ssl - Chef apt_repository 开始因 SSL 验证错误而失败

Question

从过去 2 天开始，我们开始看到与 apt_repository 资源相关的 Chef 执行失败。在 chef-client 执行中也看到了类似的失败

Chef-solo 版本:12.19.36操作系统:Ubuntu v18 & Ubuntuv14

请参阅以下来自 chef-solo 执行的错误。

==> core: [2021-10-04T14:36:46+00:00] ERROR: SSL Validation failure connecting to host: www.postgresql.org - SSL_connect returned=1 errno=0 state=error: certificate verify failed
==> core:
==> core:
==> core: ================================================================================
==> core: Error executing action create on resource 'remote_file[/var/chef/cache/https___www_postgresql_org_media_keys_ACCC4CF8_asc]'
==> core: ================================================================================
==> core:
==> core: OpenSSL::SSL::SSLError
==> core: ----------------------
==> core: SSL Error connecting to https://www.postgresql.org/media/keys/ACCC4CF8.asc - SSL_connect returned=1 errno=0 state=error: certificate verify failed
==> core:
==> core:
==> core: Resource Declaration:
==> core: ---------------------
==> core: # In /opt/chef/embedded/lib/ruby/gems/2.3.0/gems/chef-12.19.36/lib/chef/provider/apt_repository.rb
==> core:
==> core: 166: declare_resource(type, cached_keyfile) do
==> core: 167: source new_resource.key
==> core: 168: mode "0644"
==> core: 169: sensitive new_resource.sensitive
==> core: 170: action :create
==> core: 171: end
==> core: 172:
==> core:
==> core: Compiled Resource:
==> core:
==> core: ------------------
==> core: # Declared in /opt/chef/embedded/lib/ruby/gems/2.3.0/gems/chef-12.19.36/lib/chef/provider/apt_repository.rb:166:in `install_key_from_uri'
==> core:

Answer 1

这与上周四的Root CA Certificate Expiration有关让我们加密证书。

对于 OpenSSL，您至少需要升级到 1.1，我认为这是因为 1.0.1 处理证书链的方式存在错误。如果这不可能，您将需要从操作系统中删除 DST Root CA X3 证书。

Chef 还提供了它自己的根证书，而不是操作系统。我必须从 /opt/chef/embedded/ssl/certs/cacert.pem 中删除上述证书，并向其中添加 ISRG Root X1。