[chef] Re: Re: Re: Re: Re: Re: Re: Re: validation.pem seems to stop working after 24-48 hours.

["Jason J. W. Williams" < >]

Hi Dan,

> The signature is incorrect, though, so the private key used to sign the
> request doesn't match the public being used to verify the signature.
> Are you deleting /etc/chef/validation.pem on the server for any reason? Is
> there anything else on the server side that correlates with the
> validation.pem going bad, such as restarts for logrotation?
>

By "on the server" I assume you mean on the server being provisioned
via chef-client? validation.pem on servers being provisioned is loaded
via "knife bootstrap" from my workstation, and it's not changing on my
workstation. If I run "openssl rsa -noout -modulus -in validation.pem
| openssl md5" I get:

9b2a64dd6acd1e5337b5804886841208

However, if I run "openssl rsa -noout -modulus -pubin -in | openssl
md5" on the public key as shown in the Chef console I get errors:

unable to load Public Key
48166:error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong
tag:/SourceCache/OpenSSL098/OpenSSL098-35/src/crypto/asn1/tasn_dec.c:1316:
48166:error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested
asn1 
error:/SourceCache/OpenSSL098/OpenSSL098-35/src/crypto/asn1/tasn_dec.c:380:Type=X509_ALGOR
48166:error:0D08303A:asn1 encoding
routines:ASN1_TEMPLATE_NOEXP_D2I:nested asn1
error:/SourceCache/OpenSSL098/OpenSSL098-35/src/crypto/asn1/tasn_dec.c:748:Field=algor,
Type=X509_PUBKEY
48166:error:0906700D:PEM routines:PEM_ASN1_read_bio:ASN1
lib:/SourceCache/OpenSSL098/OpenSSL098-35/src/crypto/pem/pem_oth.c:83:

It's almost as if the public key in Chef has become corrupted, which
would seem to explain the "padding error" message on the server side
logs.

-J