Chef cookbook for setting up SSL certs and keys on Debian and Ubuntu systems
Switch branches/tags
Nothing to show
Pull request Compare This branch is 14 commits behind cap10morgan:master.
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Failed to load latest commit information.


A recipe for setting up system-wide SSL certs on Ubuntu / Debian systems.


Ubuntu or Debian Linux system and an encrypted data bag named "ssl".


node['ssl']['certs_dir'] = '/etc/ssl/certs'
node['ssl']['keys_dir']  = '/etc/ssl/keys'
node['ssl']['group']     = 'ssl-cert'


The certs and keys are retrieved from an encrypted data bag named "ssl". Inside the data bag, the cert should be in a key named "cert", the domain name should be in the "id" key, with periods replaced by underscores (i.e. -> foo_com), the cert's key should be in "key", and if you have a chain of certs to validate your domain's cert, put them in an array under "chain" and the recipe will set them up for you.

NOTE: The certs and keys should all be on one line, with their newlines replaced by "\n". They will be stored correctly once placed on the server.

After running the default recipe, your certs will be in /etc/ssl/certs/{}.crt, and the keys will be in /etc/ssl/private/{}.key. Any chain certs will be combined into /etc/ssl/certs/{}.chain.crt and the whole cert chain will be put into /etc/ssl/certs/{}.combined.crt. The separate chain cert is for Apache, and the combined one is for Nginx.