summaryrefslogtreecommitdiff
path: root/lib/chef/knife/ssl_check.rb
diff options
context:
space:
mode:
Diffstat (limited to 'lib/chef/knife/ssl_check.rb')
-rw-r--r--lib/chef/knife/ssl_check.rb32
1 files changed, 16 insertions, 16 deletions
diff --git a/lib/chef/knife/ssl_check.rb b/lib/chef/knife/ssl_check.rb
index e3005711fe..858ab3cf89 100644
--- a/lib/chef/knife/ssl_check.rb
+++ b/lib/chef/knife/ssl_check.rb
@@ -154,23 +154,23 @@ class Chef
ui.warn(<<~BAD_CERTS)
There are invalid certificates in your trusted_certs_dir.
OpenSSL will not use the following certificates when verifying SSL connections:
-
+
#{cert_debug_msg}
-
+
#{ui.color("TO FIX THESE WARNINGS:", :bold)}
-
+
We are working on documentation for resolving common issues uncovered here.
-
+
* If the certificate is generated by the server, you may try redownloading the
server's certificate. By default, the certificate is stored in the following
location on the host where your chef-server runs:
-
+
/var/opt/opscode/nginx/ca/SERVER_HOSTNAME.crt
-
+
Copy that file to your trusted_certs_dir (currently: #{configuration.trusted_certs_dir})
using SSH/SCP or some other secure method, then re-run this command to confirm
that the server's certificate is now trusted.
-
+
BAD_CERTS
# @TODO: ^ needs URL once documentation is posted.
end
@@ -185,21 +185,21 @@ BAD_CERTS
debug_chef_ssl_config
ui.err(<<~ADVICE)
-
+
#{ui.color("TO FIX THIS ERROR:", :bold)}
-
+
If the server you are connecting to uses a self-signed certificate, you must
configure chef to trust that server's certificate.
-
+
By default, the certificate is stored in the following location on the host
where your chef-server runs:
-
+
/var/opt/opscode/nginx/ca/SERVER_HOSTNAME.crt
-
+
Copy that file to your trusted_certs_dir (currently: #{configuration.trusted_certs_dir})
using SSH/SCP or some other secure method, then re-run this command to confirm
that the server's certificate is now trusted.
-
+
ADVICE
end
@@ -212,14 +212,14 @@ ADVICE
ui.error("You are attempting to connect to: '#{host}'")
ui.error("The server's certificate belongs to '#{cn}'")
ui.err(<<~ADVICE)
-
+
#{ui.color("TO FIX THIS ERROR:", :bold)}
-
+
The solution for this issue depends on your networking configuration. If you
are able to connect to this server using the hostname #{cn}
instead of #{host}, then you can resolve this issue by updating chef_server_url
in your configuration file.
-
+
If you are not able to connect to the server using the hostname #{cn}
you will have to update the certificate on the server to use the correct hostname.
ADVICE