summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--CHANGELOG.md2
-rw-r--r--DOC_CHANGES.md5
-rw-r--r--RELEASE_NOTES.md7
-rw-r--r--lib/chef/client.rb33
-rw-r--r--lib/chef/config.rb2
-rw-r--r--spec/unit/config_spec.rb4
6 files changed, 7 insertions, 46 deletions
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 426b70c224..64c35d257b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -20,7 +20,7 @@
Typo fixes
* [Pull 2505](https://github.com/opscode/chef/pull/2505) Make Chef handle URIs in a case-insensitive manner
* [**Phil Dibowitz**](https://github.com/jaymzh):
- Let people disable SSL warnings.
+ Drop SSL warnings now that we have a safe default
### Chef Contributions
* ruby 1.9.3 support is dropped
diff --git a/DOC_CHANGES.md b/DOC_CHANGES.md
index 55b56ac407..dbe79478f5 100644
--- a/DOC_CHANGES.md
+++ b/DOC_CHANGES.md
@@ -36,5 +36,6 @@ The `--audit-mode` flag should be a link to the documentation for that flag
This probably only needs to be a bullet point added to http://docs.getchef.com/nodes.html#about-why-run-mode under the
`certain assumptions` section
-## Suppress SSL Warnings
-There is now a `suppress_ssl_warnings` config to suppress the SSL warnings.
+## Drop SSL Warnings
+Now that the default for SSL checking is on, no more warning is emitted when SSL
+checking is off.
diff --git a/RELEASE_NOTES.md b/RELEASE_NOTES.md
index d5c0e5024d..329f55555b 100644
--- a/RELEASE_NOTES.md
+++ b/RELEASE_NOTES.md
@@ -64,10 +64,9 @@ The package resource on OpenBSD is wired up to use the new OpenBSD package provi
Previously, when a URI scheme contained all uppercase letters, Chef would reject the URI as invalid. In compliance with RFC3986, Chef now treats URI schemes in a case insensitive manner.
-## Suppress SSL Warnings
-You can now disable SSL warnings with `suppress_ssl_warnings true` in your
-config. These warnings are here for a reason, so be sure you know what you
-are doing.
+## Drop SSL Warnings
+Now that the default for SSL checking is on, no more warning is emitted when SSL
+checking is off.
# Chef Client Release Notes 12.0.0:
diff --git a/lib/chef/client.rb b/lib/chef/client.rb
index 9fe45b77df..3d9678ea31 100644
--- a/lib/chef/client.rb
+++ b/lib/chef/client.rb
@@ -419,8 +419,6 @@ class Chef
begin
runlock.save_pid
- check_ssl_config
-
request_id = Chef::RequestID.instance.request_id
run_context = nil
@events.run_start(Chef::VERSION)
@@ -529,37 +527,6 @@ class Chef
Chef::ReservedNames::Win32::Security.has_admin_privileges?
end
- def check_ssl_config
- if Chef::Config[:ssl_verify_mode] == :verify_none and !Chef::Config[:verify_api_cert] and !Chef::Config[:suppress_ssl_warnings]
- Chef::Log.warn(<<-WARN)
-
-* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
-SSL validation of HTTPS requests is disabled. HTTPS connections are still
-encrypted, but chef is not able to detect forged replies or man in the middle
-attacks.
-
-To fix this issue add an entry like this to your configuration file:
-
-```
- # Verify all HTTPS connections (recommended)
- ssl_verify_mode :verify_peer
-
- # OR, Verify only connections to chef-server
- verify_api_cert true
-```
-
-To check your SSL configuration, or troubleshoot errors, you can use the
-`knife ssl check` command like so:
-
-```
- knife ssl check -c #{Chef::Config.config_file}
-```
-
-* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
-WARN
- end
- end
-
end
end
diff --git a/lib/chef/config.rb b/lib/chef/config.rb
index f65b9a010f..453a8f83da 100644
--- a/lib/chef/config.rb
+++ b/lib/chef/config.rb
@@ -352,8 +352,6 @@ class Chef
# be validated.
default :ssl_verify_mode, :verify_peer
- default :suppress_ssl_warnings, false
-
# Whether or not to verify the SSL cert for HTTPS requests to the Chef
# server API. If set to `true`, the server's cert will be validated
# regardless of the :ssl_verify_mode setting. This is set to `true` when
diff --git a/spec/unit/config_spec.rb b/spec/unit/config_spec.rb
index 4cae31b98c..ed2003e8bf 100644
--- a/spec/unit/config_spec.rb
+++ b/spec/unit/config_spec.rb
@@ -246,10 +246,6 @@ describe Chef::Config do
expect(Chef::Config[:ssl_verify_mode]).to eq(:verify_peer)
end
- it "Chef::Config[:suppress_ssl_warnings] defaults to false" do
- expect(Chef::Config[:suppress_ssl_warnings]).to eq(false)
- end
-
it "Chef::Config[:ssl_ca_path] defaults to nil" do
expect(Chef::Config[:ssl_ca_path]).to be_nil
end