How to Rotate SSL/TLS Certificates in Chef Supermarket? - Progress Community

Loading

Skip to Main Content

How to Rotate SSL/TLS Certificates in Chef Supermarket?

Unlike Chef Automate or Chef Infra Server, Chef Supermarket does not provide a built-in chef-automate or chef-server-ctl command for certificate rotation. Instead, its TLS certificates are managed via the configuration file (supermarket.rb) and the reconfigure process. This article explains how to safely rotate SSL/TLS certificates for Chef Supermarket.

Sep 3, 2025
Knowledge

Title

How to Rotate SSL/TLS Certificates in Chef Supermarket?

URL Name

How-to-Rotate-SSL-TLS-Certificates-in-Chef-Supermarket

Article Number

000289477

Environment

Question/Problem Description

How can we rotate SSL/TLS certificates for Chef Supermarket, given that there is no dedicated command-line flag for certificate rotation?

Steps to Reproduce

NA

Clarifying Information

Error Message

NA

Defect Number

Enhancement Number

Cause

Resolution

Follow these steps to update and apply new certificates:

1. Copy the new certificate and key

Place your new certificate, private key, and (optionally) the chain file into the SSL directory (for example, /etc/supermarket/ssl/):

/etc/supermarket/ssl/supermarket.crt
/etc/supermarket/ssl/supermarket.key
/etc/supermarket/ssl/chain.pem

Set proper ownership and permissions:

chown root:root /etc/supermarket/ssl/*
chmod 600 /etc/supermarket/ssl/supermarket.key

2. Update `supermarket.rb`

Edit the configuration file /etc/supermarket/supermarket.rb and point to the new certificate paths:

supermarket['ssl']['certificate']     = "/etc/supermarket/ssl/supermarket.crt"
supermarket['ssl']['certificate_key'] = "/etc/supermarket/ssl/supermarket.key"
supermarket['ssl']['chain']           = "/etc/supermarket/ssl/chain.pem"   # optional

More options are documented here: Supermarket SSL Configuration.

3. Start the Supermarket services and apply configuration

Start the Supermarket services:

sudo supermarket-ctl start

Run the following command to reconfigure Supermarket and apply the updated certificates:

sudo supermarket-ctl reconfigure

Notes & Best Practices

Always back up existing certificates and configuration files before replacing them.
If Supermarket is fronted by a load balancer or reverse proxy (e.g., Nginx, HAProxy, AWS ALB), certificate rotation may only be required at that layer rather than inside Supermarket.
Test certificate rotation in a lower/non-production environment before applying changes to production.
Additional SSL-related fields in supermarket.rb may need updating depending on your deployment setup.

Workaround

Notes

Keyword Phrase

Last Modified Date

9/3/2025 4:02 PM

Drop Files

Upload FilesOr drop files

Disclaimer

The origins of the information on this site may be internal or external to Progress Software Corporation (“Progress”). Progress Software Corporation makes all reasonable efforts to verify this information. However, the information provided is for your information only. Progress Software Corporation makes no explicit or implied claims to the validity of this information.

Any sample code provided on this site is not supported under any Progress support program or service. The sample code is provided on an "AS IS" basis. Progress makes no warranties, express or implied, and disclaims all implied warranties including, without limitation, the implied warranties of merchantability or of fitness for a particular purpose. The entire risk arising out of the use or performance of the sample code is borne by the user. In no event shall Progress, its employees, or anyone else involved in the creation, production, or delivery of the code be liable for any damages whatsoever (including, without limitation, damages for loss of business profits, business interruption, loss of business information, or other pecuniary loss) arising out of the use of or inability to use the sample code, even if Progress has been advised of the possibility of such damages.

Loading

How to Rotate SSL/TLS Certificates in Chef Supermarket? - Progress Community