Adoptable Cookbooks List

Looking for a cookbook to adopt? You can now see a list of cookbooks available for adoption!
List of Adoptable Cookbooks

Supermarket Belongs to the Community

Supermarket belongs to the community. While Chef has the responsibility to keep it running and be stewards of its functionality, what it does and how it works is driven by the community. The chef/supermarket repository will continue to be where development of the Supermarket application takes place. Come be part of shaping the direction of Supermarket by opening issues and pull requests or by joining us on the Chef Mailing List.

Select Badges

Select Supported Platforms

Select Status

The openssl cookbook has been deprecated

Author provided reason for deprecation:

The openssl cookbook has been deprecated and is no longer being maintained by its authors. Use of the openssl cookbook is no longer recommended.


openssl (32) Versions 4.1.1

Resources and libraries for interacting with certificates, keys, passwords, and dhparam files.

cookbook 'openssl', '= 4.1.1', :supermarket
cookbook 'openssl', '= 4.1.1'
knife supermarket install openssl
knife supermarket download openssl
Quality 0%

OpenSSL Cookbook

This cookbook provides tools for working with the Ruby OpenSSL library. It includes:
- A library method to generate secure random passwords in recipes, using the Ruby OpenSSL library.
- An LWRP for generating x509 certificates.
- An attribute-driven recipe for upgrading OpenSSL packages.


The random_password mixin works on any platform with the Ruby SecureRandom module. This module are already included with Chef.

The openssl_x509 lwrp works on any platform with the OpenSSL Ruby bindings installed. These bindings are already included with Chef.

The upgrade recipe has been tested on the following platforms:

  • Ubuntu 12.04, 14.04
  • Debian 7.4
  • CentOS 6.5

The recipe may work on other platforms or different versions of the above platforms, but this has not been tested.


This cookbook depends on the Chef Sugar cookbook. Chef Sugar is used to make the default attribute settings easier to reason about. (See Attributes)


  • node['openssl']['packages'] - An array of packages required to use openssl. The default attributes attempt to be smart about which packages are the default, but this may need to be changed by users of the openssl::upgrade recipe.
  • node['openssl']['restart_services'] - An array of service resources that depend on the packages listed in the node['openssl']['packages'] attribute. This array is empty by default, as Chef has no reasonable way to detect which applications or services are compiled against these packages. Note Each service listed in this array should represent a "service" resource specified in the recipes of the node's run list.



An empty placeholder recipe. Takes no action.


The upgrade recipe iterates over the list of packages in the node['openssl']['packages'] attribute, and manages them with the :upgrade action. Each package will send a :restart notification to service resources named in the node['openssl']['restart_services'] attribute.

Example Usage

In this example, assume the node is running the stats_collector daemon, which depends on the openssl library. Imagine that a new openssl vulnerability has been disclosed, and the operating system vendor has released an update to openssl to address this vulnerability. In order to protect the node, an administrator crafts this recipe:

node.default['openssl']['restart_services'] = ['stats_collector']

# other recipe code here...
service 'stats_collector' do
  action [:enable, :start]

include_recipe 'openssl::upgrade'

When executed, this recipe will ensure that openssl is upgraded to the latest version, and that the stats_collector service is restarted to pick up the latest security fixes released in the openssl package.

Libraries & LWRPs

There are two mixins packaged with this cookbook.

random_password (OpenSSLCookbook::RandomPassword)

The RandomPassword mixin can be used to generate secure random passwords in Chef cookbooks, usually for assignment to a variable or an attribute. random_password uses Ruby's SecureRandom library and is customizable.

Example Usage

Chef::Recipe.send(:include, OpenSSLCookbook::RandomPassword)
node.set['my_secure_attribute'] = random_password
node.set_unless['my_secure_attribute'] = random_password
node.set['my_secure_attribute'] = random_password(length: 50)
node.set['my_secure_attribute'] = random_password(length: 50, mode: :base64)
node.set['my_secure_attribute'] = random_password(length: 50, mode: :base64, encoding: 'ASCII')

Note that node attributes are widely accessible. Storing unencrypted passwords in node attributes, as in this example, carries risk.

secure_password (Opscode::OpenSSL::Password)

This library should be considered deprecated and will be removed in a future version. Please use OpenSSLCookbook::RandomPassword instead. The documentation is kept here for historical reasons.

Example Usage

::Chef::Recipe.send(:include, Opscode::OpenSSL::Password)
node.set_unless['my_password'] = secure_password

Note that node attributes are widely accessible. Storing unencrypted passwords in node attributes, as in this example, carries risk.


This LWRP generates self-signed, PEM-formatted x509 certificates. If no existing key is specified, the LWRP will automatically generate a passwordless key with the certificate.


Name Type Description
common_name String (Required) Value for the CN certificate field.
org String (Required) Value for the O certificate field.
org_unit String (Required) Value for the OU certificate field.
country String (Required) Value for the C ssl field.
expire Fixnum (Optional) Value representing the number of days from now through which the issued certificate cert will remain valid. The certificate will expire after this period.
key_file String (Optional) The path to a certificate key file on the filesystem. If the key_file attribute is specified, the LWRP will attempt to source a key from this location. If no key file is found, the LWRP will generate a new key file at this location. If the key_file attribute is not specified, the LWRP will generate a key file in the same directory as the generated certificate, with the same name as the generated certificate.
key_pass String (Optional) The passphrase for an existing is the key's passphrase
key_length Fixnum (Optional) The desired Bit Length of the generated key. Default: 2048
owner String (optional) The owner of all files created by the LWRP. Default: "root"
group String (optional) The group of all files created by the LWRP. Default: "root"
mode String or Fixnum (Optional) The permission mode of all files created by the LWRP. Default: "0400"

Example Usage

In this example, an administrator wishes to create a self-signed x509 certificate for use with a web server. In order to create the certificate, the administrator crafts this recipe:

openssl_x509 '/etc/httpd/ssl/mycert.pem' do
  common_name ''
  org 'Foo Bar'
  org_unit 'Lab'
  country 'US'

When executed, this recipe will generate a key certificate at /etc/httpd/ssl/mycert.key. It will then use that key to generate a new certificate file at /etc/httpd/ssl/mycert.pem.

License and Author

Author:: Jesse Nelson (

Author:: Seth Vargo (

Author:: Charles Johnson (

Author:: Joshua Timberman (


Copyright:: 2009-2015, Chef Software, Inc <>

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
See the License for the specific language governing permissions and
limitations under the License.

Dependent cookbooks

chef-sugar >= 0.0.0

Contingent cookbooks

aegir Applicable Versions
apache2_odin_auth Applicable Versions
application_zf Applicable Versions
bacula Applicable Versions
bacula-backup Applicable Versions
bootstrap Applicable Versions
boxbilling Applicable Versions
cakephp Applicable Versions
chef Applicable Versions
chef-bareos Applicable Versions
chef-jellyfish Applicable Versions
chef-server Applicable Versions
confluence Applicable Versions
couchbase Applicable Versions
couchbase-ng Applicable Versions
crowd Applicable Versions
dokku Applicable Versions
drone_app Applicable Versions
drupal Applicable Versions
elefant Applicable Versions
elkstack Applicable Versions
esri-iis Applicable Versions
esri-tomcat Applicable Versions
et_haproxy Applicable Versions
frog Applicable Versions
gallery Applicable Versions
github-users Applicable Versions
gitlab-server Applicable Versions
ice Applicable Versions
jahia Applicable Versions
jenkinsstack Applicable Versions
jetty Applicable Versions
jira Applicable Versions
kagent Applicable Versions
katello Applicable Versions
liquid-feedback Applicable Versions
logserver Applicable Versions
magento Applicable Versions
magentostack Applicable Versions
mailman Applicable Versions
metarepo Applicable Versions
mysql Applicable Versions
mysql-multi Applicable Versions
mysqler Applicable Versions
nginx-hardening Applicable Versions
nodestack Applicable Versions
openbazaar Applicable Versions
openerp Applicable Versions
openldap Applicable Versions
opennebula Applicable Versions
opennms Applicable Versions
opsview Applicable Versions
owncloud Applicable Versions
paramount Applicable Versions
percona Applicable Versions
percona-tools Applicable Versions
phpstack Applicable Versions
postfixadmin Applicable Versions
postgresql Applicable Versions
postgresql91 Applicable Versions
pythonstack Applicable Versions
rainloop Applicable Versions
rancher-ha Applicable Versions
riot_mysql Applicable Versions
roundcube Applicable Versions
rundeck-node Applicable Versions
singularity Applicable Versions
sitecore Applicable Versions
sql_server Applicable Versions
sqlcipher Applicable Versions
stack_commons Applicable Versions
stackstorm Applicable Versions
strongloop Applicable Versions
sugar_crm Applicable Versions
sugarcrm Applicable Versions
sugarcrm_ce Applicable Versions
teampass Applicable Versions
testswarm Applicable Versions
tincvpn Applicable Versions
tomcat Applicable Versions
tomee Applicable Versions
transmission Applicable Versions
twindb-repo Applicable Versions
uptime Applicable Versions
webgoat Applicable Versions
wordpress Applicable Versions
wordpress-windows Applicable Versions
zabbix-pkg Applicable Versions
zarafa Applicable Versions
zenoss Applicable Versions
zf2 Applicable Versions
zncrypt Applicable Versions

openssl Cookbook CHANGELOG

This file is used to list changes made in each version of the openssl cookbook.

v4.1.1 (2015-06-11)

  • fixes

v4.1.0 (2015-06-11)

  • Add new random_password Mixin (Thanks, Seth!)
  • Rewritten
  • Refactor specs
  • Clear Rubocop violations

v4.0.0 (2015-02-19)

  • Reverting to Opscode module namespace

v3.0.2 (2015-12-18)

  • Accidently released 2.0.2 as 3.0.2
  • Re-namespaced Opscode::OpenSSL::Password module as Chef::OpenSSL::Password

v2.0.2 (2014-12-30)

  • Call cert.to_pem before recipe DSL

v2.0.0 (2014-06-11)

  • #1 - COOK-847 - Add LWRP for generating self signed certs
  • #4 - COOK-4715 - add upgrade recipe and complete test harness



  • COOK-3222 - Allow setting length for secure_password


  • Add name attribute to metadata

Foodcritic Metric

4.1.1 failed this metric

FC031: Cookbook without metadata file: /tmp/cook/291032a436d48df4350eb551/openssl/metadata.rb:1
FC045: Consider setting cookbook name in metadata: /tmp/cook/291032a436d48df4350eb551/openssl/metadata.rb:1