> ## Documentation Index > Fetch the complete documentation index at: https://infisical.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Sync certificates to Chef Infra > Distribute certificates via Chef data bags. Store certificates in Chef data bags for distribution to nodes via Chef Infra. Certificates are stored as data bag items with customizable field names. > [!NOTE] > > Certificate Syncs are configured per Application. First select which certificates to sync, then configure the Chef destination. ## Prerequisites * A [Chef Connection](https://infisical.com/docs/integrations/app-connections/chef.md) with the following permissions: * `data bag read` * `data bag create` * `data bag update` * `data bag delete` > [!NOTE] > > Certificates are stored as data bag items with configurable field names for certificate, private key, and chain. ## Create a Chef sync > [tab] Infisical UI > > 1. In your Application, go to the **Certificate Syncs** tab and select **Create Sync**. > > 2. Select the **Chef** option. > > 3. Configure the **Destination**: > * **Chef Connection**: The Chef Connection to authenticate with. > * **Data Bag Name**: The name of the Chef data bag for storing certificates. > > 4. Configure the **Sync Options**: > * **Enable Removal of Expired/Revoked Certificates**: Remove certificates from the destination if they are no longer active. > * **Preserve Data Bag Item on Renewal**: Update the existing data bag item on renewal instead of creating a new one. > * **Include Root CA**: Include the Root CA certificate in the chain. > * **Certificate Name Schema**: Customize item names using placeholders such as `{{certificateId}}`, `{{commonName}}`, `{{profileId}}`, and `{{applicationId}}`. Must include `{{certificateId}}`. See [Certificate Name Schema](https://infisical.com/docs/documentation/platform/pki/applications/certificate-syncs/overview#certificate-name-schema) for the full placeholder reference. > * **Auto-Sync Enabled**: Automatically sync certificates when changes occur. > > 5. Configure the **Field Mappings**: > * **Certificate Field**: Field name for the certificate (default: `certificate`) > > * **Private Key Field**: Field name for the private key (default: `private_key`) > > * **Certificate Chain Field**: Field name for the chain (default: `certificate_chain`) > > * **CA Certificate Field**: Field name for the root CA (default: `ca_certificate`) > > > [!TIP] > > > > Certificates are stored as data bag items: > > > > ```json theme={"dark"} > > { > > "id": "certificate-item-name", > > "certificate": "-----BEGIN CERTIFICATE-----\n...", > > "private_key": "-----BEGIN PRIVATE KEY-----\n...", > > "certificate_chain": "-----BEGIN CERTIFICATE-----\n...", > > "ca_certificate": "-----BEGIN CERTIFICATE-----\n..." > > } > > ``` > > 6. Configure the **Details**: > * **Name**: The name of your sync (slug-friendly). > * **Description**: Optional description. > > 7. Select which certificates should be synced. > > 8. Review and click **Create Sync**. > [tab] API > > To create a **Chef Certificate Sync**, make an API request to the [Create Chef Certificate Sync](https://infisical.com/docs/api-reference/endpoints/pki/syncs/chef/create.md) API endpoint. > > ### Sample request > > > [!NOTE] > > > > Pass `filters` to describe the certificates this sync holds. Anything in the Application that matches is > > attached automatically, as it is issued. Omit it and the sync starts empty, and you can set filters later. > > See [Certificate filters](https://infisical.com/docs/documentation/platform/pki/applications/certificate-syncs/overview#certificate-filters). > > ```bash Request theme={"dark"} > curl --request POST \ > --url https://app.infisical.com/api/v1/cert-manager/syncs/chef \ > --header 'Authorization: Bearer ' \ > --header 'Content-Type: application/json' \ > --data '{ > "name": "my-chef-cert-sync", > "applicationId": "3c90c3cc-0d44-4b50-8888-8dd25736052a", > "description": "an example certificate sync", > "connectionId": "550e8400-e29b-41d4-a716-446655440000", > "destination": "chef", > "isAutoSyncEnabled": true, > "filters": { > "certificateOrderIds": [ > "550e8400-e29b-41d4-a716-446655440000", > "660f1234-e29b-41d4-a716-446655440001" > ] > }, > "syncOptions": { > "canRemoveCertificates": true, > "preserveSecretOnRenewal": true, > "canImportCertificates": false, > "includeRootCa": false, > "certificateNameSchema": "myapp-{{certificateId}}", > "fieldMappings": { > "certificate": "ssl_cert", > "privateKey": "ssl_key", > "certificateChain": "ssl_chain", > "caCertificate": "ssl_ca" > } > }, > "destinationConfig": { > "dataBagName": "ssl_certificates" > } > }' > ``` > > ### Example with default field mappings > > ```bash Request theme={"dark"} > curl --request POST \ > --url https://app.infisical.com/api/v1/cert-manager/syncs/chef \ > --header 'Authorization: Bearer ' \ > --header 'Content-Type: application/json' \ > --data '{ > "name": "my-chef-cert-sync-default", > "applicationId": "3c90c3cc-0d44-4b50-8888-8dd25736052a", > "description": "Chef sync with default field mappings", > "connectionId": "550e8400-e29b-41d4-a716-446655440000", > "destination": "chef", > "isAutoSyncEnabled": true, > "syncOptions": { > "canRemoveCertificates": true, > "preserveSecretOnRenewal": true, > "canImportCertificates": false, > "includeRootCa": false, > "certificateNameSchema": "{{commonName}}-{{certificateId}}", > "fieldMappings": { > "certificate": "certificate", > "privateKey": "private_key", > "certificateChain": "certificate_chain", > "caCertificate": "ca_certificate" > } > }, > "destinationConfig": { > "dataBagName": "certificates" > } > }' > ``` > > ### Sample response > > ```json Response theme={"dark"} > { > "pkiSync": { > "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a", > "name": "my-chef-cert-sync", > "description": "an example certificate sync", > "destination": "chef", > "isAutoSyncEnabled": true, > "destinationConfig": { > "dataBagName": "ssl_certificates" > }, > "syncOptions": { > "canRemoveCertificates": true, > "preserveSecretOnRenewal": true, > "canImportCertificates": false, > "includeRootCa": false, > "certificateNameSchema": "myapp-{{certificateId}}", > "fieldMappings": { > "certificate": "ssl_cert", > "privateKey": "ssl_key", > "certificateChain": "ssl_chain", > "caCertificate": "ssl_ca" > } > }, > "applicationId": "3c90c3cc-0d44-4b50-8888-8dd25736052a", > "connectionId": "550e8400-e29b-41d4-a716-446655440000", > "createdAt": "2023-01-01T00:00:00.000Z", > "updatedAt": "2023-01-01T00:00:00.000Z" > } > } > ``` ## Certificate management The Chef Certificate Sync provides: * **Automatic Deployment**: Deploy certificates in Infisical to Chef data bags with customizable field names. * **Certificate Updates**: Update certificates in Chef data bags when renewals occur. * **Expiration Handling**: Optionally remove expired certificates from Chef data bags (if enabled). * **Format Preservation**: Maintain certificate format during sync operations. * **Field Customization**: Map certificate data to custom field names that match your Chef cookbook requirements. * **CA Certificate Support**: Include CA certificates in data bag items for complete certificate chain management. > [!NOTE] > > Chef Certificate Syncs support both automatic and manual > synchronization modes. When auto-sync is enabled, certificates are > automatically deployed as they're issued or renewed. ## Manual certificate sync You can manually trigger certificate synchronization to Chef using the sync certificates functionality. This is useful for: * Initial setup when you have existing certificates to deploy * One-time sync of specific certificates * Testing certificate sync configurations * Force sync after making changes To manually sync certificates, use the [Sync Certificates](https://infisical.com/docs/api-reference/endpoints/pki/syncs/chef/sync-certificates.md) API endpoint or the manual sync option in the Infisical UI. ## FAQ > [accordion] Can I import certificates from Chef back into Infisical? > > Chef doesn't support importing certificates back into Infisical > due to the nature of Chef data bags where certificates are stored as data > rather than managed certificate objects. ## What's next? > [card] [AWS Certificate Manager](https://infisical.com/docs/documentation/platform/pki/applications/certificate-syncs/aws-certificate-manager.md) > > Import certificates into ACM for AWS services. > [card] [Auto-Renewal](https://infisical.com/docs/documentation/platform/pki/applications/certificates.md#renewal) > > Enable automatic certificate renewal and syncing. > [card] [Alerting](https://infisical.com/docs/documentation/platform/pki/applications/alerting/overview) > > Get notified about certificate lifecycle events. > [card] [Other Sync Destinations](https://infisical.com/docs/documentation/platform/pki/applications/certificate-syncs/overview) > > View all supported sync destinations. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.