Adoptable Cookbooks List

List of Adoptable Cookbooks

Supermarket Belongs to the Community


Select Badges

Select Supported Platforms


ssl-key-vault (10) Versions 0.1.0

SSL key & certificate storage in chef-vault

cookbook 'ssl-key-vault', '= 0.1.0'
cookbook 'ssl-key-vault', '= 0.1.0', :supermarket
knife supermarket install ssl-key-vault
knife supermarket download ssl-key-vault
Quality -%

ssl-key-vault cookbook

This cookbook manages OpenSSL key pairs, using chef-vault to share and store private keys.

This cookbook's home is at



  1. Generate a self-signed key or a secret key and certificate.
  2. Store the private key in chef-vault. The name should be set to

    $ knife encrypt cert \ --search 'QUERY' --admins '' \ --name \ --cert /path/to/ $ knife upload data_bags/certs

Either add Chef server's admin API users to the --admins, or make the key otherwise accessible to yourself in future (e.g. with knife-briefcase).

  1. Add the certificate to node's ssl_certificates attribute (key is key's name, and value is full certificate):
example_com_cert = <<EOF

default_attributes :ssl_certificates => {
  '' => example_com_cert

If you don't want to clutter your role definition, you can read the certificate from file in the chef repo:

default_attributes :ssl_certificates => {
  '' =>'../config/certificates/').read
  1. Add recipe[ssl-key-vault] to node's run list.

The key will be stored in /etc/ssl/private/, and certificate in /etc/ssl/certs/

TODOs & questions

Maybe we should store certificate somewhere else than in attributes? knife-vault supports only one value, and certificate is public, so it shouldn't be encrypted. Creating a separate data bag seems to create a lot of clutter, and is not easy to describe in Usage section, as it needs to be encoded in JSON. Adding it to cookbook's files/ is also kind of messy.

Maybe the answer would be to script adding a new key. A knife plugin or at least a Thor task definition may be helpful here.

I don't have much of idea currently how to add tests, with chef-vault, encrypted data bags, and such.


Author:: Maciej Pasternacki

Dependent cookbooks

This cookbook has no specified dependencies.

Contingent cookbooks

There are no cookbooks that are contingent upon this one.

No quality metric results found