Answers: <p>Answered on Slack, the likely first issue here is that the output from <code>openssl req</code> is not a cert, it's a CSR. But there are some other lingering issues here too. It is recommended to use something like Certstrap to do internal cert generation rather than raw <code>openssl</code> commands as the modern standards are quite fiddly.</p>
  
Answers: CC BY-SA 4.0
Answers: 2019-07-30T10:34:40.640Z
Answers: There's also [`cfssl`](https://github.com/cloudflare/cfssl), which appears to have more community adoption.
Answers: d4nyll
Answers: CC BY-SA 3.0
Answers: 2018-01-23T21:26:42.287Z
Answers: 2018-01-23T21:26:42.287Z
Answers: coderanger
Body: <p>While configuring the chef provisioner I am running into the following error after running 'terraform apply'</p>
  
  <pre><code>chef_environment.terraform_01: Post https://10.90.239.223/organizations/mykitchen/environments: x509: cannot validate certificate for 10.90.239.223 because it doesn't contain any IP SANs
  </code></pre>
  
  <p>I tried this </p>
  
  <pre><code>openssl req -x509 -newkey rsa:4096 -keyout chef.key -out chef.pem -nodes -days 365 -config req.conf
  
  sudo chown opscode:opscode chef.*
  sudo mv chef.* /var/opt/opscode/nginx/ca/.
  
  sudo chef-server-ctl stop
  sudo chef-server-ctl reconfigure
  sudo chef-server-ctl start
  </code></pre>
  
  <p>my req.conf</p>
  
  <pre><code>[req]
  default_bits = 2048
  prompt = no
  default_md = sha256
  req_extensions = req_ext
  distinguished_name = dn
  
  [ dn ]
  C=US
  ST=mystate
  L=mycity
  O=DevOps
  OU=myname
  emailAddress=myemail@mycompany.com
  CN = 10.90.239.223
  
  [ req_ext ]
  subjectAltName = @alt_names
  
  [alt_names]
  IP = 10.90.239.223
  DNS.1 = 10.0.90.45
  DNS.2 = 10.90.50.8
  email = DevOps-3@10.90.239.223
  URI = https://10.90.239.223/
  </code></pre>
  
  <p>but I am still getting </p>
  
  <pre><code>chef_environment.terraform_01: Post https://10.90.239.223/organizations/mykitchen/environments: x509: cannot validate certificate for 10.90.239.223 because it doesn't contain any                                       IP SANs
  </code></pre>
  
  <p>In my chef provisioner config I also have</p>
  
  <pre><code>ssl_verify_mode = ":verify_none" 
  </code></pre>
  
  <p>So far I am stumped.  What am I missing?</p>
  
Tags: <chef><terraform><security><ssl>
Title: terraform chef provisioning - cannot validate certificate for 10.90.239.223 because it doesn't contain any IP SANs
UserDisplayName: scott
ThreadText: # terraform chef provisioning - cannot validate certificate for 10.90.239.223 because it doesn't contain any IP SANs
  
  (Asked by: username_0 on 2018-01-23)
  
  While configuring the chef provisioner I am running into the following error after running 'terraform apply'
  
  ```
  chef_environment.terraform_01: Post https://10.90.239.223/organizations/mykitchen/environments: x509: cannot validate certificate for 10.90.239.223 because it doesn't contain any IP SANs
  
  ```
  
  I tried this
  
  ```
  openssl req -x509 -newkey rsa:4096 -keyout chef.key -out chef.pem -nodes -days 365 -config req.conf
  
  sudo chown opscode:opscode chef.*
  sudo mv chef.* /var/opt/opscode/nginx/ca/.
  
  sudo chef-server-ctl stop
  sudo chef-server-ctl reconfigure
  sudo chef-server-ctl start
  
  ```
  
  my req.conf
  
  ```
  [req]
  default_bits = 2048
  prompt = no
  default_md = sha256
  req_extensions = req_ext
  distinguished_name = dn
  
  [ dn ]
  C=US
  ST=mystate
  L=mycity
  O=DevOps
  OU=myname
  emailAddress=myemail@mycompany.com
  CN = 10.90.239.223
  
  [ req_ext ]
  subjectAltName = @alt_names
  
  [alt_names]
  IP = 10.90.239.223
  DNS.1 = 10.0.90.45
  DNS.2 = 10.90.50.8
  email = DevOps-3@10.90.239.223
  URI = https://10.90.239.223/
  
  ```
  
  but I am still getting
  
  ```
  chef_environment.terraform_01: Post https://10.90.239.223/organizations/mykitchen/environments: x509: cannot validate certificate for 10.90.239.223 because it doesn't contain any                                       IP SANs
  
  ```
  
  In my chef provisioner config I also have
  
  ```
  ssl_verify_mode = ":verify_none" 
  
  ```
  
  So far I am stumped. What am I missing?
  
  **Tags:** chef, terraform, security, ssl
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2018-01-23. Score: 3 | Accepted answer
  
  Answered on Slack, the likely first issue here is that the output from `openssl req` is not a cert, it's a CSR. But there are some other lingering issues here too. It is recommended to use something like Certstrap to do internal cert generation rather than raw `openssl` commands as the modern standards are quite fiddly.
  
  > **Comments:**
  > **username_2**: There's also [`cfssl`](https://github.com/cloudflare/cfssl), which appears to have more community adoption.  
  
  ---
  
  