Chef Infra

Store certificates in Chef data bags for distribution to nodes via Chef Infra. Certificates are stored as data bag items with customizable field names.

Certificate Syncs are configured per Application. First select which certificates to sync, then configure the Chef destination.

Prerequisites

A Chef Connection with the following permissions:
- data bag read
- data bag create
- data bag update
- data bag delete

Certificates are stored as data bag items with configurable field names for certificate, private key, and chain.

Create a Chef Sync

Infisical UI
API

In your Application, go to the Certificate Syncs tab and click Create Sync.
Select the Chef option.
Configure the Destination:
- Chef Connection: The Chef Connection to authenticate with.
- Data Bag Name: The name of the Chef data bag for storing certificates.
Configure the Sync Options:
- Enable Removal of Expired/Revoked Certificates: Remove certificates from the destination if they are no longer active.
- Preserve Data Bag Item on Renewal: Update the existing data bag item on renewal instead of creating a new one.
- Include Root CA: Include the Root CA certificate in the chain.
- Certificate Name Schema: Customize item names using {{certificateId}} placeholder.
- Auto-Sync Enabled: Automatically sync certificates when changes occur.
Configure the Field Mappings:
- Certificate Field: Field name for the certificate (default: certificate)
- Private Key Field: Field name for the private key (default: private_key)
- Certificate Chain Field: Field name for the chain (default: certificate_chain)
- CA Certificate Field: Field name for the root CA (default: ca_certificate)

Certificates are stored as data bag items:

{
  "id": "certificate-item-name",
  "certificate": "-----BEGIN CERTIFICATE-----\n...",
  "private_key": "-----BEGIN PRIVATE KEY-----\n...",
  "certificate_chain": "-----BEGIN CERTIFICATE-----\n...",
  "ca_certificate": "-----BEGIN CERTIFICATE-----\n..."
}

Configure the Details:
- Name: The name of your sync (slug-friendly).
- Description: Optional description.
Select which certificates should be synced.
Review and click Create Sync.

To create a Chef Certificate Sync, make an API request to the Create Chef Certificate Sync API endpoint.

Sample request

You can optionally specify certificateIds during sync creation to immediately add certificates to the sync. If not provided, you can add certificates later using the certificate management endpoints.

Request

curl --request POST \
--url https://app.infisical.com/api/v1/cert-manager/syncs/chef \
--header 'Authorization: Bearer <access-token>' \
--header 'Content-Type: application/json' \
--data '{
    "name": "my-chef-cert-sync",
    "applicationId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
    "description": "an example certificate sync",
    "connectionId": "550e8400-e29b-41d4-a716-446655440000",
    "destination": "chef",
    "isAutoSyncEnabled": true,
    "certificateIds": [
        "550e8400-e29b-41d4-a716-446655440000",
        "660f1234-e29b-41d4-a716-446655440001"
    ],
    "syncOptions": {
        "canRemoveCertificates": true,
        "preserveSecretOnRenewal": true,
        "canImportCertificates": false,
        "includeRootCa": false,
        "certificateNameSchema": "myapp-{{certificateId}}",
        "fieldMappings": {
            "certificate": "ssl_cert",
            "privateKey": "ssl_key",
            "certificateChain": "ssl_chain",
            "caCertificate": "ssl_ca"
        }
    },
    "destinationConfig": {
        "dataBagName": "ssl_certificates"
    }
}'

Example with Default Field Mappings

Request

curl --request POST \
--url https://app.infisical.com/api/v1/cert-manager/syncs/chef \
--header 'Authorization: Bearer <access-token>' \
--header 'Content-Type: application/json' \
--data '{
    "name": "my-chef-cert-sync-default",
    "applicationId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
    "description": "Chef sync with default field mappings",
    "connectionId": "550e8400-e29b-41d4-a716-446655440000",
    "destination": "chef",
    "isAutoSyncEnabled": true,
    "syncOptions": {
        "canRemoveCertificates": true,
        "preserveSecretOnRenewal": true,
        "canImportCertificates": false,
        "includeRootCa": false,
        "certificateNameSchema": "{{commonName}}-{{certificateId}}",
        "fieldMappings": {
            "certificate": "certificate",
            "privateKey": "private_key",
            "certificateChain": "certificate_chain",
            "caCertificate": "ca_certificate"
        }
    },
    "destinationConfig": {
        "dataBagName": "certificates"
    }
}'

Sample response

Response

{
    "pkiSync": {
        "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
        "name": "my-chef-cert-sync",
        "description": "an example certificate sync",
        "destination": "chef",
        "isAutoSyncEnabled": true,
        "destinationConfig": {
            "dataBagName": "ssl_certificates"
        },
        "syncOptions": {
            "canRemoveCertificates": true,
            "preserveSecretOnRenewal": true,
            "canImportCertificates": false,
            "includeRootCa": false,
            "certificateNameSchema": "myapp-{{certificateId}}",
            "fieldMappings": {
                "certificate": "ssl_cert",
                "privateKey": "ssl_key",
                "certificateChain": "ssl_chain",
                "caCertificate": "ssl_ca"
            }
        },
        "applicationId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
        "connectionId": "550e8400-e29b-41d4-a716-446655440000",
        "createdAt": "2023-01-01T00:00:00.000Z",
        "updatedAt": "2023-01-01T00:00:00.000Z"
    }
}

Certificate Management

The Chef Certificate Sync provides:

Automatic Deployment: Deploy certificates in Infisical to Chef data bags with customizable field names.
Certificate Updates: Update certificates in Chef data bags when renewals occur.
Expiration Handling: Optionally remove expired certificates from Chef data bags (if enabled).
Format Preservation: Maintain certificate format during sync operations.
Field Customization: Map certificate data to custom field names that match your Chef cookbook requirements.
CA Certificate Support: Include CA certificates in data bag items for complete certificate chain management.

Chef Certificate Syncs support both automatic and manual synchronization modes. When auto-sync is enabled, certificates are automatically deployed as they are issued or renewed.

Manual Certificate Sync

You can manually trigger certificate synchronization to Chef using the sync certificates functionality. This is useful for:

Initial setup when you have existing certificates to deploy
One-time sync of specific certificates
Testing certificate sync configurations
Force sync after making changes

To manually sync certificates, use the Sync Certificates API endpoint or the manual sync option in the Infisical UI.

FAQ

Can I import certificates from Chef back into Infisical?

Chef does not support importing certificates back into Infisical due to the nature of Chef data bags where certificates are stored as data rather than managed certificate objects.

What’s Next?

AWS Certificate Manager

Import certificates into ACM for AWS services.

Auto-Renewal

Enable automatic certificate renewal and syncing.

Alerting

Get notified about certificate lifecycle events.

Other Sync Destinations

View all supported sync destinations.

Certificate Management

Product Reference

Reference

Prerequisites

Create a Chef Sync

Sample request

Example with Default Field Mappings

Sample response

Certificate Management

Manual Certificate Sync

FAQ

What’s Next?

AWS Certificate Manager

Auto-Renewal

Alerting

Other Sync Destinations

Certificate Management

Product Reference

Reference

Documentation Index

​Prerequisites

​Create a Chef Sync

​Sample request

​Example with Default Field Mappings

​Sample response

​Certificate Management

​Manual Certificate Sync

​FAQ

​What’s Next?

AWS Certificate Manager

Auto-Renewal

Alerting

Other Sync Destinations

Prerequisites

Create a Chef Sync

Sample request

Example with Default Field Mappings

Sample response

Certificate Management

Manual Certificate Sync

FAQ

What’s Next?