by: username_0 on 2018-01-23)

While configuring the chef provisioner I am running into the following error after running 'terraform apply'
chef_environment.terraform_01: Post https://10.90.239.223/organizations/mykitchen/environments: x509: cannot validate certificate for 10.90.239.223 because it doesn't contain any IP SANs

I tried this 
openssl req -x509 -newkey rsa:4096 -keyout chef.key -out chef.pem -nodes -days 365 -config req.conf

sudo chown opscode:opscode chef.*
sudo mv chef.* /var/opt/opscode/nginx/ca/.

sudo chef-server-ctl stop
sudo chef-server-ctl reconfigure
sudo chef-server-ctl start

my req.conf
[req]
default_bits = 2048
prompt = no
default_md = sha256
req_extensions = req_ext
distinguished_name = dn

[ dn ]
C=US
ST=mystate
L=mycity
O=DevOps
OU=myname
emailAddress=myemail@mycompany.com
CN = 10.90.239.223

[ req_ext ]
subjectAltName = @alt_names

[alt_names]
IP = 10.90.239.223
DNS.1 = 10.0.90.45
DNS.2 = 10.90.50.8
email = DevOps-3@10.90.239.223
URI = https://10.90.239.223/

but I am still getting 
chef_environment.terraform_01: Post https://10.90.239.223/organizations/mykitchen/environments: x509: cannot validate certificate for 10.90.239.223 because it doesn't contain any                                       IP SANs

In my chef provisioner config I also have
ssl_verify_mode = ":verify_none" 

So far I am stumped.  What am I missing?

**Tags:** chef, terraform, security, ssl


---

## 1 answers

### Answer by username_1 on 2018-01-23. Score: 3 | Accepted answer

Answered on Slack, the likely first issue here is that the output from `openssl req` is not a cert, it's a CSR. But there are some other lingering issues here too. It is recommended to use something like Certstrap to do internal cert generation rather than raw `openssl` commands as the modern standards are quite fiddly.

> **Comments:**
> **username_2**: There's also [`cfssl`](https://github.com/cloudflare/cfssl), which appears to have more community adoption.  

---

