Error running ChefInspecChecks
- Dominant language
- Go
- Stars
- 1.2k
- Forks
- 357
- PR merge metrics
- No merged PRs in 30d
Description
I am getting an continuous error when attempting to perform a Systems Manager Association, AWS-RunInspecChecks. I am trying to make a STIG compliant RHEL7 image and when I run the Inspec Checks, it takes a very long time, as much as 25-30 minutes. The Association then fails due to the following message:
/opt/chefdk/embedded/lib/ruby/2.6.0/net/protocol.rb:44:in `connect_nonblock': SSL_connect returned=1 errno=0 state=error: certificate verify failed (self signed certificate in certificate chain) (Seahorse::Client::NetworkingError)
When I look at the logs in the /var/log/messages directory on the instance, I see errors caused by this:
Post https://ssm.us-gov-west-1.amazonaws.com/: x509: certificate signed by unknown authority
When I run the Inspec Checks on the instance before "stigging it up", the association succeeds and I can see the non-compliant issues that need to be addressed. However once the issues are addressed, the association fails due to what appears to be an SSL cert issue.
ssm is currently installed and running on the instance
permissions are correctly set and associated
Contributor guide
Research direction
Reproduce the AWS-RunInspecChecks association before and after applying the STIG changes, then inspect /var/log/messages and the reported /opt/chefdk/embedded/lib/ruby/2.6.0/net/protocol.rb failure. Compare the certificate chain and trust configuration used for https://ssm.us-gov-west-1.amazonaws.com/. Done means identifying the changed trust condition or documenting the missing information needed to isolate it.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, linux, ruby
- Domain
- cloud, operating-systems, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 20/100