在做厨师客户端设置时出现ssl验证错误

Question

我是Chef的新手,并且在Node1上安装了一个厨师服务器11,我已经在Node2上成功设置了工作站,当我获得用户列表时,我获得了所有用户列表

[root@Staging3 .chef]# knife user list
admin
root

但是当我发出刀引导时,我得到了跟随错误.

[root@Staging3 .chef]# knife bootstrap 10.4.6.214 -x root -N slave1 --sudo
Doing old-style registration with the validation key at /opt/chef/chef-repo/.chef/chef-validator.pem...
Delete your validation key in order to use your user credentials instead

Connecting to X.X.X.X
root@X.X.X.X's password: 
X.X.X.X Starting first Chef Client run...
X.X.X.X Starting Chef Client, version 12.1.1
X.X.X.X Creating a new client identity for slave1 using the validator key.
X.X.X.X [2015-03-19T00:42:00+05:30] ERROR: SSL Validation failure connecting to host: staging4.akosha.com - SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed
X.X.X.X 
X.X.X.X ================================================================================
X.X.X.X Chef encountered an error attempting to create the client "slave1"
X.X.X.X ================================================================================
X.X.X.X 
X.X.X.X [2015-03-19T00:42:00+05:30] FATAL: Stacktrace dumped to /var/chef/cache/chef-stacktrace.out
X.X.X.X Chef Client failed. 0 resources updated in 6.045009421 seconds
X.X.X.X [2015-03-19T00:42:00+05:30] ERROR: SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed
X.X.X.X [2015-03-19T00:42:00+05:30] FATAL: Chef::Exceptions::ChildConvergeError: Chef run process exited unsuccessfully (exit code 1)

我已经阅读了所有关于进行客户端设置的博客,但没有遇到任何解决方案,任何帮助都将在此赞赏....

我以为我的厨师工作站可能有问题,但事实并非如此

[root@Staging3 chef-repo]# knife ssl check -s https://staging4.akosha.com
Connecting to host staging4.akosha.com:443
Successfully verified certificates from `staging4.akosha.com'

Answer 1

这里有一些信息你可以看一下:

https://docs.chef.io/chef_client_security.html

使用Chef 12,您需要运行命令:

knife ssl fetch

或者,您可以使用以下设置在knife.rb文件中转换ssl验证:

ssl_verify_mode    :verify_none

Answer 2

您的目标节点不知道您的厨师服务器证书,也无法验证它.

您必须将chef-server证书添加到客户端.

我认为这个bug仍然是关于刀子没有将trusted_certs目录推送到bootstraping节点.

现在的解决方法,引导程序,--node-ssl-verify-mode none因此厨师客户端将不会验证ssl(并且它将写入ssl_verify_mode :verify_none节点的client.rbIIRC)

之后,您将能够使用烹饪书推送厨师服务器证书,并使用chef-clientcookbook 配置ssl参数.