Adoptable Cookbooks List

Looking for a cookbook to adopt? You can now see a list of cookbooks available for adoption!
List of Adoptable Cookbooks

Supermarket Belongs to the Community

Supermarket belongs to the community. While Chef has the responsibility to keep it running and be stewards of its functionality, what it does and how it works is driven by the community. The chef/supermarket repository will continue to be where development of the Supermarket application takes place. Come be part of shaping the direction of Supermarket by opening issues and pull requests or by joining us on the Chef Mailing List.

Select Badges

Select Supported Platforms

Select Status

The openssl cookbook has been deprecated

Author provided reason for deprecation:

The openssl cookbook has been deprecated and is no longer being maintained by its authors. Use of the openssl cookbook is no longer recommended.

RSS

openssl (32) Versions 8.5.5

Resources and libraries for interacting with certificates, keys, passwords, and dhparam files.

Policyfile
Berkshelf
Knife
cookbook 'openssl', '~> 8.5.5', :supermarket
cookbook 'openssl', '~> 8.5.5'
knife supermarket install openssl
knife supermarket download openssl
README
Dependencies
Changelog
Quality 17%

OpenSSL Cookbook

Build Status Cookbook Version

This cookbook provides tools for working with the Ruby OpenSSL library. It includes:

  • A library method to generate secure random passwords in recipes, using the Ruby SecureRandom library.
  • A resource for generating RSA private keys.
  • A resource for generating RSA public keys.
  • A resource for generating EC private keys.
  • A resource for generating EC public keys.
  • A resource for generating x509 certificates.
  • A resource for generating x509 requests.
  • A resource for generating x509 crl.
  • A resource for generating dhparam.pem files.
  • An attribute-driven recipe for upgrading OpenSSL packages.

NOTE: All resources in this cookbook are now built-into Chef 14.4 and later so this cookbook is no longer necessary to use those resources. When Chef 15.4 is released (Aug 2019) the resources will be removed from this cookbook as all users should be running Chef 14.4 or later.

Platforms

  • Debian / Ubuntu derivatives
  • Fedora
  • FreeBSD
  • macOS
  • openSUSE / SUSE Linux Enterprises
  • RHEL/CentOS/Scientific/Amazon/Oracle
  • Solaris

Chef

  • Chef 12.7+

Cookbooks

  • none

Attributes

  • node['openssl']['restart_services'] - An array of service resources that depend on the openssl packages. This array is empty by default, as Chef has no reasonable way to detect which applications or services are compiled against these packages. Note Each service listed in this array should represent a "service" resource specified in the recipes of the node's run list.

Recipes

upgrade

The upgrade recipe iterates over the list of packages in the node['openssl']['packages'] attribute, and manages them with the :upgrade action. Each package will send a :restart notification to service resources named in the node['openssl']['restart_services'] attribute.

Example Usage

In this example, assume the node is running the stats_collector daemon, which depends on the openssl library. Imagine that a new openssl vulnerability has been disclosed, and the operating system vendor has released an update to openssl to address this vulnerability. In order to protect the node, an administrator crafts this recipe:

node.default['openssl']['restart_services'] = ['stats_collector']

# other recipe code here...
service 'stats_collector' do
  action [:enable, :start]
end

include_recipe 'openssl::upgrade'

When executed, this recipe will ensure that openssl is upgraded to the latest version, and that the stats_collector service is restarted to pick up the latest security fixes released in the openssl package.

Libraries

There are two mixins packaged with this cookbook.

random_password (OpenSSLCookbook::RandomPassword)

The RandomPassword mixin can be used to generate secure random passwords in Chef cookbooks, usually for assignment to a variable or an attribute. random_password uses Ruby's SecureRandom library and is customizable.

Example Usage

Chef::Recipe.send(:include, OpenSSLCookbook::RandomPassword)
node.normal['my_secure_attribute'] = random_password
node.normal_unless['my_secure_attribute'] = random_password
node.normal['my_secure_attribute'] = random_password(length: 50)
node.normal['my_secure_attribute'] = random_password(length: 50, mode: :base64)
node.normal['my_secure_attribute'] = random_password(length: 50, mode: :base64, encoding: 'ASCII')

Note that node attributes are widely accessible. Storing unencrypted passwords in node attributes, as in this example, carries risk.

Resources

openssl_x509_certificate

This resource generates signed or self-signed, PEM-formatted x509 certificates. If no existing key is specified, the resource will automatically generate a passwordless key with the certificate. If a CA private key and certificate are provided, the certificate will be signed with them.

Note: This resource was renamed from openssl_x509 to openssl_x509_certificate. The legacy name will continue to function, but cookbook code should be updated for the new resource name.

Properties

Name Type Description
path String (Optional) Optional path to write the file to if you'd like to specify it here instead of in the resource name
common_name String (Optional) Value for the CN certificate field.
org String (Optional) Value for the O certificate field.
org_unit String (Optional) Value for the OU certificate field.
city String (Optional) Value for the L certificate field.
state String (Optional) Value for the ST certificate field.
country String (Optional) Value for the C ssl field.
email String (Optional) Value for the email ssl field.
expire Integer (Optional) Value representing the number of days from now through which the issued certificate cert will remain valid. The certificate will expire after this period. _Default: 365
extensions Hash (Optional) Hash of X509 Extensions entries, in format { 'keyUsage' => { 'values' => %w( keyEncipherment digitalSignature), 'critical' => true } } Default: empty
subject_alt_name Array (Optional) Array of Subject Alternative Name entries, in format DNS:example.com or IP:1.2.3.4 Default: empty
key_file String (Optional) The path to a certificate key file on the filesystem. If the key_file property is specified, the resource will attempt to source a key from this location. If no key file is found, the resource will generate a new key file at this location. If the key_file property is not specified, the resource will generate a key file in the same directory as the generated certificate, with the same name as the generated certificate.
key_pass String (Optional) The passphrase for an existing key's passphrase
key_type String (Optional) The desired type of the generated key (rsa or ec). Default: rsa
key_length Integer (Optional) The desired Bit Length of the generated key (if key_type is equal to 'rsa'). Default: 2048
key_curve String (Optional) The desired curve of the generated key (if key_type is equal to 'ec'). Run openssl ecparam -list_curves to see available options. Default: prime256v1
csr_file String (Optional) The path to a X509 Certificate Request (CSR) on the filesystem. If the csr_file property is specified, the resource will attempt to source a CSR from this location. If no CSR file is found, the resource will generate a Self-Signed Certificate and the certificate fields must be specified (common_name at last).
ca_cert_file String (Optional) The path to the CA X509 Certificate on the filesystem. If the ca_cert_file property is specified, the ca_key_file property must also be specified, the certificate will be signed with them.
ca_key_file String (Optional) The path to the CA private key on the filesystem. If the ca_key_file property is specified, the `ca_cert_file' property must also be specified, the certificate will be signed with them.
ca_key_pass String (Optional) The passphrase for CA private key's passphrase
owner String (optional) The owner of all files created by the resource.
group String (optional) The group of all files created by the resource.
mode String or Integer (Optional) The permission mode of all files created by the resource.

Example Usage

In this example, an administrator wishes to create a self-signed x509 certificate for use with a web server. In order to create the certificate, the administrator crafts this recipe:

openssl_x509 '/etc/httpd/ssl/mycert.pem' do
  common_name 'www.f00bar.com'
  org 'Foo Bar'
  org_unit 'Lab'
  country 'US'
end

When executed, this recipe will generate a key certificate at /etc/httpd/ssl/mycert.key. It will then use that key to generate a new certificate file at /etc/httpd/ssl/mycert.pem.

In this example, an administrator wishes to create a x509 certificate signed with a CA certificate and key. In order to create the certificate, the administrator crafts this recipe:

openssl_x509_certificate '/etc/ssl_test/my_signed_cert.crt' do
  common_name 'www.f00bar.com'
  ca_key_file '/etc/ssl_test/my_ca.key'
  ca_cert_file '/etc/ssl_test/my_ca.crt'
  expire 365
  extensions(
    'keyUsage' => {
      'values' => %w(
        keyEncipherment
        digitalSignature),
      'critical' => true,
    },
    'extendedKeyUsage' => {
      'values' => %w(serverAuth),
      'critical' => false,
    }
  )
  subject_alt_name ['IP:127.0.0.1', 'DNS:localhost.localdomain']
end

When executed, this recipe will generate a key certificate at /etc/ssl_test/my_signed_cert.key. It will then use that key to generate a CSR and signed it with my_ca.key/my_ca.crt. A new certificate file at /etc/ssl_test/my_signed_cert.cert will be created as a result.

openssl_x509_request

This resource generates PEM-formatted x509 certificates requests. If no existing key is specified, the resource will automatically generate a passwordless key with the certificate.

Properties

Name Type Description
path String (Optional) Optional path to write the file to if you'd like to specify it here instead of in the resource name
common_name String (Required) Value for the CN certificate field.
org String (Optional) Value for the O certificate field.
org_unit String (Optional) Value for the OU certificate field.
city String (Optional) Value for the L certificate field.
state String (Optional) Value for the ST certificate field.
country String (Optional) Value for the C ssl field.
email String (Optional) Value for the email ssl field.
key_file String (Optional) The path to a certificate key file on the filesystem. If the key_file property is specified, the resource will attempt to source a key from this location. If no key file is found, the resource will generate a new key file at this location. If the key_file property is not specified, the resource will generate a key file in the same directory as the generated certificate, with the same name as the generated certificate.
key_pass String (Optional) The passphrase for an existing key's passphrase
key_type String (Optional) The desired type of the generated key (rsa or ec). Default: ec
key_length Integer (Optional) The desired Bit Length of the generated key (if key_type is equal to 'rsa'). Default: 2048
key_curve String (Optional) The desired curve of the generated key (if key_type is equal to 'ec'). Run openssl ecparam -list_curves to see available options. _Default: prime256v1
owner String (optional) The owner of all files created by the resource.
group String (optional) The group of all files created by the resource.
mode String or Integer (Optional) The permission mode of all files created by the resource.

Example Usage

In this example, an administrator wishes to create a x509 CRL. In order to create the CRL, the administrator crafts this recipe:

openssl_x509_request '/etc/ssl_test/my_ec_request.csr' do
  common_name 'myecrequest.example.com'
  org 'Test Kitchen Example'
  org_unit 'Kitchens'
  country 'UK'
end

When executed, this recipe will generate a key certificate at /etc/httpd/ssl/my_ec_request.key. It will then use that key to generate a new csr file at /etc/ssl_test/my_ec_request.csr.

openssl_x509_crl

This resource generates PEM-formatted x509 CRL.

Properties

Name Type Description
path String (Optional) Optional path to write the file to if you'd like to specify it here instead of in the resource name
serial_to_revoke String or Integer(Optional) Serial of the X509 Certificate to revoke
revocation_reason String or Integer(Optional) [Reason of the revocation]((https://en.wikipedia.org/wiki/Certificate_revocation_list#Reasons_for_revocation)) Default: 0
expire Integer (Optional) Value representing the number of days from now through which the issued CRL will remain valid. The CRL will expire after this period. Default: 8
renewal_threshold Integer (Optional) Number of days before the expiration. It this threshold is reached, the CRL will be renewed Default: 1
ca_cert_file String (Required) The path to the CA X509 Certificate on the filesystem. If the ca_cert_file property is specified, the ca_key_file property must also be specified, the CRL will be signed with them.
ca_key_file String (Required) The path to the CA private key on the filesystem. If the ca_key_file property is specified, the `ca_cert_file' property must also be specified, the CRL will be signed with them.
ca_key_pass String (Optional) The passphrase for CA private key's passphrase
owner String (optional) The owner of all files created by the resource.
group String (optional) The group of all files created by the resource.
mode String or Integer (Optional) The permission mode of all files created by the resource.

Example Usage

In this example, an administrator wishes to create an empty X509 CRL. In order to create the CRL, the administrator crafts this recipe:

openssl_x509_crl '/etc/ssl_test/my_ca.crl' do
  ca_cert_file '/etc/ssl_test/my_ca.crt'
  ca_key_file '/etc/ssl_test/my_ca.key'
end

When executed, this recipe will generate a new CRL file at /etc/ssl_test/my_ca.crl.

In this example, an administrator wishes to revoke a certificate in an existing X509 CRL.

openssl_x509_crl '/etc/ssl_test/my_ca.crl' do
  ca_cert_file '/etc/ssl_test/my_ca.crt'
  ca_key_file '/etc/ssl_test/my_ca.key'
  serial_to_revoke C7BCB6602A2E4251EF4E2827A228CB52BC0CEA2F
end

openssl_dhparam

This resource generates dhparam.pem files. If a valid dhparam.pem file is found at the specified location, no new file will be created. If a file is found at the specified location but it is not a valid dhparam file, it will be overwritten.

Properties

Name Type Description
path String (Optional) Optional path to write the file to if you'd like to specify it here instead of in the resource name
key_length Integer (Optional) The desired Bit Length of the generated key. Default: 2048
generator Integer (Optional) The desired Diffie-Hellmann generator. Can be 2 or 5.
owner String (optional) The owner of all files created by the resource.
group String (optional) The group of all files created by the resource.
mode String or Integer (Optional) The permission mode of all files created by the resource. Default: "0640"

Example Usage

In this example, an administrator wishes to create a dhparam.pem file for use with a web server. In order to create the .pem file, the administrator crafts this recipe:

openssl_dhparam '/etc/httpd/ssl/dhparam.pem' do
  key_length 2048
  generator 2
end

When executed, this recipe will generate a dhparam file at /etc/httpd/ssl/dhparam.pem.

openssl_rsa_private_key

This resource generates rsa private key files. If a valid rsa key file can be opened at the specified location, no new file will be created. If the RSA key file cannot be opened, either because it does not exist or because the password to the RSA key file does not match the password in the recipe, it will be overwritten.

Note: This resource was renamed from openssl_rsa_key to openssl_rsa_private_key. The legacy name will continue to function, but cookbook code should be updated for the new resource name.

Properties

Name Type Description
path String (Optional) Optional path to write the file to if you'd like to specify it here instead of in the resource name
key_length Integer (Optional) The desired Bit Length of the generated key. Default: 2048
key_cipher String (Optional) The designed cipher to use when generating your key. Run openssl list-cipher-algorithms to see available options. Default: des3
key_pass String (Optional) The desired passphrase for the key.
owner String (optional) The owner of all files created by the resource.
group String (optional) The group of all files created by the resource.
mode String or Integer (Optional) The permission mode of all files created by the resource. Default: "0640"
force true/false (Optional) Force creating the key even if the existing key exists. Default: false

Example Usage

In this example, an administrator wishes to create a new RSA private key file in order to generate other certificates and public keys. In order to create the key file, the administrator crafts this recipe:

openssl_rsa_private_key '/etc/httpd/ssl/server.key' do
  key_length 2048
end

When executed, this recipe will generate a passwordless RSA key file at /etc/httpd/ssl/server.key.

openssl_rsa_public_key

This resource generates rsa public key files given a private key.

Properties

Name Type Description
path String (Optional) Optional path to write the file to if you'd like to specify it here instead of in the resource name
private_key_path String (Required unless private_key_content used) The path to the private key to generate the public key from
private_key_content String (Required unless private_key_path used) The content of the private key including new lines. Used if you don't want to write a private key to disk and use private_key_path.
private_key_pass String (Optional) The passphrase of the provided private key
owner String (optional) The owner of all files created by the resource.
group String (optional) The group of all files created by the resource.
mode String or Integer (Optional) The permission mode of all files created by the resource. Default: "0640"

Note: To use private_key_content the private key string must be properly formatted including new lines. The easiest way to get the right string is to run the following from irb (/opt/chefdk/embedded/bin/irb from ChefDK)

File.read('/foo/bar/private.pem')

Example Usage

openssl_rsa_public_key '/etc/foo/something.pub' do
  priv_key_path '/etc/foo/something.pem'
end

openssl_ec_private_key

This resource generates ec private key files. If a valid ec key file can be opened at the specified location, no new file will be created. If the EC key file cannot be opened, either because it does not exist or because the password to the EC key file does not match the password in the recipe, it will be overwritten.

Properties

Name Type Description
path String (Optional) Optional path to write the file to if you'd like to specify it here instead of in the resource name
key_curve String (Optional) The desired curve of the generated key. Run openssl ecparam -list_curves to see available options. _Default: prime256v1
key_cipher String (Optional) The designed cipher to use when generating your key. Run openssl list-cipher-algorithms to see available options. Default: des3
key_pass String (Optional) The desired passphrase for the key.
owner String (optional) The owner of all files created by the resource.
group String (optional) The group of all files created by the resource.
mode String or Integer (Optional) The permission mode of all files created by the resource. Default: "0640"
force true/false (Optional) Force creating the key even if the existing key exists. Default: false

Example Usage

In this example, an administrator wishes to create a new EC private key file in order to generate other certificates and public keys. In order to create the key file, the administrator crafts this recipe:

openssl_ec_private_key '/etc/httpd/ssl/server.key' do
  key_curve "prime256v1'
end

When executed, this recipe will generate a passwordless EC key file at /etc/httpd/ssl/server.key.

openssl_ec_public_key

This resource generates ec public key files given a private key.

Properties

Name Type Description
path String (Optional) Optional path to write the file to if you'd like to specify it here instead of in the resource name
private_key_path String (Required unless private_key_content used) The path to the private key to generate the public key from
private_key_content String (Required unless private_key_path used) The content of the private key including new lines. Used if you don't want to write a private key to disk and use private_key_path.
private_key_pass String (Optional) The passphrase of the provided private key
owner String (optional) The owner of all files created by the resource. Default: "root"
group String (optional) The group of all files created by the resource. Default: "root or wheel depending on platform"
mode String or Integer (Optional) The permission mode of all files created by the resource. Default: "0640"

Note: To use private_key_content the private key string must be properly formatted including new lines. The easiest way to get the right string is to run the following from irb (/opt/chefdk/embedded/bin/irb from ChefDK)

File.read('/foo/bar/private.pem')

Example Usage

openssl_ec_public_key '/etc/foo/something.pub' do
  priv_key_path '/etc/foo/something.pem'
end

Maintainers

This cookbook is maintained by Chef's Community Cookbook Engineering team. Our goal is to improve cookbook quality and to aid the community in contributing to cookbooks. To learn more about our team, process, and design goals see our team documentation. To learn more about contributing to cookbooks like this see our contributing documentation, or if you have general questions about this cookbook come chat with us in #cookbok-engineering on the Chef Community Slack

License

Copyright: 2009-2018, Chef Software, Inc.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.

Dependent cookbooks

This cookbook has no specified dependencies.

Contingent cookbooks

aegir Applicable Versions
apache2_odin_auth Applicable Versions
application_zf Applicable Versions
bacula Applicable Versions
bacula-backup Applicable Versions
bootstrap Applicable Versions
boxbilling Applicable Versions
cakephp Applicable Versions
chef Applicable Versions
chef-bareos Applicable Versions
chef-jellyfish Applicable Versions
chef-server Applicable Versions
confluence Applicable Versions
couchbase Applicable Versions
couchbase-ng Applicable Versions
crowd Applicable Versions
dokku Applicable Versions
drone_app Applicable Versions
drupal Applicable Versions
elefant Applicable Versions
elkstack Applicable Versions
esri-iis Applicable Versions
esri-tomcat Applicable Versions
et_haproxy Applicable Versions
frog Applicable Versions
gallery Applicable Versions
github-users Applicable Versions
gitlab-server Applicable Versions
ice Applicable Versions
jahia Applicable Versions
jenkinsstack Applicable Versions
jetty Applicable Versions
jira Applicable Versions
kagent Applicable Versions
katello Applicable Versions
liquid-feedback Applicable Versions
logserver Applicable Versions
magento Applicable Versions
magentostack Applicable Versions
mailman Applicable Versions
metarepo Applicable Versions
mysql Applicable Versions
mysql-multi Applicable Versions
mysqler Applicable Versions
nginx-hardening Applicable Versions
nodestack Applicable Versions
openbazaar Applicable Versions
openerp Applicable Versions
openldap Applicable Versions
opennebula Applicable Versions
opennms Applicable Versions
opsview Applicable Versions
owncloud Applicable Versions
paramount Applicable Versions
percona Applicable Versions
percona-tools Applicable Versions
phpstack Applicable Versions
postfixadmin Applicable Versions
postgresql Applicable Versions
postgresql91 Applicable Versions
pythonstack Applicable Versions
rainloop Applicable Versions
rancher-ha Applicable Versions
riot_mysql Applicable Versions
roundcube Applicable Versions
rundeck-node Applicable Versions
singularity Applicable Versions
sitecore Applicable Versions
sql_server Applicable Versions
sqlcipher Applicable Versions
stack_commons Applicable Versions
stackstorm Applicable Versions
strongloop Applicable Versions
sugar_crm Applicable Versions
sugarcrm Applicable Versions
sugarcrm_ce Applicable Versions
teampass Applicable Versions
testswarm Applicable Versions
tincvpn Applicable Versions
tomcat Applicable Versions
tomee Applicable Versions
transmission Applicable Versions
twindb-repo Applicable Versions
uptime Applicable Versions
webgoat Applicable Versions
wordpress Applicable Versions
wordpress-windows Applicable Versions
zabbix-pkg Applicable Versions
zarafa Applicable Versions
zenoss Applicable Versions
zf2 Applicable Versions
zncrypt Applicable Versions

openssl Cookbook CHANGELOG

This file is used to list changes made in each version of the openssl cookbook.

8.5.5 (2018-09-04)

All resources in this cookbook are now built into Chef 14.4+. When Chef 15.4 is released (April 2019) the resources will be removed from this cookbook as all users should be running Chef 14.4 or later at that point.

8.5.4 (2018-08-29)

  • Add missing email documentation for the request property
  • Fix x509_crl to work on non-Linux platforms
  • Attribute -> Property in the readme
  • revokation -> revocation in the readme
  • Update group/owner documentation
  • Avoid deprecation warnings on Chef 14.3+

8.5.3 (2018-08-15)

  • Call ::OpenSSL not OpenSSL to be more defensive in the helpers

8.5.2 (2018-08-14)

  • Back out mode change in ec_private_key

8.5.1 (2018-08-14)

  • Add license headers to the resources
  • Remove default_action setup from the resources since this is done automatically in custom resources now
  • Make sure to use the path name_property when creating the ec public key file
  • Make sure we're using openssl and not Chef's Openssl class
  • Simplify how we handle user/group properties

8.5.0 (2018-08-02)

  • Use the system provided owner/group defaults in resources
  • Added new openssl_x509_crl resource
  • Fix openssl_ec_public_key with documentation & tests
  • Few corrections in the documentation
  • Fix backward compatibility with chef client 12

8.4.0 (2018-07-30)

This release is brought to you by Institut National de l'Audiovisuel, which contributed the following changes:

  • openssl_x509 is renamed to openssl_x509_certificate with backwards compatibility for the old name
  • openssl_x509_certificate can now generate a signed certificate with a provided CA cert & key
  • openssl_x509_certificate now support x509 extensions
  • openssl_x509_certificate now support x509 csr
  • openssl_x509_certificate now generate a random serial for the certificate
  • openssl_x509_certificate expires has now a default value : 365
  • country field is now mandatory in x509_request
  • the private key file is not rewrited in x509_request if it already exist

8.3.0 (2018-07-25)

  • Add resource x509_request

8.2.0 (2018-07-23)

  • Add ec_private_key & ec_public_key resources

8.1.2 (2018-02-09)

  • Fix typo in resources that caused failures on Windows.
  • Properly reference key_cipher in the readme

8.1.1 (2018-01-05)

  • Add YARD comments to all the helpers
  • Move valid ciphers directly into the equal_to check
  • Remove the Chefspec matchers since modern ChefSpec does this automatically
  • Fix failures on Windows nodes

8.1.0 (2017-12-28)

  • Adding x509 support for /ST and /L
  • Allow passing private key content to rsa_public_key resource via property
  • Fix openssl_rsa_public_key converging on every run
  • Fix undefied method "cipher" error in openssl_rsa_private_key resource

8.0.0 (2017-12-11)

  • Added a new openssl_rsa_public_key resource which generates a public key from a private key
  • Rename openssl_rsa_key to openssl_rsa_private_key, while still allowing the old name to function. This resource actually generates private keys, but the previous name didn't make that clear
  • Added owner, group, and mode properties to all of the resources so you could control who owned the files you generated
  • Set the default modes of generated files to 640 instead of 644
  • Set the files to generate using node['root_group'] not 'root' for compatibility on other *nix systems such as FreeBSD and macOS
  • Added a new property to openssl_rsa_private_key for specifying the cipher to use
  • Converted integration tests to InSpec and moved all resources to a single Kitchen suite for quicker testing
  • Added a force property to allow overwriting any existing key that may exist
  • Fixed upgrade recipe failures on Debian 9
  • Added a new path property which allows you to set the path there instead of in the resource's name
  • Improved input validation in some of the helpers
  • Added a deprecation message in Opscode::OpenSSL::Password helper "secure_password" and removed readme documentation
  • Added a warning in the upgrade recipe if we're on an unsupported platform
  • Switched the upgrade recipe to a multipackage upgrade to speed up Chef runs

7.1.0 (2017-05-30)

  • Add supported platforms to the metdata
  • Fix amazon support
  • Remove class_eval usage and require Chef 12.7+

7.0.1 (2017-03-21)

  • Fix compatibility with Chef 12.5.1

7.0.0 (2017-03-06)

  • Converted LWRPs to custom resources, increasing the chef-client dependency to 12.5+. This fixes the bus where each resource notified on every run even if it didn't actually update the files on disk.
  • Added testing for Chef 13
  • Test with Local Delivery instead of Rake

6.1.1 (2017-01-19)

  • Resolve deprecation warnings in chefspec
  • Use proper ::File class and fix 2 validation of dhparam key length
  • Disable .zero? in cookstyle for now

6.1.0 (2017-01-18)

  • [#37] Support for Subject Alternative Names on generated self-signed certificates
  • rubocop
  • Cookstyle fixes

6.0.0 (2016-09-08)

  • Update the minimum chef release to 12.1

5.0.1 (2016-09-01)

  • Update docs from node.normal as node.set has been deprecated
  • Testing updates

5.0.0 (2016-08-27)

  • Remove the need for the chef-sugar cookbook
  • Remove the default['openssl']['packages'] attribute in the upgrades recipe and instead use the correct openssl packages based on platform
  • Remove support for Debian 6 and Ubuntu 10.04 in the upgrade recipe
  • Add support for Fedora and Suse in the upgrade recipe
  • Prevent errors with unset variable in error raising within the random password helper
  • Add cookstyle and resolve all warnings
  • Add testing, contributing, and maintainers documentation
  • Add integration testing in Travis CI with kitchen-dokken
  • Add issues_url, source_url and chef_version metadata
  • Update the requirements section of the README
  • Update the Chefspecs to avoid errors and run using caching for faster runs
  • Add issues and PR templates for Github

v4.4.0 (2015-08-28)

  • NEW: x509 certificates are now signed via SHA-256 instead of SHA-1
  • FIX: gen_dhparam error now correctly fails with TypeError instead of ArgumentError if Generator argument isn't an integer

v4.3.2 (2015-08-01)

  • FIX: Updated changelog

v4.3 (2015-08-01)

  • NEW: Add rsa_key lwrp
  • FIX: dhparam lwrp now correctly honors the generator parameter

v4.2 (2015-06-23)

  • NEW: Add dhparam lwrp
  • FIX: x509 lwrp now updates resource count correctly

v4.1.2 (2015-06-20)

  • Add Serverspec suite
  • Removed update suite from .kitchen.yml
  • Add explicit license to test cookbook recipes
  • Add Whyrun support to x509 LWRP
  • Expand Chefspec tests for x509 LWRP to step_into LWRP
  • Add helper library
  • Update x509 LWRP to verify existing keys, if specified

v4.1.1 (2015-06-11)

  • README.md fixes

v4.1.0 (2015-06-11)

  • Add new random_password Mixin (Thanks, Seth!)
  • Rewritten README.md
  • Refactor specs
  • Clear Rubocop violations

v4.0.0 (2015-02-19)

  • Reverting to Opscode module namespace

v3.0.2 (2015-12-18)

  • Accidently released 2.0.2 as 3.0.2
  • Re-namespaced Opscode::OpenSSL::Password module as Chef::OpenSSL::Password

v2.0.2 (2014-12-30)

  • Call cert.to_pem before recipe DSL

v2.0.0 (2014-06-11)

  • 1 - COOK-847 - Add LWRP for generating self signed certs

  • 4 - COOK-4715 - add upgrade recipe and complete test harness

v1.1.0

Improvement

  • COOK-3222 - Allow setting length for secure_password

v1.0.2

  • Add name attribute to metadata

Collaborator Number Metric
            

8.5.5 failed this metric

Failure: Cookbook has 0 collaborators. A cookbook must have at least 2 collaborators to pass this metric.

Contributing File Metric
            

8.5.5 failed this metric

Failure: To pass this metric, your cookbook metadata must include a source url, the source url must be in the form of https://github.com/user/repo, and your repo must contain a CONTRIBUTING.md file

Cookstyle Metric
            

8.5.5 failed this metric

Chef/Correctness/InvalidPlatformFamilyInCase: Use valid platform family values in case statements. (https://docs.chef.io/workstation/cookstyle/chef_correctness_invalidplatformfamilyincase): openssl/recipes/upgrade.rb: 21
Chef/Correctness/PropertyWithoutType: Resource properties or attributes should always define a type to help users understand the correct allowed values. (https://docs.chef.io/workstation/cookstyle/chef_correctness_propertywithouttype): openssl/resources/dhparam.rb: 24
Chef/Correctness/PropertyWithoutType: Resource properties or attributes should always define a type to help users understand the correct allowed values. (https://docs.chef.io/workstation/cookstyle/chef_correctness_propertywithouttype): openssl/resources/dhparam.rb: 25
Chef/Correctness/PropertyWithoutType: Resource properties or attributes should always define a type to help users understand the correct allowed values. (https://docs.chef.io/workstation/cookstyle/chef_correctness_propertywithouttype): openssl/resources/ec_private_key.rb: 24
Chef/Correctness/PropertyWithoutType: Resource properties or attributes should always define a type to help users understand the correct allowed values. (https://docs.chef.io/workstation/cookstyle/chef_correctness_propertywithouttype): openssl/resources/rsa_private_key.rb: 24
Chef/Correctness/PropertyWithoutType: Resource properties or attributes should always define a type to help users understand the correct allowed values. (https://docs.chef.io/workstation/cookstyle/chef_correctness_propertywithouttype): openssl/resources/x509_certificate.rb: 40
Chef/Correctness/PropertyWithoutType: Resource properties or attributes should always define a type to help users understand the correct allowed values. (https://docs.chef.io/workstation/cookstyle/chef_correctness_propertywithouttype): openssl/resources/x509_certificate.rb: 41
Chef/Correctness/PropertyWithoutType: Resource properties or attributes should always define a type to help users understand the correct allowed values. (https://docs.chef.io/workstation/cookstyle/chef_correctness_propertywithouttype): openssl/resources/x509_certificate.rb: 42
Chef/Correctness/PropertyWithoutType: Resource properties or attributes should always define a type to help users understand the correct allowed values. (https://docs.chef.io/workstation/cookstyle/chef_correctness_propertywithouttype): openssl/resources/x509_request.rb: 35
Chef/Correctness/PropertyWithoutType: Resource properties or attributes should always define a type to help users understand the correct allowed values. (https://docs.chef.io/workstation/cookstyle/chef_correctness_propertywithouttype): openssl/resources/x509_request.rb: 36
Chef/Correctness/PropertyWithoutType: Resource properties or attributes should always define a type to help users understand the correct allowed values. (https://docs.chef.io/workstation/cookstyle/chef_correctness_propertywithouttype): openssl/resources/x509_request.rb: 37
Chef/Deprecations/ResourceUsesOnlyResourceName: Starting with Chef Infra Client 16, using `resource_name` without also using `provides` will result in resource failures. Make sure to use both `resource_name` and `provides` to change the name of the resource. You can also omit `resource_name` entirely if the value set matches the name Chef Infra Client automatically assigns based on COOKBOOKNAME_FILENAME. (https://docs.chef.io/workstation/cookstyle/chef_deprecations_resourceusesonlyresourcename): openssl/resources/dhparam.rb: 19
Chef/Deprecations/ResourceUsesOnlyResourceName: Starting with Chef Infra Client 16, using `resource_name` without also using `provides` will result in resource failures. Make sure to use both `resource_name` and `provides` to change the name of the resource. You can also omit `resource_name` entirely if the value set matches the name Chef Infra Client automatically assigns based on COOKBOOKNAME_FILENAME. (https://docs.chef.io/workstation/cookstyle/chef_deprecations_resourceusesonlyresourcename): openssl/resources/ec_private_key.rb: 19
Chef/Deprecations/ResourceUsesOnlyResourceName: Starting with Chef Infra Client 16, using `resource_name` without also using `provides` will result in resource failures. Make sure to use both `resource_name` and `provides` to change the name of the resource. You can also omit `resource_name` entirely if the value set matches the name Chef Infra Client automatically assigns based on COOKBOOKNAME_FILENAME. (https://docs.chef.io/workstation/cookstyle/chef_deprecations_resourceusesonlyresourcename): openssl/resources/ec_public_key.rb: 19
Chef/Deprecations/ResourceUsesOnlyResourceName: Starting with Chef Infra Client 16, using `resource_name` without also using `provides` will result in resource failures. Make sure to use both `resource_name` and `provides` to change the name of the resource. You can also omit `resource_name` entirely if the value set matches the name Chef Infra Client automatically assigns based on COOKBOOKNAME_FILENAME. (https://docs.chef.io/workstation/cookstyle/chef_deprecations_resourceusesonlyresourcename): openssl/resources/rsa_private_key.rb: 18
Chef/Deprecations/ResourceUsesOnlyResourceName: Starting with Chef Infra Client 16, using `resource_name` without also using `provides` will result in resource failures. Make sure to use both `resource_name` and `provides` to change the name of the resource. You can also omit `resource_name` entirely if the value set matches the name Chef Infra Client automatically assigns based on COOKBOOKNAME_FILENAME. (https://docs.chef.io/workstation/cookstyle/chef_deprecations_resourceusesonlyresourcename): openssl/resources/rsa_public_key.rb: 19
Chef/Deprecations/ResourceUsesOnlyResourceName: Starting with Chef Infra Client 16, using `resource_name` without also using `provides` will result in resource failures. Make sure to use both `resource_name` and `provides` to change the name of the resource. You can also omit `resource_name` entirely if the value set matches the name Chef Infra Client automatically assigns based on COOKBOOKNAME_FILENAME. (https://docs.chef.io/workstation/cookstyle/chef_deprecations_resourceusesonlyresourcename): openssl/resources/x509_certificate.rb: 18
Chef/Deprecations/ResourceUsesOnlyResourceName: Starting with Chef Infra Client 16, using `resource_name` without also using `provides` will result in resource failures. Make sure to use both `resource_name` and `provides` to change the name of the resource. You can also omit `resource_name` entirely if the value set matches the name Chef Infra Client automatically assigns based on COOKBOOKNAME_FILENAME. (https://docs.chef.io/workstation/cookstyle/chef_deprecations_resourceusesonlyresourcename): openssl/resources/x509_crl.rb: 18
Chef/Deprecations/ResourceUsesOnlyResourceName: Starting with Chef Infra Client 16, using `resource_name` without also using `provides` will result in resource failures. Make sure to use both `resource_name` and `provides` to change the name of the resource. You can also omit `resource_name` entirely if the value set matches the name Chef Infra Client automatically assigns based on COOKBOOKNAME_FILENAME. (https://docs.chef.io/workstation/cookstyle/chef_deprecations_resourceusesonlyresourcename): openssl/resources/x509_request.rb: 18
Chef/Deprecations/ResourceWithoutUnifiedTrue: Set `unified_mode true` in Chef Infra Client 15.3+ custom resources to ensure they work correctly in Chef Infra Client 18 (April 2022) when Unified Mode becomes the default. (https://docs.chef.io/workstation/cookstyle/chef_deprecations_resourcewithoutunifiedtrue): openssl/resources/dhparam.rb: 1
Chef/Deprecations/ResourceWithoutUnifiedTrue: Set `unified_mode true` in Chef Infra Client 15.3+ custom resources to ensure they work correctly in Chef Infra Client 18 (April 2022) when Unified Mode becomes the default. (https://docs.chef.io/workstation/cookstyle/chef_deprecations_resourcewithoutunifiedtrue): openssl/resources/ec_private_key.rb: 1
Chef/Deprecations/ResourceWithoutUnifiedTrue: Set `unified_mode true` in Chef Infra Client 15.3+ custom resources to ensure they work correctly in Chef Infra Client 18 (April 2022) when Unified Mode becomes the default. (https://docs.chef.io/workstation/cookstyle/chef_deprecations_resourcewithoutunifiedtrue): openssl/resources/ec_public_key.rb: 1
Chef/Deprecations/ResourceWithoutUnifiedTrue: Set `unified_mode true` in Chef Infra Client 15.3+ custom resources to ensure they work correctly in Chef Infra Client 18 (April 2022) when Unified Mode becomes the default. (https://docs.chef.io/workstation/cookstyle/chef_deprecations_resourcewithoutunifiedtrue): openssl/resources/rsa_private_key.rb: 1
Chef/Deprecations/ResourceWithoutUnifiedTrue: Set `unified_mode true` in Chef Infra Client 15.3+ custom resources to ensure they work correctly in Chef Infra Client 18 (April 2022) when Unified Mode becomes the default. (https://docs.chef.io/workstation/cookstyle/chef_deprecations_resourcewithoutunifiedtrue): openssl/resources/rsa_public_key.rb: 1
Chef/Deprecations/ResourceWithoutUnifiedTrue: Set `unified_mode true` in Chef Infra Client 15.3+ custom resources to ensure they work correctly in Chef Infra Client 18 (April 2022) when Unified Mode becomes the default. (https://docs.chef.io/workstation/cookstyle/chef_deprecations_resourcewithoutunifiedtrue): openssl/resources/x509_certificate.rb: 1
Chef/Deprecations/ResourceWithoutUnifiedTrue: Set `unified_mode true` in Chef Infra Client 15.3+ custom resources to ensure they work correctly in Chef Infra Client 18 (April 2022) when Unified Mode becomes the default. (https://docs.chef.io/workstation/cookstyle/chef_deprecations_resourcewithoutunifiedtrue): openssl/resources/x509_crl.rb: 1
Chef/Deprecations/ResourceWithoutUnifiedTrue: Set `unified_mode true` in Chef Infra Client 15.3+ custom resources to ensure they work correctly in Chef Infra Client 18 (April 2022) when Unified Mode becomes the default. (https://docs.chef.io/workstation/cookstyle/chef_deprecations_resourcewithoutunifiedtrue): openssl/resources/x509_request.rb: 1

Run with Cookstyle Version 7.32.1 with cops Chef/Deprecations,Chef/Correctness,Chef/Sharing,Chef/RedundantCode,Chef/Modernize,Chef/Security,InSpec/Deprecations

No Binaries Metric
            

8.5.5 passed this metric

Testing File Metric
            

8.5.5 failed this metric

Failure: To pass this metric, your cookbook metadata must include a source url, the source url must be in the form of https://github.com/user/repo, and your repo must contain a TESTING.md file

Version Tag Metric
            

8.5.5 failed this metric

Failure: To pass this metric, your cookbook metadata must include a source url, the source url must be in the form of https://github.com/user/repo, and your repo must include a tag that matches this cookbook version number