How do I include my internal CA certificate to validate SSL exchanges in Chef?
There's a couple of way to achieve the result:


Chef has a trusted_dir to allow adding certificate to the trusted list. the documentation has a lot of details about it. Adding your CA certificate to this directory would solve the problem. knife has it also in a slightly different path as per it's own documentation
Chef use its own CA certiticate list in /opt/chef/embedded/ssl/certs/cacert.pem. 
You can add your CA certificate at end of this list to trust it. 


The second option has an advantage of allowing you to export the environment variable SSL_CERT_FILE pointing to chef cacert.pem to allow most of the tools using openssl library to know your CA certificate.

For the case of a self signed certificate on the chef server (or another server used as target in a recipe), knife ssl_fetch would allow all knife commands to work.

To add the server certificate to the cacert.pem for the case 2. above, you can use the following command:

# For a self signed CA certiticate
openssl s_client -showcerts -connect &lt;YOUR_CHEF_SERVER&gt;:443 &lt;/dev/null 2&gt;/dev/null|openssl x509 -outform PEM &gt;&gt; /opt/chefdk/embedded/ssl/certs/cacert.pem

# For an internal CA signed certificate:
openssl s_client -showcerts -verify 5 -connect &lt;YOUR_CHEF_SERVER&gt;:443 &lt;/dev/null 2&gt;/dev/null | awk '/BEGIN/,/END/{if(/BEGIN/){a++}; certs[a]=(certs[a] "\n" $0)}; END {print certs[a]}' &gt;&gt; /opt/chefdk/embedded/ssl/certs/cacert.pem

export SSL_CERT_FILE=/opt/chefdk/embedded/ssl/certs/cacert.pem


The openssl command is included in chef-dk, so this can be done under windows also.  Change the path to c:\opscode\ instead of /opt/. To export the environment variable use set SSL_CERT_FILE=... (with /P to add it permanently to your environment) in your command.