Recommended Free Tools
A complete Chef deployment has three parts: Chef Infra Server on an Ubuntu VPS, Chef Workstation on an administrator’s computer, and Chef Infra Client on each managed node. Install and initialize the server first, create an administrator and organization, configure the workstation with the resulting PEM keys, then use knife bootstrap over SSH (or WinRM) to install and register each client.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
Lifecycle warning: Progress Chef documents that Chef Infra Server is deprecated and reaches end-of-life status in November 2026. A lab or short-lived project can still follow this procedure, but a production deployment should include a replacement or migration checkpoint before committing to a long operating horizon.
As an Amazon Associate I earn from qualifying purchases.
What you are building
Chef uses a control-plane and node model. The server stores organizations, nodes, environments, roles, cookbooks, policies, and authentication data. The workstation is the administrator’s control plane: it contains knife, cookbook authoring tools, testing utilities, and the credentials needed to talk to the server. A node is any physical, virtual, or cloud device configured and maintained by Chef Infra Client.
The normal flow is:
- Install and configure Chef Infra Server on an x86_64 Ubuntu VPS.
- Create an administrative user and an organization, then retain their private PEM keys securely.
- Install Chef Workstation on a separate Ubuntu or Debian system.
- Copy the user and organization credentials into the workstation’s
.chefdirectory and configureknife. - Bootstrap each target node. Knife connects over SSH by default, installs Chef Infra Client, writes first-boot configuration, runs the client, and registers the node with the server over HTTPS.
Supported platform and prerequisites
Chef’s current server installation documentation lists x86_64 Ubuntu 20.04 and Ubuntu 22.04 as supported server platforms. Use one of those releases for the server unless the live support matrix explicitly adds another version. The VPS needs a stable, resolvable hostname or fully qualified domain name (FQDN), synchronized time, and the network paths Chef requires.
#1 Best Overall
Server checklist
- Architecture: x86_64 (AMD64).
- Operating system: Ubuntu 20.04 or 22.04 for the server target documented by Chef.
- Name resolution: Set a permanent hostname such as
chef.example.netand create a DNS record that resolves to the VPS. Test resolution from both the workstation and prospective client nodes. - Time: Enable NTP or the Ubuntu time-synchronization service. Kerberos is not required for ordinary SSH bootstrapping, but large clock differences can break TLS validation, signed requests, and troubleshooting.
- Network: Permit HTTPS and HTTP as required by the Chef server prerequisites, normally TCP ports 443 and 80. Restrict administrative SSH to trusted source addresses and apply the VPS provider’s firewall and hardening policy.
- Privileges: You need a sudo-capable account on the VPS. The account used for bootstrap must be able to obtain root privileges on each node.
- Backups: Arrange provider snapshots or another tested backup method before putting organization data and cookbooks on the server.
How much VPS capacity is needed?
Chef does not publish one universal CPU, RAM, or storage size that fits every installation. Choose capacity from the number of nodes, cookbook and search complexity, indexing load, backup frequency, and retention requirements. Start with a small instance for a proof of concept, observe memory, CPU, disk, and response time during a staging run, and scale before production. Keep free disk space for package caches, server data, logs, and backup staging rather than sizing only for the operating system.
Prepare the Ubuntu VPS
Set the hostname and verify DNS
- Assign the VPS a stable hostname, for example
chef.example.net, using your provider’s console or Ubuntu’s hostname tools. - Create an A or AAAA record for that name and wait for the record to be visible from the networks that will administer Chef.
- From the workstation, resolve the name and test the intended HTTPS endpoint. A temporary hosts-file entry can help during a lab setup, but production should use real DNS.
Synchronize time and apply firewall rules
Enable Ubuntu’s time synchronization and confirm that the VPS clock is correct. Allow TCP 80 and 443 to the extent required by the Chef server and your topology; do not expose administration ports broadly just because the VPS is reachable. Permit SSH only from the workstation or management network, and record any provider-level firewall rules separately from the guest operating system rules.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsInstall and initialize Chef Infra Server
1. Obtain the server package
Download the current Chef Infra Server package that matches the supported Ubuntu architecture from Progress Chef’s installation documentation. Copy the Ubuntu Debian package to the VPS, for example into /tmp. Keep the exact version in your deployment notes so a rebuild uses the same artifact or an intentionally upgraded one.
2. Install the Debian package
Run the package installation as root:
sudo dpkg -i /tmp/chef-server-core-<version>.debIf dpkg reports missing dependencies, resolve them with Ubuntu’s package manager, then rerun the installation. Do not delete the package until you have recorded its version and confirmed the service is healthy.
3. Run the server reconfigure operation
Chef’s server package supplies the chef-server-ctl administration command. Apply the bundled configuration with:
sudo chef-server-ctl reconfigureThe server is composed of multiple services, so this operation can take several minutes. Wait for it to finish instead of interrupting it. If it fails, capture the terminal output and service logs before retrying; repeated retries without fixing DNS, disk, permissions, or dependency errors can make diagnosis harder.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minute4. Create an administrator and protect the private key
Create a Chef user and write its private key to an absolute path that only the administrator can read:
Rank #2
sudo chef-server-ctl user-create USER_NAME FIRST_NAME LAST_NAME EMAIL 'PASSWORD' --filename /absolute/path/admin.pemReplace the uppercase values with your own data. Use a long, unique password and store admin.pem in an encrypted password manager or offline secrets store. Treat the file as a root credential: anyone who obtains it can authenticate as that Chef user.
5. Create an organization
An organization is the namespace in which nodes and cookbooks live. Using the newly created administrator, create one and save its validator key in a protected location. A typical server command is:
sudo chef-server-ctl org-create ORG_NAME 'Organization Display Name' --association_user USER_NAME --filename /absolute/path/ORG_NAME-validator.pemUse a lowercase, stable short name for ORG_NAME. Check the command syntax supplied by the server release you installed if your package presents different options. Keep the organization validator key separate from the user key and never commit either file to a public or shared source repository.
Install Chef Workstation
Chef Workstation bundles Chef Infra Client, Chef InSpec, Chef Habitat, knife, Test Kitchen, Cookstyle, and other cookbook tools. Install it on an Ubuntu or Debian administration computer rather than treating the Chef server as the authoring machine.
1. Install the workstation package
Download the current supported 64-bit Debian package, then install the exact file you downloaded:
sudo dpkg -i chef-workstation_<WORKSTATION_VERSION>-1_amd64.debResolve any package dependencies through the operating system package manager and rerun the command if necessary.
2. Verify the toolchain
chef -vThe output should identify Chef Workstation and the bundled Chef Infra Client version. Record this output with your server package version; compatibility problems are much easier to diagnose when all three version lines are known.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →3. Create a private Chef configuration directory
On the workstation, create a directory for organization credentials and configuration:
mkdir -p ~/.chef
chmod 700 ~/.chefCopy admin.pem and the organization validator PEM into this directory using a secure transfer method. Set restrictive permissions:
chmod 600 ~/.chef/*.pemIf more than one organization or user is administered from the workstation, use separate named files and explicit configuration rather than overwriting keys.
4. Configure knife
Create ~/.chef/knife.rb with the server URL, organization name, administrator identity, and key paths. A minimal configuration has this shape:
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →current_dir = File.dirname(__FILE__)
chef_server_url 'https://chef.example.net/organizations/ORG_NAME'
node_name 'USER_NAME'
client_key "#{current_dir}/admin.pem"
cookbook_path ["#{current_dir}/../cookbooks"]Use the FQDN that appears in the server certificate, not an unresolvable alias. The organization URL must match the organization you created. Keep knife.rb private if it contains paths or environment-specific details, and never embed private key contents in it.
Bootstrap the first Chef client
Prepare the target node
Before running knife bootstrap, collect the node’s reachable IP address or FQDN and confirm that the workstation can open SSH to it. The bootstrap account must have a password or SSH key accepted by the node and must be able to run commands as root, either directly or through sudo. Confirm that the node can resolve and reach the Chef server over HTTPS.
SSH bootstrap
From the workstation, run the documented SSH form:
knife bootstrap <ADDRESS> -U <USERNAME> --sudo --chef-license-key <LICENSE>Replace <ADDRESS> with the node’s IP address or FQDN, <USERNAME> with the SSH account, and <LICENSE> with the license argument required by the Chef Client and Workstation versions you selected. Current releases can change license or authentication flags, so check knife bootstrap --help and the matching Chef documentation before automating the command.
Knife connects over SSH, transfers the installation and first-boot materials, installs Chef Infra Client, configures the client identity, runs chef-client, and registers the node with the server over HTTPS. A successful first run normally leaves a node object and client identity visible to knife and in the Chef server administration interface.
WinRM alternative
SSH is the default transport. For a Windows target, use the WinRM bootstrap options documented for your Workstation release and provide credentials and the node address appropriate to that transport. The same trust and version requirements apply: the target must reach the Chef server, and the bootstrap account must be able to install and run the client.
Choose the bootstrap authentication flow
| Flow | Credential used for first registration | Important requirements | When to choose it |
|---|---|---|---|
| Organization-validator | Organization validator PEM | The validator key must be available to the bootstrap process; protect it like any other private key. | Traditional bootstrap where the organization validator creates the new node identity. |
| Validatorless | A user PEM with permission to create or manage the node | Remove the validator key reference from the bootstrap configuration and supply --node-name. |
Environments that deliberately avoid distributing a validator credential. |
Do not mix the two flows accidentally. If you select validatorless bootstrap, verify that no validator key is referenced in the generated first-boot configuration and that the node name is explicit. If you use the validator flow, limit access to the organization PEM and rotate the process if the key is exposed.
Certificates, trust, and clock errors
Chef clients authenticate to the server over HTTPS. For an on-premises or privately signed server certificate, the workstation can retrieve the server certificate with:
Free tools Windows power users keep installed
One-click scans. No signup required.
knife ssl fetchKnife may copy the resulting client.d files from the workstation to a node during bootstrap. Inspect the fetched certificate and confirm that the hostname used by clients matches the certificate identity. Do not disable TLS verification as a shortcut.
When a client reports certificate-not-yet-valid, certificate-expired, or signed-request failures, check NTP on the server, workstation, and node before replacing keys. A clock mismatch can make valid certificates and request signatures appear invalid.
Verify the completed installation
On the workstation
- Run
chef -vand record the Workstation and Client versions. - Run a harmless
knifequery, such as listing nodes, to verify the user key, organization URL, and server certificate. - Confirm that the expected organization and node names are shown, not a similarly named test organization.
On the server
- Confirm that
chef-server-ctl reconfigurecompleted without errors. - Check the server’s service status and logs with the administration commands supplied by your package version.
- Verify that TCP 443 is reachable from the workstation and every managed network segment that needs to converge.
- Back up the administrator and organization keys in a controlled secrets system, then test that the backup can actually be recovered.
On the node
- Check that Chef Infra Client is installed and that a first run completed.
- Verify that the node has a client identity and appears in the organization.
- Run a controlled second convergence after assigning a small, known-good policy or cookbook.
- Inspect the client log and exit status. A successful SSH connection alone does not prove that registration and convergence succeeded.
Version compatibility and release pinning
Chef’s current bootstrap documentation states that Chef Infra Client 19 or later requires Chef Workstation 26 or later. Pair the versions deliberately instead of installing whichever package happens to be newest on each machine. Record the server package, Workstation release, bundled Client release, operating-system version, and cookbook compatibility in a deployment note.
- Install the selected Workstation package and run
chef -v. - Confirm that the bundled Client meets the version requirement for your bootstrap documentation.
- Bootstrap one disposable or staging node.
- Run the cookbooks and policy revisions used by production.
- Only then repeat the process across the production node set.
Recheck the live compatibility documentation whenever you upgrade Workstation, Client, or the server package. A successful installation does not guarantee that every cookbook, custom resource, or integration supports the new client line.
Common failures and recovery paths
The server hostname does not resolve
Fix DNS or the node’s resolver configuration before continuing. Test the FQDN from the workstation and target node, and make sure the name in chef_server_url is identical to the name clients use.
Port 443 is blocked
Check the VPS provider firewall, Ubuntu firewall, security groups, and any network ACL between the node and server. A server that is reachable by SSH from your laptop can still be unreachable from a private client subnet.
dpkg fails during package installation
Read the dependency error, install the missing Ubuntu packages through the supported package manager, and rerun dpkg -i. Verify architecture before downloading again; an ARM package will not install on the x86_64 server target documented here.
chef-server-ctl reconfigure never completes
Check free disk space, hostname resolution, time synchronization, and the service logs. Allow the operation several minutes because Chef initializes multiple components. Do not repeatedly terminate it while services are being configured.
Bootstrap authenticates over SSH but cannot register
Separate the two paths: first verify SSH and sudo on the node, then verify HTTPS from the node to the Chef server. Next check the organization URL, user or validator PEM permissions, server certificate trust, and clock synchronization. If using validatorless mode, ensure the validator reference is removed and --node-name is present.
The node appears with an unexpected name
Inspect the first-boot configuration and the bootstrap command. Destroy or rename the unintended node only after confirming that no production policy is attached to it, then rerun bootstrap with an explicit node name.
Lab installation versus production deployment
Single-server lab or proof of concept
A standalone VPS is practical for learning, cookbook development, and a short-lived evaluation. Use a real FQDN, NTP, restricted SSH, backups, and a disposable staging node even in a lab so that the bootstrap path resembles the final environment.
Production considerations
Production requires more than a successful package install. Document DNS ownership, firewall rules, backup and restore procedures, monitoring, key custody, upgrade windows, node enrollment, and retention. Validate restores rather than assuming a provider snapshot is usable. Separate workstation credentials from server administration access and remove unused keys promptly.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Plan a replacement or migration checkpoint
Because the server product has an announced retirement within the current planning horizon, approve a migration or replacement review before expanding the installation. Inventory cookbooks, custom resources, policy files, node identities, secrets, compliance checks, and integrations so that you know what must move and what can be retired. Keep the deployment reproducible while that decision is pending; do not let an undocumented one-off VPS become the only copy of your configuration.
Quick Recap
Operational checklist
- Server is x86_64 Ubuntu 20.04 or 22.04 and has a resolvable FQDN.
- NTP is working on server, workstation, and nodes.
- Required HTTP/HTTPS paths, especially TCP 80 and 443, are allowed by every firewall layer.
- Chef Infra Server package installation and
chef-server-ctl reconfigurecompleted successfully. - Administrator and organization PEM files were created, backed up securely, and assigned restrictive permissions.
- Workstation package installation succeeded and
chef -voutput was recorded. knife.rbpoints to the correct organization URL and FQDN.- Bootstrap transport, SSH or WinRM credentials, sudo rights, and node reachability were tested.
- Validator or validatorless authentication was selected intentionally.
- Client and Workstation versions satisfy the documented compatibility pairing.
- A staging bootstrap and controlled convergence succeeded before production enrollment.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
