You have been alerted that your Chef Automate certificate has expired. You may have found out through troubleshooting an outage or maybe you found it within an error message. Regardless, we will guide you on how to easily update Automate with the new certificate, and this will help with getting Automate back up and running quickly. 

See our Resolution section for the steps on how to achieve this.

This fix applies to those who have an active contract with Chef for Automate systems.

For a Single Chef Automate with Embedded Chef Server

Once you have your new custom certificate ready(usually, this will have been generated by a networking, security, or other specific certificate handling team in your organization), you can proceed to update your new certificate by patching it into Automate. Follow these steps to apply the patch:

Step 1:

Create a .toml file of any name with the following contents (ensuring to use three-double-quotes) :

[[global.v1.frontend_tls]]

The TLS certificate for the load balancer frontend.

cert = """-----BEGIN CERTIFICATE-----

<server certificate content>
----END CERTIFICATE-----
----BEGIN CERTIFICATE-----
<intermediate certificate content>
----END CERTIFICATE-----
----BEGIN CERTIFICATE-----
<root certificate content>
----END CERTIFICATE-----
"""

Step 2: 

Patch the config with the command:

chef-automate config patch <config_file name>

This change will require some downtime. Please plan for that and comment the chef-server.rb lines as outlined below in order to disconnect the clients from the data collector and allow them to run without errors which would normally be caused by Chef Automate being down.

Presuming you have a standalone Chef Infra Server that's reporting to the data collector, you can comment out the automate-specific parts of your chef-server.rb file and run chef-server-ctl reconfigure to put the changes into effect. That should stop the chef-clients from getting 500 errors and allow your production deployments to continue (minus the data collection). Try that and let us know if you're still seeing 500 errors from client runs.

Here are examples of the 3 chef-server.rb entries you'd want to comment out:

data_collector['root_url'] = 'https://automate.example.com/data-collector/v0/'';

# Add for Chef Infra Client run forwarding

data_collector['proxy'] = true

# Add for compliance scanning

profiles['root_url'] = 'https://automate.example.com'';

Save and close the file

Step 3: Perform your reconfigure to apply these settings.

chef-server-ctl reconfigure

After the Automate system has reconfigured itself following the new certificate being patched in, you can check its status with the following command:

chef-automate status

If all looks good there, undo the commenting you did in chef-server.rb and reconfigure once more

chef-server-ctl reconfigure

The Chef Server should begin once again sending data-collector calls to the configured Automate system.

For Automate HA

For Automate HA, a single TLS cert guards and verifies access to the API. This cert is also known as the Automate external load balancer cert, but is completely internal to Automate's frontends.

To change the external Automate cluster cert follow these steps:

1. On the bastion, create a patch toml file with a name like patch.toml
2. Enter the complete new cert like this, with the key if needed. For further detail https://docs.chef.io/automate/configuration/#load-balancer-certificate-and-private-key

   1. [[global.v1.frontend_tls]]
      # The TLS certificate for the load balancer frontend.
      cert = """-----BEGIN CERTIFICATE-----
      <your certificate>
      -----END CERTIFICATE-----
      """
      
      # The TLS RSA key for the load balancer frontend.
      key = """-----BEGIN RSA PRIVATE KEY-----
      <your private key>
      -----END RSA PRIVATE KEY-----
      """

3. Run the patch command following like: chef-automate config patch patch.toml --frontend https://docs.chef.io/automate/ha_config/#patch-configuration-for-frontend-cluster