Answers: <p>In my case, I was doing basically the same thing, because the internal certificate path was different than the typical certificate path, so I had to add my internal certificates.  In my case, adding the SSL_CERT_FILE didn't work.  I needed to copy my certificates, which I had exported as *.cer and then made *.pem versions using</p>
  <p>. ./openssl x509 -inform der -in C:\dev\apps\certificates\org_root.cer -out C:\dev\apps\certificates\org_root.pem</p>
  <p>I found the openssl tool here:</p>
  <p>C:\opscode\chefdk\embedded\bin</p>
  <p>Then I copied them to this location (which the location in the documentation above doesn't clarify very well) on the target machine:</p>
  <p>C:\Users\[username]\.chef\trusted_certs</p>
  <p>I had to create the &quot;trusted_certs&quot; folder on my target machine where I wanted to run the chef client.  After copying the certificates there, it began working and trusting the internal certificate chain without SSL errors (in my case self-signed certificate error).</p>
  <p>Also, on the ChefDK machine if you're using kitchen or something like that, I had to take the contents of my internal certificates' *.pem files and copy the contents of the content to the tail of the &quot;C:\opscode\chefdk\embedded\ssl\certs\cacert.pem&quot; file or the cacert.pem file referenced by the SSL_CERT_FILE environment variable.  In my case, I was copying an internal intermediate cert as well as a internal root cert and I believe they recommend that order also (ending with the root in the chain).  This requirement on the ChefDK machine is due to the ChefDK communicating with a client machine using &quot;remote_file&quot; and the solution I'm providing appears to relate to this Chef bug, which may be fixed in newer versions of Chef.</p>
  <p><a href="https://github.com/chef/chef/issues/5944" rel="nofollow noreferrer">https://github.com/chef/chef/issues/5944</a></p>
  
Answers: CC BY-SA 4.0
Answers: 2021-04-02T11:53:08.030Z
Answers: You're just giving a complex multistep solution which ends doing what I describe as answer in a more convoluted manner... The trusted cert approach works nearly only for Chef client code, that's OK for nodes, usually not in CI systems.
Answers: Tensibai
Answers: CC BY-SA 4.0
Answers: 2021-04-02T11:53:48.013Z
Answers: I really fail to understand what this answer brings which is not in mine in fact.
Answers: Tensibai
Answers: CC BY-SA 4.0
Answers: 2021-07-23T05:35:40.760Z
Answers: Obviously answering your own question with your own solution is going to be the most ideal for your particular situation.  My answer is probably more helpful with someone with a similar situation whose encountering the same issue on Windows, particularly with the differences encountered such as requiring adding those specific files in those specific directories.
Answers: Brandon Hawbaker
Answers: CC BY-SA 4.0
Answers: 2021-07-23T09:40:03.327Z
Answers: The trusted certs directory works only for chef itself, not for berks or others. And well, that's the point 1 of my answer with link to the official doc covering windows paths, etc. The second part is the end of my answer on where to add the CA certificates...
Answers: Tensibai
Answers: CC BY-SA 4.0
Answers: 2021-04-01T23:34:28.027Z
Answers: 2021-04-02T05:13:00.130Z
Answers: 2021-04-02T05:13:00.130Z
Answers: Brandon Hawbaker
Answers: <p>There's a couple of way to achieve the result:</p>
  
  <ol>
  <li><p>Chef has a <code>trusted_dir</code> to allow adding certificate to the trusted list. the <a href="https://docs.chef.io/chef_client_security.html#ssl-certificates" rel="nofollow noreferrer">documentation</a> has a lot of details about it. Adding your CA certificate to this directory would solve the problem. <code>knife</code> has it also in a slightly different path as per it's own <a href="https://docs.chef.io/knife_ssl_fetch.html" rel="nofollow noreferrer">documentation</a></p></li>
  <li><p>Chef use its own CA certiticate list in <code>/opt/chef/embedded/ssl/certs/cacert.pem</code>. 
  You can add your CA certificate at end of this list to trust it. </p></li>
  </ol>
  
  <p>The second option has an advantage of allowing you to export the environment variable <code>SSL_CERT_FILE</code> pointing to chef <code>cacert.pem</code> to allow most of the tools using <code>openssl</code> library to know your CA certificate.</p>
  
  <p>For the case of a self signed certificate on the chef server (or another server used as target in a recipe), <code>knife ssl_fetch</code> would allow all knife commands to work.</p>
  
  <p>To add the server certificate to the cacert.pem for the case 2. above, you can use the following command:</p>
  
  <pre><code># For a self signed CA certiticate
  openssl s_client -showcerts -connect &lt;YOUR_CHEF_SERVER&gt;:443 &lt;/dev/null 2&gt;/dev/null|openssl x509 -outform PEM &gt;&gt; /opt/chefdk/embedded/ssl/certs/cacert.pem
  
  # For an internal CA signed certificate:
  openssl s_client -showcerts -verify 5 -connect &lt;YOUR_CHEF_SERVER&gt;:443 &lt;/dev/null 2&gt;/dev/null | awk '/BEGIN/,/END/{if(/BEGIN/){a++}; certs[a]=(certs[a] "\n" $0)}; END {print certs[a]}' &gt;&gt; /opt/chefdk/embedded/ssl/certs/cacert.pem
  
  export SSL_CERT_FILE=/opt/chefdk/embedded/ssl/certs/cacert.pem
  </code></pre>
  
  <p>The openssl command is included in chef-dk, so this can be done under windows also.  Change the path to <code>c:\opscode\</code> instead of <code>/opt/</code>. To export the environment variable use <code>set SSL_CERT_FILE=...</code> (with <code>/P</code> to add it permanently to your environment) in your command.</p>
  
Answers: CC BY-SA 4.0
Answers: 2017-02-28T17:08:12.693Z
Answers: 2020-01-29T09:44:30.313Z
Answers: 2020-01-29T09:44:30.313Z
Answers: Tensibai
Body: <p>We do use an internal Certificate Authority to create server certificates in my company.</p>
  
  <p>We also have to deal with a transparent proxy doing SSL interception (MITM).</p>
  
  <p>I regularly encounter SSL validation errors due to Chef not knowing the CA  certificate, and sometimes it's the tooling around chef itself (berkshelf, knife; even chef client itself when talking to the server for the first time since chef 12 enables SSL by default).</p>
  
  <p>Question is: How do I make Chef aware of my CA certificate to get valid SSL exchanges ?</p>
  
Tags: <chef><ssl>
Title: How do I include my internal CA certificate to validate SSL exchanges in Chef?
UserDisplayName: Tensibai
ThreadText: # How do I include my internal CA certificate to validate SSL exchanges in Chef?
  
  (Asked by: username_0 on 2017-02-28)
  
  We do use an internal Certificate Authority to create server certificates in my company.
  
  We also have to deal with a transparent proxy doing SSL interception (MITM).
  
  I regularly encounter SSL validation errors due to Chef not knowing the CA certificate, and sometimes it's the tooling around chef itself (berkshelf, knife; even chef client itself when talking to the server for the first time since chef 12 enables SSL by default).
  
  Question is: How do I make Chef aware of my CA certificate to get valid SSL exchanges ?
  
  **Tags:** chef, ssl
  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_0 on 2017-02-28. Score: 15 | Accepted answer
  
  There's a couple of way to achieve the result:
  
  1. Chef has a `trusted_dir` to allow adding certificate to the trusted list. the [documentation](https://docs.chef.io/chef_client_security.html#ssl-certificates) has a lot of details about it. Adding your CA certificate to this directory would solve the problem. `knife` has it also in a slightly different path as per it's own [documentation](https://docs.chef.io/knife_ssl_fetch.html)
  2. Chef use its own CA certiticate list in `/opt/chef/embedded/ssl/certs/cacert.pem`.
     You can add your CA certificate at end of this list to trust it.
  
  The second option has an advantage of allowing you to export the environment variable `SSL_CERT_FILE` pointing to chef `cacert.pem` to allow most of the tools using `openssl` library to know your CA certificate.
  
  For the case of a self signed certificate on the chef server (or another server used as target in a recipe), `knife ssl_fetch` would allow all knife commands to work.
  
  To add the server certificate to the cacert.pem for the case 2. above, you can use the following command:
  
  ```
  # For a self signed CA certiticate
  openssl s_client -showcerts -connect <YOUR_CHEF_SERVER>:443 </dev/null 2>/dev/null|openssl x509 -outform PEM >> /opt/chefdk/embedded/ssl/certs/cacert.pem
  
  # For an internal CA signed certificate:
  openssl s_client -showcerts -verify 5 -connect <YOUR_CHEF_SERVER>:443 </dev/null 2>/dev/null | awk '/BEGIN/,/END/{if(/BEGIN/){a++}; certs[a]=(certs[a] "\n" $0)}; END {print certs[a]}' >> /opt/chefdk/embedded/ssl/certs/cacert.pem
  
  export SSL_CERT_FILE=/opt/chefdk/embedded/ssl/certs/cacert.pem
  
  ```
  
  The openssl command is included in chef-dk, so this can be done under windows also. Change the path to `c:\opscode\` instead of `/opt/`. To export the environment variable use `set SSL_CERT_FILE=...` (with `/P` to add it permanently to your environment) in your command.
  
  
  ---
  
  ### Answer by username_1 on 2021-04-01. Score: 0
  
  In my case, I was doing basically the same thing, because the internal certificate path was different than the typical certificate path, so I had to add my internal certificates. In my case, adding the SSL\_CERT\_FILE didn't work. I needed to copy my certificates, which I had exported as \*.cer and then made \*.pem versions using
  
  . ./openssl x509 -inform der -in C:\dev\apps\certificates\org\_root.cer -out C:\dev\apps\certificates\org\_root.pem
  
  I found the openssl tool here:
  
  C:\opscode\chefdk\embedded\bin
  
  Then I copied them to this location (which the location in the documentation above doesn't clarify very well) on the target machine:
  
  C:\Users\[username]\.chef\trusted\_certs
  
  I had to create the "trusted\_certs" folder on my target machine where I wanted to run the chef client. After copying the certificates there, it began working and trusting the internal certificate chain without SSL errors (in my case self-signed certificate error).
  
  Also, on the ChefDK machine if you're using kitchen or something like that, I had to take the contents of my internal certificates' \*.pem files and copy the contents of the content to the tail of the "C:\opscode\chefdk\embedded\ssl\certs\cacert.pem" file or the cacert.pem file referenced by the SSL\_CERT\_FILE environment variable. In my case, I was copying an internal intermediate cert as well as a internal root cert and I believe they recommend that order also (ending with the root in the chain). This requirement on the ChefDK machine is due to the ChefDK communicating with a client machine using "remote\_file" and the solution I'm providing appears to relate to this Chef bug, which may be fixed in newer versions of Chef.
  
  <https://github.com/chef/chef/issues/5944>
  
  > **Comments:**
  > **username_0**: You're just giving a complex multistep solution which ends doing what I describe as answer in a more convoluted manner... The trusted cert approach works nearly only for Chef client code, that's OK for nodes, usually not in CI systems.  
  > **username_0**: I really fail to understand what this answer brings which is not in mine in fact.  
  > **username_1**: Obviously answering your own question with your own solution is going to be the most ideal for your particular situation.  My answer is probably more helpful with someone with a similar situation whose encountering the same issue on Windows, particularly with the differences encountered such as requiring adding those specific files in those specific directories.  
  > **username_0**: The trusted certs directory works only for chef itself, not for berks or others. And well, that's the point 1 of my answer with link to the official doc covering windows paths, etc. The second part is the end of my answer on where to add the CA certificates...  
  
  ---
  
  