Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have existing validation and webui private keys that I wish to use on a new chef-server deployment. Part of my bootstrap template copies these keys to /etc/chef/. When chef-solo does its run and starts chef-server how can I prevent it from overwriting /etc/chef/validation.pem and /etc/chef/webui.pem.

Alternatively, is there a process to replace validation.pem and webui.pem with another pair of keys that I have in hand? All I can find is instructions on having the server regenerate them.

share|improve this question
add comment

1 Answer

validation.pem is the private key of a special client in chef server named chef-validator. While webui.pem is the private key of chef client webui.

You can regenerate the private/public keys of any client via knife API or chef server web UI.

Personally I would not suggest "replace" a private key but regenerate it because this is sensitive data and you'd better not keep using a special one for a long time. Instead, please regenerate them in a certain period for security reason.

However, it's doable to hack bookshelf data store under /var/opt/chef-server/bookshelf/data of your chef 11 server host to change the public key stored in an object file. For example, you can extract the object URL when you performing command knife client show chef-validator -VV. I strongly dis-recommend this way because it's hacking.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.