Wildcard certificate for Chef Server 12.x

I've successfully installed our wildcard certificate and when I got to the web gui certificate shows green (I'm using chrome).

But knife commands are erroring. Specifically:

bwright@mylaptop:~/chef-repo/cookbooks$ knife ssl check

Configuration Info:

OpenSSL Configuration:
* Version: OpenSSL 1.0.1t  3 May 2016
* Certificate file: /opt/chefdk/embedded/ssl/cert.pem
* Certificate directory: /opt/chefdk/embedded/ssl/certs
Chef SSL Configuration:
* ssl_ca_path: nil
* ssl_ca_file: nil
* trusted_certs_dir: "/home/bwright/.chef/trusted_certs"
WARNING: There are invalid certificates in your trusted_certs_dir.
OpenSSL will not use the following certificates when verifying SSL connections:

/home/bwright/.chef/trusted_certs/wildcard_prod_example_com.crt: unable to get local issuer certificate


TO FIX THESE WARNINGS:

We are working on documentation for resolving common issues uncovered here.

* If the certificate is generated by the server, you may try redownloading the
server's certificate. By default, the certificate is stored in the following
location on the host where your chef-server runs:

  /var/opt/opscode/nginx/ca/SERVER_HOSTNAME.crt

Copy that file to your trusted_certs_dir (currently: /home/bwright/.chef/trusted_certs)
using SSH/SCP or some other secure method, then re-run this command to confirm
that the server's certificate is now trusted.

Connecting to host chef-12.prod.example.com:443
ERROR: The SSL certificate of chef-12.prod.example.com could not be verified
Certificate issuer data: /C=BE/O=GlobalSign nv-sa/CN=AlphaSSL CA - SHA256 - G2

Configuration Info:

OpenSSL Configuration:
* Version: OpenSSL 1.0.1t  3 May 2016
* Certificate file: /opt/chefdk/embedded/ssl/cert.pem
* Certificate directory: /opt/chefdk/embedded/ssl/certs
Chef SSL Configuration:
* ssl_ca_path: nil
* ssl_ca_file: nil
* trusted_certs_dir: "/home/bwright/.chef/trusted_certs"

TO FIX THIS ERROR:

If the server you are connecting to uses a self-signed certificate, you must
configure chef to trust that server's certificate.

By default, the certificate is stored in the following location on the host
where your chef-server runs:

  /var/opt/opscode/nginx/ca/SERVER_HOSTNAME.crt

Copy that file to your trusted_certs_dir (currently: /home/bwright/.chef/trusted_certs)
using SSH/SCP or some other secure method, then re-run this command to confirm
that the server's certificate is now trusted.

I've tried a few different things (still doing a knife ssl fetch or adding more cert to the file to create a chain) and so far have not been able to get it working. Any help would be much appreciated, I really don't want to have to use self signed certs.

Start by reproducing the failure with knife ssl check and inspect /home/bwright/.chef/trusted_certs/wildcard_prod_example_com.crt and the reported issuer data. The issue is resolved when the Chef Server certificate is accepted by knife ssl check without the invalid-certificate warning or verification error.