chef-run does not warn when Automate cert is untrusted

[ericcalabretta]

Description

If the chef-workstation node does not trust the certificate of Chef Automate, the chef-run command will successfully run but will not send the report to Automate. It will not warn or provide an indicator to user regarding the untrusted cert. Results will not be sent to Automate. No indicator is sent to the command output, the default.log or the stack-trace.log.

Example command output:

Chef-run ssh://vagrant:vagrant@centos package ntp
[✔] Packaging cookbook... done!
[✔] Generating local policyfile... exporting... done!
[✔] Applying package[ntp] from resource to target.
└── [✔] [centos] Successfully converged package[ntp].

example config.toml

[data_collector]
url="https://automate/data-collector/v0/"
token="12345678910"

Something should be sent to the user to inform them the chef-run succeeded but the report was not sent to Automate because the certificate is not trusted. It'd also be helpful if instructions on how to use knife ssl fetch would be provided.

Chef Workstation Version

Chef Workstation: 0.2.29

Platform Version

macOS 10.14.1

[robbkidd]

Thanks for reporting, @ericcalabretta. I'm going to move this issue over to chef-run's repo.

[tyler-ball]

I'm pretty sure we hard coded this behavior for the initial release because we were getting too many chef-client failures from self-signed Automate certs. I agree - we need to re-address this is a better way.

Maybe chef-run looks up the cert for the Automate server, asks the user whether to trust it, saves it locally and then copies it to the trusted cert directory for remote nodes?

[ericcalabretta]

@tyler-ball That'd be good behavior, similar to the experience you get with knife. If the cert is untrusted it'll give you the commands required to trust with the appropriate warnings.

We could also have chef-run look in the standard chef trusted folders too. Depending on the user personas that may not help, but it's what you'd expect as an existing chef user. You'd expect all our tools to use the same settings/certs/env vars when possible.