When running test kitchen, the Chef client inside VirtualBox VM isn't accepting my Chef server's self-signed certificate.
$ bundle exec kitchen converge default-windows-2008r2
-----> Starting Kitchen (v1.17.0)
-----> Converging <default-windows-2008r2>...
Preparing files for transfer
Preparing dna.json
Resolving cookbook dependencies with Berkshelf 4.2.0...
Using compat_resource (12.19.0)
Installing cron (4.1.3) from http://berksapi.mycompany.com/ ([chef_server] https://chef.mycompany.com:443/organizations/devops)
Installing logentries-windows (0.2.2) from http://berksapi.mycompany.com/ ([chef_server] https://chef.mycompany.com:443/organizations/devops)
>>>>>> ------Exception-------
>>>>>> Class: Kitchen::ActionFailed
>>>>>> Message: 1 actions failed.
>>>>>> Failed to complete #converge action: [SSL_connect returned=1 errno=0 state=error: certificate verify failed] on default-windows-2008r2
>>>>>> ----------------------
>>>>>> Please see .kitchen/logs/kitchen.log for more details
>>>>>> Also try running `kitchen diagnose --all` for configuration
Installing logrotate (2.2.0) from http://berksapi.mycompany.com/ ([chef_server] https://chef.mycompany.com:443/organizations/devops)
Using mingw (2.0.1)
Installing omnibus_updater (3.0.2) from http://berksapi.mycompany.com/ ([chef_server] https://chef.mycompany.com:443/organizations/devops)
Installing ohai (5.2.0) from http://berksapi.mycompany.com/ ([chef_server] https://chef.mycompany.com:443/organizations/devops)
$ echo $?
20
My workstation's Berks config already has SSL verification disabled:
$ cat ~/.berkshelf/config.json
{
"ssl":{
"verify": false
}
}
I have also tried setting a Chef attribute to disable verification:
# .kitchen.yml
suites:
- name: default
attributes:
chef_client:
config:
ssl_verify_mode: ":verify_none"
If you update to a newer version of Berkshelf (4.2.0 is about 18 months old) we've fixed most things to use the same .chef/trusted_certs/ folder as Chef itself, which will likely fix this issue without needing to disable verification.