1

While configuring the chef provisioner I am running into the following error after running 'terraform apply'

chef_environment.terraform_01: Post https://10.90.239.223/organizations/mykitchen/environments: x509: cannot validate certificate for 10.90.239.223 because it doesn't contain any IP SANs

I tried this

openssl req -x509 -newkey rsa:4096 -keyout chef.key -out chef.pem -nodes -days 365 -config req.conf

sudo chown opscode:opscode chef.*
sudo mv chef.* /var/opt/opscode/nginx/ca/.

sudo chef-server-ctl stop
sudo chef-server-ctl reconfigure
sudo chef-server-ctl start

my req.conf

[req]
default_bits = 2048
prompt = no
default_md = sha256
req_extensions = req_ext
distinguished_name = dn

[ dn ]
C=US
ST=mystate
L=mycity
O=DevOps
OU=myname
emailAddress=myemail@mycompany.com
CN = 10.90.239.223

[ req_ext ]
subjectAltName = @alt_names

[alt_names]
IP = 10.90.239.223
DNS.1 = 10.0.90.45
DNS.2 = 10.90.50.8
email = DevOps-3@10.90.239.223
URI = https://10.90.239.223/

but I am still getting

chef_environment.terraform_01: Post https://10.90.239.223/organizations/mykitchen/environments: x509: cannot validate certificate for 10.90.239.223 because it doesn't contain any                                       IP SANs

In my chef provisioner config I also have

ssl_verify_mode = ":verify_none" 

So far I am stumped. What am I missing?

3

Answered on Slack, the likely first issue here is that the output from openssl req is not a cert, it's a CSR. But there are some other lingering issues here too. It is recommended to use something like Certstrap to do internal cert generation rather than raw openssl commands as the modern standards are quite fiddly.

  • There's also cfssl, which appears to have more community adoption. – d4nyll Jul 30 '19 at 10:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.