cookbook 'tls', '= 3.2.1'
tls (16) Versions 3.2.1 Follow0
Deploy TLS certificates
cookbook 'tls', '= 3.2.1', :supermarket
knife supermarket install tls
knife supermarket download tls
tls-cookbook
Chef cookbook to deploy SSL/TLS certificates (including root ones) on a system. Data is stored in the encrypted data bag which name is specified in the attribute node['tls']['data_bag_name']
(by default tls
). Data bag item name matches node.chef_environment
value.
Certificate files will be placed under the directory specified in attribute node['tls']['base_dir']
(by default /etc/chef-tls
).
Root certificate files will be placed under system directories.
Encrypted data bag format
{ "id": "development", "ca_certificates": { // Trusted Root CA // "name": "----- certificate data -----" "Custom_CA": "-----BEGIN CERTIFICATE-----\nMIIF0jCC........UwhJJgNX\n-----END CERTIFICATE-----", // other entries }, "certificates": [ { "name": "domain.tld-rsa", // Certificate name (optional) "domains": [ // Domain list "domain.tld", "www.domain.tld" ], "chain": [ // Certificate chain (from leaf to root, PEM encoded, new lines should be escaped) "-----BEGIN CERTIFICATE-----\nMIIFNjCC........4PcGNXXA\n-----END CERTIFICATE-----", "-----BEGIN CERTIFICATE-----\nMIIEkjCC........NFu0Qg==\n-----END CERTIFICATE-----" ], "private_key": "-----BEGIN RSA PRIVATE KEY-----\nMIIEpAIB........8tt8JA==\n-----END RSA PRIVATE KEY-----" // Certificate private key (PEM encoded, new lines should be escaped) }, { // other entries } ] }
Resources
tls_certificate
Certificate deployment is made by using tls_certificate
resource. For example,
tls_certificate 'www.domain.tld' do action :deploy end
Different software (e.g. Nginx, Postfix) will require paths to deployed certificates and private keys. To obtain these paths, ::ChefCookbook::TLS
helper should be used. Below is the example:
tls_item = ::ChefCookbook::TLS.new(node).certificate_entry('www.domain.tld') tls_item.certificate_path # Get path to the certificate tls_item.certificate_private_key_path # Get path to the certificate's private key
If there are several certificates for the same set of domains (e.g. RSA and ECDSA ones), both tls_certificate
resource and certificate_entry
helper method will operate with the first item found in the data bag. To pick out the exact certificate, you should use either tls_rsa_certificate
resource / rsa_certificate_entry
helper method or tls_ec_certificate
resource / ec_certificate_entry
helper method.
tls_rsa_certificate
tls_rsa_certificate 'www.domain.tld' do action :deploy end
tls_item = ::ChefCookbook::TLS.new(node).rsa_certificate_entry('www.domain.tld')
tls_ec_certificate
tls_ec_certificate 'www.domain.tld' do action :deploy end
tls_item = ::ChefCookbook::TLS.new(node).ec_certificate_entry('www.domain.tld')
tls_ca_certificate
Installing/uninstalling CA certificates only works on Ubuntu systems.
To obtain path to CA certificate bundle, ::ChefCookbook::TLS
helper should be used. Below is the example:
tls_helper = ::ChefCookbook::TLS.new(node) tls_helper.ca_bundle_path # Get CA certificate bundle path
Installing
tls_ca_certificate 'Custom_CA' do action :install end
Uninstalling
tls_ca_certificate 'Custom_CA' do action :uninstall end
License
MIT @ Alexander Pyatkin
Dependent cookbooks
This cookbook has no specified dependencies.
Contingent cookbooks
Collaborator Number Metric
3.2.1 failed this metric
Failure: Cookbook has 0 collaborators. A cookbook must have at least 2 collaborators to pass this metric.
Contributing File Metric
3.2.1 failed this metric
Failure: To pass this metric, your cookbook metadata must include a source url, the source url must be in the form of https://github.com/user/repo, and your repo must contain a CONTRIBUTING.md file
Foodcritic Metric
3.2.1 failed this metric
FC066: Ensure chef_version is set in metadata: tls/metadata.rb:1
FC108: Resource should not define a property named 'name': tls/resources/ca_certificate.rb:3
Run with Foodcritic Version 14.3.0 with tags metadata,correctness ~FC031 ~FC045 and failure tags any
No Binaries Metric
3.2.1 passed this metric
Testing File Metric
3.2.1 failed this metric
Failure: To pass this metric, your cookbook metadata must include a source url, the source url must be in the form of https://github.com/user/repo, and your repo must contain a TESTING.md file
Version Tag Metric
3.2.1 passed this metric
3.2.1 failed this metric
3.2.1 failed this metric
Failure: To pass this metric, your cookbook metadata must include a source url, the source url must be in the form of https://github.com/user/repo, and your repo must contain a CONTRIBUTING.md file
Foodcritic Metric
3.2.1 failed this metric
FC066: Ensure chef_version is set in metadata: tls/metadata.rb:1
FC108: Resource should not define a property named 'name': tls/resources/ca_certificate.rb:3
Run with Foodcritic Version 14.3.0 with tags metadata,correctness ~FC031 ~FC045 and failure tags any
No Binaries Metric
3.2.1 passed this metric
Testing File Metric
3.2.1 failed this metric
Failure: To pass this metric, your cookbook metadata must include a source url, the source url must be in the form of https://github.com/user/repo, and your repo must contain a TESTING.md file
Version Tag Metric
3.2.1 passed this metric
3.2.1 failed this metric
FC108: Resource should not define a property named 'name': tls/resources/ca_certificate.rb:3
Run with Foodcritic Version 14.3.0 with tags metadata,correctness ~FC031 ~FC045 and failure tags any
3.2.1 passed this metric
Testing File Metric
3.2.1 failed this metric
Failure: To pass this metric, your cookbook metadata must include a source url, the source url must be in the form of https://github.com/user/repo, and your repo must contain a TESTING.md file
Version Tag Metric
3.2.1 passed this metric
3.2.1 failed this metric
3.2.1 passed this metric