Amazon AWS Private CA Certificate Chains In Chef Automate or Chef Server

Automate or Chef Infra Servers need to be configured with the full cert chain because their certificate's chain is not automatically sourced from a ca-bundle or keychain store on operating systems. If they do not, the client has no way to verify the cert chain and the attempted TLS connection fails. Amazon/AWS's private CA cert chain is one such root CA. We will use that chain as an example here. Keywords: CA, PKI, chain, cert, key

Feb 20, 2026
Knowledge

Title

URL Name

Amazon-AWS-Private-CA-Certificate-Chains

Article Number

000225660

Environment

Clients of Automate or Chef Infra Servers

Question/Problem Description

All systems that want to be secure must provide or use certs and chains of certs.

Chef Client, Workstation, and all the Progress Chef server systems default to using certs to protect their communications.

See the Clarifying Information and Resolution sections for more detail on this capability in our products.

Steps to Reproduce

Clarifying Information

Discussion on the files stored in the trusted_certs directory of a Chef Workstation or Chef Client install.

For insight into where those directories occur in each system, see: https://docs.chef.io/chef_client_security/#trusted_certs-directory

These cert files come from one or both of two places

When a Chef Workstation does a knife bootstrap, it places the files from its own trusted_certs directory into the newly created chef-client’s trusted_certs directory, like this: https://github.com/chef/chef/blob/v17.10.3/knife/lib/chef/knife/core/bootstrap_context.rb#L230-L239
Or, a Chef Workstation or an older Chef Client that had knife embedded can do knife ssl fetch and this will retrieve certs that it can use. This command will
- Reach out to whatever chef_server_url is configured in the calling system’s config,rb/client.rb/knife.rb
- Grab ALL of the TLS certs offered by the responding web server
- And store each cert in file(s) named using a certain format in the trusted_certs directory for the chef-client/knife/Chef Workstation

knife ssl fetch Example

Here is an example of running knife ssl fetch from a Chef Workstation install.

These certs are being gathered from the ones configured for Hosted Chef, api.opscode.com AKA api.chef.io . Each cert gets a special name when they are written to the filesystem. Notice also that inside the specially named cert files, they are just a regular x509 format certificate body.

If you took each of these cert files and added them to a chef-client’s trusted_certs folder, that chef-client would then trust Hosted Chef, or api.opscode.com as well.

Notice the first file is named chef_io.crt. This is a wildcard cert for chef.io That is why there is no hostname.

mcwfhhorn:sean-horn-opscode horn$ knife ssl fetch
WARNING: Certificates from api.opscode.com will be fetched and placed in your trusted_cert
       directory (/Users/horn/Downloads/ocs/sean-horn-opscode/.chef/trusted_certs).

       Knife has no means to verify these are the correct certificates. You should
       verify the authenticity of these certificates after downloading.
Adding certificate for chef_io in /Users/horn/Downloads/ocs/sean-horn-opscode/.chef/trusted_certs/chef_io.crt
Adding certificate for Amazon in /Users/horn/Downloads/ocs/sean-horn-opscode/.chef/trusted_certs/Amazon.crt
Adding certificate for Amazon_Root_CA_1 in /Users/horn/Downloads/ocs/sean-horn-opscode/.chef/trusted_certs/Amazon_Root_CA_1.crt
Adding certificate for Starfield_Services_Root_Certificate_Authority_-_G2 in /Users/horn/Downloads/ocs/sean-horn-opscode/.chef/trusted_certs/Starfield_Services_Root_Certificate_Authority_-_G2.crt


mcwfhhorn:sean-horn-opscode horn$ ls .chef/trusted_certs/
Amazon.crt                        Starfield_Services_Root_Certificate_Authority_-_G2.crt    chefserver1FE.crt
Amazon_Root_CA_1.crt                    centos-6_3.crt                        supermarket.crt
DigiCert_SHA2_Secure_Server_CA.crt            chef_io.crt                        wildcard_opscode_com.crt

mcwfhhorn:sean-horn-opscode horn$ cat /Users/horn/Downloads/ocs/sean-horn-opscode/.chef/trusted_certs/Amazon_Root_CA_1.crt
-----BEGIN CERTIFICATE-----
MIIEkjCCA3qgAwIBAgITBn+USionzfP6wq4rAfkI7rnExjANBgkqhkiG9w0BAQsF
ADCBmDELMAkGA1UEBhMCVVMxEDAOBgNVBAgTB0FyaXpvbmExEzARBgNVBAcTClNj
b3R0c2RhbGUxJTAjBgNVBAoTHFN0YXJmaWVsZCBUZWNobm9sb2dpZXMsIEluYy4x
OzA5BgNVBAMTMlN0YXJmaWVsZCBTZXJ2aWNlcyBSb290IENlcnRpZmljYXRlIEF1
dGhvcml0eSAtIEcyMB4XDTE1MDUyNTEyMDAwMFoXDTM3MTIzMTAxMDAwMFowOTEL
MAkGA1UEBhMCVVMxDzANBgNVBAoTBkFtYXpvbjEZMBcGA1UEAxMQQW1hem9uIFJv
b3QgQ0EgMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALJ4gHHKeNXj
ca9HgFB0fW7Y14h29Jlo91ghYPl0hAEvrAIthtOgQ3pOsqTQNroBvo3bSMgHFzZM
9O6II8c+6zf1tRn4SWiw3te5djgdYZ6k/oI2peVKVuRF4fn9tBb6dNqcmzU5L/qw
IFAGbHrQgLKm+a/sRxmPUDgH3KKHOVj4utWp+UhnMJbulHheb4mjUcAwhmahRWa6
VOujw5H5SNz/0egwLX0tdHA114gk957EWW67c4cX8jJGKLhD+rcdqsq08p8kDi1L
93FcXmn/6pUCyziKrlA4b9v7LWIbxcceVOF34GfID5yHI9Y/QCB/IIDEgEw+OyQm
jgSubJrIqg0CAwEAAaOCATEwggEtMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/
BAQDAgGGMB0GA1UdDgQWBBSEGMyFNOy8DJSULghZnMeyEE4KCDAfBgNVHSMEGDAW
gBScXwDfqgHXMCs4iKK4bUqc8hGRgzB4BggrBgEFBQcBAQRsMGowLgYIKwYBBQUH
MAGGImh0dHA6Ly9vY3NwLnJvb3RnMi5hbWF6b250cnVzdC5jb20wOAYIKwYBBQUH
MAKGLGh0dHA6Ly9jcnQucm9vdGcyLmFtYXpvbnRydXN0LmNvbS9yb290ZzIuY2Vy
MD0GA1UdHwQ2MDQwMqAwoC6GLGh0dHA6Ly9jcmwucm9vdGcyLmFtYXpvbnRydXN0
LmNvbS9yb290ZzIuY3JsMBEGA1UdIAQKMAgwBgYEVR0gADANBgkqhkiG9w0BAQsF
AAOCAQEAYjdCXLwQtT6LLOkMm2xF4gcAevnFWAu5CIw+7bMlPLVvUOTNNWqnkzSW
MiGpSESrnO09tKpzbeR/FoCJbM8oAxiDR3mjEH4wW6w7sGDgd9QIpuEdfF7Au/ma
eyKdpwAJfqxGF4PcnCZXmTA5YpaP7dreqsXMGz7KQ2hsVxa81Q4gLv7/wmpdLqBK
bRRYh5TmOTFffHPLkIhqhBGWJ6bt2YFGpn6jcgAKUj6DiAdjd4lpFw85hdKrCEVN
0FE6/V1dN2RMfjCyVSRCnTawXZwXgWHxyvkQAiSr6w10kY17RSlQOYiypok1JR4U
akcjMS9cmvqtmg5iUaQqqcT5NJ0hGA==
-----END CERTIFICATE-----

Openssl ShowCerts

Notice that the certs retrieved when I connect to api.opscode.com with openssl and ask for the cert chain are identical to the ones above. This is because knife ssl fetch does something very similar to retrieve the certs from the configured Chef Server.

mcwfhhorn:sean-horn-opscode horn$ openssl s_client -showcerts -connect api.opscode.com:443

CONNECTED(00000006)
depth=4 C = US, O = "Starfield Technologies, Inc.", OU = Starfield Class 2 Certification Authority
verify return:1
depth=3 C = US, ST = Arizona, L = Scottsdale, O = "Starfield Technologies, Inc.", CN = Starfield Services Root Certificate Authority - G2
verify return:1
depth=2 C = US, O = Amazon, CN = Amazon Root CA 1
verify return:1
depth=1 C = US, O = Amazon, OU = Server CA 1B, CN = Amazon
verify return:1
depth=0 CN = chef.io
verify return:1
---
Certificate chain
 0 s:/CN=chef.io
   i:/C=US/O=Amazon/OU=Server CA 1B/CN=Amazon
-----BEGIN CERTIFICATE-----
MIIGGjCCBQKgAwIBAgIQASIa6eHWs66V0f8xV0hi3TANBgkqhkiG9w0BAQsFADBG
MQswCQYDVQQGEwJVUzEPMA0GA1UEChMGQW1hem9uMRUwEwYDVQQLEwxTZXJ2ZXIg
Q0EgMUIxDzANBgNVBAMTBkFtYXpvbjAeFw0yMjEwMDYwMDAwMDBaFw0yMzExMDMy
MzU5NTlaMBIxEDAOBgNVBAMTB2NoZWYuaW8wggEiMA0GCSqGSIb3DQEBAQUAA4IB
DwAwggEKAoIBAQCnuwW0eL90XF50xknasjahXJYCTAIGwuZZ804byscDoqohGtuB
m7AwCn+b16grBmPIoJBQFniD5IcSXp0XEiX2eOmwg/kRJcJCfkGd7Fj4VzUgSYBT
GRgfNQMR4l45cD19T12m7jVAmChWdxA+H42/bcGK92fi7llye8Z0m+e00ZpLZdpR
ZBPZAZaZJcPpj68LuYNV4+00l1SFDXTJ3LGAGQ4fG//bGW983fzrNxedZCNecjMU
OjD0jg2c9Fk+a9k/G7cZrc2KGc1LlMV5tb9j5m0qTa9bdzfim8l5TfPh4FJ5qyc3
jyOMNw6pT/RZOnql9Gs6CcLYwdsOcKKG7mTNAgMBAAGjggM2MIIDMjAfBgNVHSME
GDAWgBRZpGYGUqB7lZI8o5QHJ5Z0W/k90DAdBgNVHQ4EFgQU/oaynwMR/p4tJk2t
bqA9PN8WANMwaAYDVR0RBGEwX4IHY2hlZi5pb4IRYXBpLmJlcmtzaGVsZi5jb22C
CSouY2hlZi5pb4ILZ2V0Y2hlZi5jb22CC29wc2NvZGUuY29tgg0qLm9wc2NvZGUu
Y29tgg0qLmdldGNoZWYuY29tMA4GA1UdDwEB/wQEAwIFoDAdBgNVHSUEFjAUBggr
BgEFBQcDAQYIKwYBBQUHAwIwPQYDVR0fBDYwNDAyoDCgLoYsaHR0cDovL2NybC5z
Y2ExYi5hbWF6b250cnVzdC5jb20vc2NhMWItMS5jcmwwEwYDVR0gBAwwCjAIBgZn
gQwBAgEwdQYIKwYBBQUHAQEEaTBnMC0GCCsGAQUFBzABhiFodHRwOi8vb2NzcC5z
Y2ExYi5hbWF6b250cnVzdC5jb20wNgYIKwYBBQUHMAKGKmh0dHA6Ly9jcnQuc2Nh
MWIuYW1hem9udHJ1c3QuY29tL3NjYTFiLmNydDAMBgNVHRMBAf8EAjAAMIIBfAYK
KwYBBAHWeQIEAgSCAWwEggFoAWYAdgDoPtDaPvUGNTLnVyi8iWvJA9PL0RFr7Otp
4Xd9bQa9bgAAAYOsQ3PLAAAEAwBHMEUCIQCU/ydppvJQimfNlUgaEGgEeX/b10Lv
Cmd76dKpgSBOIgIgGc7jY0fAQn6PmqMlHocVOoNDJO82xgSQFYmmpF3CP+kAdQCz
c3cH4YRQ+GOG1gWp3BEJSnktsWcMC4fc8AMOeTalmgAAAYOsQ3PmAAAEAwBGMEQC
ICQTBeLsZ9InZ6GogveUR5pUYAqxt/JBYgStKrVLYMTyAiBYQLb3FDp2ll8k2NJF
+9tIZgKuzZN1nxppnoh86+8fDwB1ALc++yTfnE26dfI5xbpY9Gxd/ELPep81xJ4d
CYEl7bSZAAABg6xDc8MAAAQDAEYwRAIgP8hAi0CGPKWvwpaXhfw+lWuyDTzUSk8x
SKOFWmuLTqQCICKuXdo4UyRdScjl2igNHRZtsQGyBpH/za79ZqJN9/u4MA0GCSqG
SIb3DQEBCwUAA4IBAQCDyEyfYx2UALfKIEiF0R2Vvusv2aNg9L+PwqjtxUy5+Lrg
nkzIsUoXn2sd/qStMSfAlm0180G+UFTIEN5eZC4iKj5uZzGIekEywECl3kst7GfS
WpmV1jwqdUiKUq352Nf2UUC0FPzX6imnQLLPpLwRaVq6CxqxTKue55M61ODcD70U
3T4PYrLmYToK+WxCgYOV/KPg05/heCnBGcWKB7lSCQcc+xJY9nyOeGC3M2aSSvAS
aNgL/VNdQJsQaxYSpRwQvG+500WUKRKFVUe8lwp0XuUqmKZD5LxoWJB1R/thwQAz
40FRCC2vTDq7Vje/BVpC6T0J5RZBbHnfb+GVjQkW
-----END CERTIFICATE-----
 1 s:/C=US/O=Amazon/OU=Server CA 1B/CN=Amazon
   i:/C=US/O=Amazon/CN=Amazon Root CA 1
-----BEGIN CERTIFICATE-----
MIIESTCCAzGgAwIBAgITBn+UV4WH6Kx33rJTMlu8mYtWDTANBgkqhkiG9w0BAQsF
ADA5MQswCQYDVQQGEwJVUzEPMA0GA1UEChMGQW1hem9uMRkwFwYDVQQDExBBbWF6
b24gUm9vdCBDQSAxMB4XDTE1MTAyMjAwMDAwMFoXDTI1MTAxOTAwMDAwMFowRjEL
MAkGA1UEBhMCVVMxDzANBgNVBAoTBkFtYXpvbjEVMBMGA1UECxMMU2VydmVyIENB
IDFCMQ8wDQYDVQQDEwZBbWF6b24wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
AoIBAQDCThZn3c68asg3Wuw6MLAd5tES6BIoSMzoKcG5blPVo+sDORrMd4f2AbnZ
cMzPa43j4wNxhplty6aUKk4T1qe9BOwKFjwK6zmxxLVYo7bHViXsPlJ6qOMpFge5
blDP+18x+B26A0piiQOuPkfyDyeR4xQghfj66Yo19V+emU3nazfvpFA+ROz6WoVm
B5x+F2pV8xeKNR7u6azDdU5YVX1TawprmxRC1+WsAYmz6qP+z8ArDITC2FMVy2fw
0IjKOtEXc/VfmtTFch5+AfGYMGMqqvJ6LcXiAhqG5TI+Dr0RtM88k+8XUBCeQ8IG
KuANaL7TiItKZYxK1MMuTJtV9IblAgMBAAGjggE7MIIBNzASBgNVHRMBAf8ECDAG
AQH/AgEAMA4GA1UdDwEB/wQEAwIBhjAdBgNVHQ4EFgQUWaRmBlKge5WSPKOUByeW
dFv5PdAwHwYDVR0jBBgwFoAUhBjMhTTsvAyUlC4IWZzHshBOCggwewYIKwYBBQUH
AQEEbzBtMC8GCCsGAQUFBzABhiNodHRwOi8vb2NzcC5yb290Y2ExLmFtYXpvbnRy
dXN0LmNvbTA6BggrBgEFBQcwAoYuaHR0cDovL2NydC5yb290Y2ExLmFtYXpvbnRy
dXN0LmNvbS9yb290Y2ExLmNlcjA/BgNVHR8EODA2MDSgMqAwhi5odHRwOi8vY3Js
LnJvb3RjYTEuYW1hem9udHJ1c3QuY29tL3Jvb3RjYTEuY3JsMBMGA1UdIAQMMAow
CAYGZ4EMAQIBMA0GCSqGSIb3DQEBCwUAA4IBAQCFkr41u3nPo4FCHOTjY3NTOVI1
59Gt/a6ZiqyJEi+752+a1U5y6iAwYfmXss2lJwJFqMp2PphKg5625kXg8kP2CN5t
6G7bMQcT8C8xDZNtYTd7WPD8UZiRKAJPBXa30/AbwuZe0GaFEQ8ugcYQgSn+IGBI
8/LwhBNTZTUVEWuCUUBVV18YtbAiPq3yXqMB48Oz+ctBWuZSkbvkNodPLamkB2g1
upRyzQ7qDn1X8nn8N8V7YJ6y68AtkHcNSRAnpTitxBKjtKPISLMVCx7i4hncxHZS
yLyKQXhw2W2Xs0qLeC1etA+jTGDK4UfLeC0SF7FSi8o5LL21L8IzApar2pR/
-----END CERTIFICATE-----
 2 s:/C=US/O=Amazon/CN=Amazon Root CA 1
   i:/C=US/ST=Arizona/L=Scottsdale/O=Starfield Technologies, Inc./CN=Starfield Services Root Certificate Authority - G2
-----BEGIN CERTIFICATE-----
MIIEkjCCA3qgAwIBAgITBn+USionzfP6wq4rAfkI7rnExjANBgkqhkiG9w0BAQsF
ADCBmDELMAkGA1UEBhMCVVMxEDAOBgNVBAgTB0FyaXpvbmExEzARBgNVBAcTClNj
b3R0c2RhbGUxJTAjBgNVBAoTHFN0YXJmaWVsZCBUZWNobm9sb2dpZXMsIEluYy4x
OzA5BgNVBAMTMlN0YXJmaWVsZCBTZXJ2aWNlcyBSb290IENlcnRpZmljYXRlIEF1
dGhvcml0eSAtIEcyMB4XDTE1MDUyNTEyMDAwMFoXDTM3MTIzMTAxMDAwMFowOTEL
MAkGA1UEBhMCVVMxDzANBgNVBAoTBkFtYXpvbjEZMBcGA1UEAxMQQW1hem9uIFJv
b3QgQ0EgMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALJ4gHHKeNXj
ca9HgFB0fW7Y14h29Jlo91ghYPl0hAEvrAIthtOgQ3pOsqTQNroBvo3bSMgHFzZM
9O6II8c+6zf1tRn4SWiw3te5djgdYZ6k/oI2peVKVuRF4fn9tBb6dNqcmzU5L/qw
IFAGbHrQgLKm+a/sRxmPUDgH3KKHOVj4utWp+UhnMJbulHheb4mjUcAwhmahRWa6
VOujw5H5SNz/0egwLX0tdHA114gk957EWW67c4cX8jJGKLhD+rcdqsq08p8kDi1L
93FcXmn/6pUCyziKrlA4b9v7LWIbxcceVOF34GfID5yHI9Y/QCB/IIDEgEw+OyQm
jgSubJrIqg0CAwEAAaOCATEwggEtMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/
BAQDAgGGMB0GA1UdDgQWBBSEGMyFNOy8DJSULghZnMeyEE4KCDAfBgNVHSMEGDAW
gBScXwDfqgHXMCs4iKK4bUqc8hGRgzB4BggrBgEFBQcBAQRsMGowLgYIKwYBBQUH
MAGGImh0dHA6Ly9vY3NwLnJvb3RnMi5hbWF6b250cnVzdC5jb20wOAYIKwYBBQUH
MAKGLGh0dHA6Ly9jcnQucm9vdGcyLmFtYXpvbnRydXN0LmNvbS9yb290ZzIuY2Vy
MD0GA1UdHwQ2MDQwMqAwoC6GLGh0dHA6Ly9jcmwucm9vdGcyLmFtYXpvbnRydXN0
LmNvbS9yb290ZzIuY3JsMBEGA1UdIAQKMAgwBgYEVR0gADANBgkqhkiG9w0BAQsF
AAOCAQEAYjdCXLwQtT6LLOkMm2xF4gcAevnFWAu5CIw+7bMlPLVvUOTNNWqnkzSW
MiGpSESrnO09tKpzbeR/FoCJbM8oAxiDR3mjEH4wW6w7sGDgd9QIpuEdfF7Au/ma
eyKdpwAJfqxGF4PcnCZXmTA5YpaP7dreqsXMGz7KQ2hsVxa81Q4gLv7/wmpdLqBK
bRRYh5TmOTFffHPLkIhqhBGWJ6bt2YFGpn6jcgAKUj6DiAdjd4lpFw85hdKrCEVN
0FE6/V1dN2RMfjCyVSRCnTawXZwXgWHxyvkQAiSr6w10kY17RSlQOYiypok1JR4U
akcjMS9cmvqtmg5iUaQqqcT5NJ0hGA==
-----END CERTIFICATE-----
 3 s:/C=US/ST=Arizona/L=Scottsdale/O=Starfield Technologies, Inc./CN=Starfield Services Root Certificate Authority - G2
   i:/C=US/O=Starfield Technologies, Inc./OU=Starfield Class 2 Certification Authority
-----BEGIN CERTIFICATE-----
MIIEdTCCA12gAwIBAgIJAKcOSkw0grd/MA0GCSqGSIb3DQEBCwUAMGgxCzAJBgNV
BAYTAlVTMSUwIwYDVQQKExxTdGFyZmllbGQgVGVjaG5vbG9naWVzLCBJbmMuMTIw
MAYDVQQLEylTdGFyZmllbGQgQ2xhc3MgMiBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0
eTAeFw0wOTA5MDIwMDAwMDBaFw0zNDA2MjgxNzM5MTZaMIGYMQswCQYDVQQGEwJV
UzEQMA4GA1UECBMHQXJpem9uYTETMBEGA1UEBxMKU2NvdHRzZGFsZTElMCMGA1UE
ChMcU3RhcmZpZWxkIFRlY2hub2xvZ2llcywgSW5jLjE7MDkGA1UEAxMyU3RhcmZp
ZWxkIFNlcnZpY2VzIFJvb3QgQ2VydGlmaWNhdGUgQXV0aG9yaXR5IC0gRzIwggEi
MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDVDDrEKvlO4vW+GZdfjohTsR8/
y8+fIBNtKTrID30892t2OGPZNmCom15cAICyL1l/9of5JUOG52kbUpqQ4XHj2C0N
Tm/2yEnZtvMaVq4rtnQU68/7JuMauh2WLmo7WJSJR1b/JaCTcFOD2oR0FMNnngRo
Ot+OQFodSk7PQ5E751bWAHDLUu57fa4657wx+UX2wmDPE1kCK4DMNEffud6QZW0C
zyyRpqbn3oUYSXxmTqM6bam17jQuug0DuDPfR+uxa40l2ZvOgdFFRjKWcIfeAg5J
Q4W2bHO7ZOphQazJ1FTfhy/HIrImzJ9ZVGif/L4qL8RVHHVAYBeFAlU5i38FAgMB
AAGjgfAwge0wDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAYYwHQYDVR0O
BBYEFJxfAN+qAdcwKziIorhtSpzyEZGDMB8GA1UdIwQYMBaAFL9ft9HO3R+G9FtV
rNzXEMIOqYjnME8GCCsGAQUFBwEBBEMwQTAcBggrBgEFBQcwAYYQaHR0cDovL28u
c3MyLnVzLzAhBggrBgEFBQcwAoYVaHR0cDovL3guc3MyLnVzL3guY2VyMCYGA1Ud
HwQfMB0wG6AZoBeGFWh0dHA6Ly9zLnNzMi51cy9yLmNybDARBgNVHSAECjAIMAYG
BFUdIAAwDQYJKoZIhvcNAQELBQADggEBACMd44pXyn3pF3lM8R5V/cxTbj5HD9/G
VfKyBDbtgB9TxF00KGu+x1X8Z+rLP3+QsjPNG1gQggL4+C/1E2DUBc7xgQjB3ad1
l08YuW3e95ORCLp+QCztweq7dp4zBncdDQh/U90bZKuCJ/Fp1U1ervShw3WnWEQt
8jxwmKy6abaVd38PMV4s/KCHOkdp8Hlf9BRUpJVeEXgSYCfOn8J3/yNTd126/+pZ
59vPr5KW7ySaNRB6nJHGDn2Z9j8Z3/VyVOEVqQdZe4O/Ui5GjLIAZHYcSNPYeehu
VsyuLAOQ1xk4meTKCRlb/weWsKh/NEnfVqn3sF/tM+2MR7cwA130A4w=
-----END CERTIFICATE-----
---
Server certificate
subject=/CN=chef.io
issuer=/C=US/O=Amazon/OU=Server CA 1B/CN=Amazon
---
No client certificate CA names sent
Server Temp Key: ECDH, P-256, 256 bits
---
SSL handshake has read 5502 bytes and written 322 bytes
---
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES128-GCM-SHA256
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : ECDHE-RSA-AES128-GCM-SHA256
    Session-ID: 40466F142AF603FEB305F695FF1A08D003DE3F1650A742E924330C6831A315B9
    Session-ID-ctx:
    Master-Key: 8559307D0E850816F0FAC791E2FACB2AB55926433C3F4CA89932BF64E43D9543021EA8D548E460AED1B435DBF9929F8E
    Start Time: 1668720317
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)
---

Subject Alternative Names

If we look at the chef_io.crt contents, we find that *.chef.io and *.opscode.com are each protected by this cert. This is why we get this cert when speaking to api.chef.io or api.opscode.com

openssl x509 -text -in  /Users/horn/Downloads/ocs/sean-horn-opscode/.chef/trusted_certs/chef_io.crt  | grep -A 1 Alternative
            X509v3 Subject Alternative Name:
                DNS:chef.io, DNS:api.berkshelf.com, DNS:*.chef.io, DNS:getchef.com, DNS:opscode.com, DNS:*.opscode.com, DNS:*.getchef.com

Error Message

Defect Number

Enhancement Number

Cause

Resolution

If I wanted to configure this chain in Automate, I would take the following structure and be sure the host key for Automate is at the top of the list, then add the rest of the certs in the chain until I get to the intermediate or root CA

[global.v1.frontend_tls]]
cert = """-----BEGIN CERTIFICATE-----
<your host certificate>
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
<another cert in the chain>
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
<your intermediate or private CA root certificate>
-----END CERTIFICATE-----
"""

Workaround

Notes

Keyword Phrase

CA, PKI, chain, cert, key

Last Modified Date

2/20/2026 5:02 PM

Amazon AWS Private CA Certificate Chains In Chef Automate or Chef Server

Files(0)

Was this article helpful?

Was this article helpful?

Amazon AWS Private CA Certificate Chains In Chef Automate or Chef Server

Information

Related Articles