How to fix the issue with chef-server-ctl reconfigure ssl error

This article provides a detailed explanation and step-by-step instructions for resolving SSL certificate-related errors that may arise during the chef-server-ctl reconfigure process. Specifically, it addresses scenarios where the reconfiguration fails due to issues with the OpenSearch certificate validation. Keywords: Mixlib::ShellOut::ShellCommandFailed, PKIX path validation, CertPathValidatorException, reconfigure, chef-server-ctl reconfigure

Feb 13, 2026
Knowledge

Title

URL Name

How-to-fix-the-issue-with-chef-server-ctl-reconfigure-ssl-error

Article Number

000280194

Environment

chef-server

Question/Problem Description

When the chef-server-ctl reconfigure is attempted before or after the upgrade, there will be an SSL error when the Opensearch tries to execute the resource to add the internal user. During that time, we see the following error:

ERROR org.opensearch.security.ssl.transport.SecuritySSLNettyTransport - Exception during establishing an SSL connection: javax.net.ssl.SSLHandshakeException: PKIX path validation failed:

This article will provide you with the steps on how to fix this issue and reconfigure the system successfully.

Steps to Reproduce

* On versions up to and including 15.x and beyond when attempting an upgrade * During the upgrade process, we need to reconfigure the system * This will fail with the below error when your admin cert for OS is invalid or expired. Or On a running system, it will happen when the OS admin's certificates have expired. Generally, it is valid for 2 years from the day of deployment.

Clarifying Information

The most common reason for this error is that one of the validation chain certificates has expired. This guide provides a systematic approach to troubleshooting and resolving these failures. We'll walk you through the process of troubleshooting and fixing PKIX path validation issues.

Error Message

* execute[add internal user to opensearch security plugin] action run ================================================================================ Error executing action `run` on resource 'execute[add internal user to opensearch security plugin]' ================================================================================ Mixlib::ShellOut::ShellCommandFailed ------------------------------------ Expected process to exit with [0], but received '255' ---- Begin output of export JAVA_HOME="/opt/opscode/embedded/open-jre/"; ./securityadmin.sh -f ../securityconfig/internal_users.yml -icl -nhnv -cert /opt/opscode/embedded/opensearch/config/admin.pem -cacert /opt/opscode/embedded/opensearch/config/root-ca.pem -key /opt/opscode/embedded/opensearch/config/admin-key.pem ---- STDOUT: Security Admin v7 Will connect to localhost:9300 ... done 09:51:04.797 [opensearch[_client_][transport_worker][T#1]] ERROR org.opensearch.security.ssl.transport.SecuritySSLNettyTransport - Exception during establishing a SSL connection: javax.net.ssl.SSLHandshakeException: PKIX path validation failed: java.security.cert.CertPathValidatorException: validity check failed javax.net.ssl.SSLHandshakeException: PKIX path validation failed: java.security.cert.CertPathValidatorException: validity check failed

Defect Number

Enhancement Number

Cause

Resolution

We'll walk you through the process of troubleshooting and fixing PKIX path validation issues.

1/ Navigate to the directory where the certs are located.

cd /var/opt/opscode/opensearch/config/

2/ Check the expiration date:

openssl x509 -enddate -noout -in admin.pem

3/ Rotate the certs:

cd /var/opt/opscode/opensearch/config/
./ssl_script.sh

4/ Stop the Chef server:

chef-server-ctl stop

5/ Reconfigure:

chef-server-ctl reconfigure

# Start Chef-server:

chef-server-ctl start

Note: Sometimes the first run of chef-server-ctl reconfigure fails after rotating the certificates and the second run succeeds. So, please retry if the first run fails.

If this did not resolve the problem, please reach out to Chef Support for further assistance.

Workaround

Notes

Keyword Phrase

Mixlib::ShellOut::ShellCommandFailed, PKIX path validation, CertPathValidatorException, reconfigure, chef-server-ctl reconfigure

Last Modified Date

2/13/2026 3:42 PM

How to fix the issue with chef-server-ctl reconfigure ssl error

Files(0)

Was this article helpful?

Was this article helpful?

How to fix the issue with chef-server-ctl reconfigure ssl error

Information

Related Articles