set setting reset


chef-server からの bootstrap で ERROR: SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed


chef-server から bootstrap すると表題のエラーが出ました。 bootstrap 先のサーバから knife client list とか色々やっても client として登録されないので全部ダメ。

ERROR: Your private key could not be loaded from /etc/chef/client.pem
Check your configuration file and ensure that your private key is readable

下記サイトなどによると knife ssl fetch をしなさいとあったので、chef-server 上で試してみるもまだうまくいきません。

bootstrap したいサーバ => , chef-server => です。

Doing old-style registration with the validation key at /etc/chef-server/chef-validator.pem...
Delete your validation key in order to use your user credentials instead

Connecting to Starting first Chef Client run... Starting Chef Client, version 12.3.0
#log_level                   :info Creating a new client identity for infra-amazon-linux-test-1 using the validator key. [2015-06-24T02:54:22+00:00] ERROR: SSL Validation failure connecting to host: - hostname "" does not match the server certificate ================================================================================ Chef encountered an error attempting to create the client "infra-amazon-linux-test-1" ================================================================================ [2015-06-24T02:54:22+00:00] FATAL: Stacktrace dumped to /var/chef/cache/chef-stacktrace.out Chef Client failed. 0 resources updated in 0.998938885 seconds [2015-06-24T02:54:22+00:00] ERROR: hostname "" does not match the server certificate [2015-06-24T02:54:22+00:00] FATAL: Chef::Exceptions::ChildConvergeError: Chef run process exited unsuccessfully (exit code 1)

knife ssl check というコマンドもあるので試してみると

Connecting to host
ERROR: The SSL cert is signed by a trusted authority but is not valid for the given hostname
ERROR: You are attempting to connect to:   ''
ERROR: The server's certificate belongs to 'chef-server'


The solution for this issue depends on your networking configuration. If you
are able to connect to this server using the hostname chef-server
instead of, then you can resolve this issue by updating chef_server_url
in your configuration file.

If you are not able to connect to the server using the hostname chef-server
you will have to update the certificate on the server to use the correct hostname.

IP で接続しようとしてエラーになっているようです。 chef-server という名前で接続させなければならないようなので、設定を探すと knife.rb が犯人でした。

#chef_server_url             ''
chef_server_url             'https://chef-server'

上記の様に編集した後に bootstrap したらうまくいきました。 chef 初心者丸出しな内容で我ながら辟易します。。。