Unable to create a Chef resource using the Chef provider when the Chef sever is using a self signed certificate.

[ghost]

This issue was originally opened by @sbobylev as hashicorp/terraform#18916. It was migrated here as a result of the provider split. The original body of the issue is below.

---

Unable to create a role in AWS OpsWorks for Chef Automate using terraform and the chef provider. Since OpsWorks is using a self signed certificate, terraform apply fails.

Terraform Version

Terraform v0.11.8
+ provider.chef v0.1.0

Terraform Configuration Files

backend.tf

provider "chef" {
  server_url = "https://test-xgibsgi18eldm7wa.us-east-2.opsworks-cm.io/organizations/default"
  client_name  = "terraform"
  key_material = "${file("chef-terraform.pem")}"
}

test_chef_role.tf

resource "chef_role" "test" {
  name     = "test-role"
}

Crash Output

terraform apply -auto-approve

chef_role.test: Creating...
  default_attributes_json:  "" => "{}"
  description:              "" => "Managed by Terraform"
  name:                     "" => "test-role"
  override_attributes_json: "" => "{}"

Error: Error applying plan:

1 error(s) occurred:

* chef_role.test: 1 error(s) occurred:

* chef_role.test: Post https://test-xgibsgi18eldm7wa.us-east-2.opsworks-cm.io/organizations/roles: x509: certificate signed by unknown authority

Terraform does not automatically rollback in the face of errors.
Instead, your Terraform state file has been partially updated with
any resources that successfully completed. Please address the error
above and apply again to incrementally change your infrastructure.

Expected Behavior

A new chef resource gets created.

Actual Behavior

Terraform apply fails.

Steps to Reproduce

1. terraform init
2. terraform apply -auto-approve

Workaround

Set allow_unverified_ssl to true in the backend.tf file.

provider "chef" {
  server_url = "https://test-xgibsgi18eldm7wa.us-east-2.opsworks-cm.io/organizations/default"
  client_name  = "terraform"
  key_material = "${file("chef-terraform.pem")}"
  allow_unverified_ssl = true
}

Feature Request

Add support for ssl_ca_file option