Disable Chef/Berks SSL verification inside test kitchen

Question

When running test kitchen, the Chef client inside VirtualBox VM isn't accepting my Chef server's self-signed certificate.

$ bundle exec kitchen converge default-windows-2008r2
-----> Starting Kitchen (v1.17.0)
-----> Converging <default-windows-2008r2>...
       Preparing files for transfer
       Preparing dna.json
       Resolving cookbook dependencies with Berkshelf 4.2.0...
Using compat_resource (12.19.0)
Installing cron (4.1.3) from http://berksapi.mycompany.com/ ([chef_server] https://chef.mycompany.com:443/organizations/devops)
Installing logentries-windows (0.2.2) from http://berksapi.mycompany.com/ ([chef_server] https://chef.mycompany.com:443/organizations/devops)

>>>>>> ------Exception-------
>>>>>> Class: Kitchen::ActionFailed
>>>>>> Message: 1 actions failed.
>>>>>>     Failed to complete #converge action: [SSL_connect returned=1 errno=0 state=error: certificate verify failed] on default-windows-2008r2
>>>>>> ----------------------
>>>>>> Please see .kitchen/logs/kitchen.log for more details
>>>>>> Also try running `kitchen diagnose --all` for configuration

Installing logrotate (2.2.0) from http://berksapi.mycompany.com/ ([chef_server] https://chef.mycompany.com:443/organizations/devops)
Using mingw (2.0.1)
Installing omnibus_updater (3.0.2) from http://berksapi.mycompany.com/ ([chef_server] https://chef.mycompany.com:443/organizations/devops)
Installing ohai (5.2.0) from http://berksapi.mycompany.com/ ([chef_server] https://chef.mycompany.com:443/organizations/devops)

$ echo $?
20

My workstation's Berks config already has SSL verification disabled:

$ cat ~/.berkshelf/config.json
{
  "ssl":{
    "verify": false
  }
}

I have also tried setting a Chef attribute to disable verification:

# .kitchen.yml
suites:
  - name: default
    attributes:
      chef_client:
        config:
          ssl_verify_mode: ":verify_none"

Answer 1

If you update to a newer version of Berkshelf (4.2.0 is about 18 months old) we've fixed most things to use the same .chef/trusted_certs/ folder as Chef itself, which will likely fix this issue without needing to disable verification.