Repository: chef/automate
Pull request #8037 (2023-07-05 10:33:46)

Fix/resolution msg
### :nut_and_bolt: Description: What code changed, and why?

<!-- /!\ Please ensure that you are NOT disclosing any customer information without their consent /!\ -->

### :chains: Related Resources

### :+1: Definition of Done

### :athletic_shoe: How to Build and Test the Change

### :white_check_mark: Checklist

**All PRs** must tick these:

- [ ] I have read the [CONTRIBUTING document](https://github.com/chef/automate/blob/master/CONTRIBUTING.md).
- [ ] All commits signed-off for the [Developer Certification of Origin](https://github.com/chef/chef/blob/master/CONTRIBUTING.md#developer-certification-of-origin-dco).

With occasional exceptions, all PRs **from Progress employees** must tick these:

- [ ] Is the code clear? *(complicated code or lots of comments--subdivide and use well-named methods, meaningful variable names, etc.)*
- [ ] Consistency checked? *(user notifications, user prompts, visual patterns, code patterns, variable names)*
- [ ] Repeated code blocks eliminated? *(adapt and reuse existing components, blocks, functions, etc.)*
- [ ] Spelling, grammar, typos checked? *(at a minimum use `make spell` in any component directory)*
- [ ] Code well-formatted? *(indents, line breaks, etc. improve rather than hinder readability)*

All PRs **from Progress employees** should tick these if appropriate:

- [ ] Tests added/updated? (all new code needs new tests)
- [ ] Docs added/updated? (all customer-facing changes)

*Please add a note next to any checkbox above if you are NOT ticking it.*

### :camera: Screenshots, if applicable

https://github.com/chef/automate/assets/36985548/2b0f17fd-adfa-4701-ab76-cf20bcee75ef

https://github.com/chef/automate/assets/36985548/421486cc-d3f8-464f-a143-34728ec1b61e

https://github.com/chef/automate/assets/36985548/f3b122b7-1d02-40a6-97c1-cf8f31f38a40








netlify[bot]: ### <span aria-hidden="true">👷</span> Deploy Preview for *chef-automate* processing.


|  Name | Link |
|:-:|------------------------|
|<span aria-hidden="true">🔨</span> Latest commit | 9103478b35d94fa0ba5002085fdf195d768a44e9 |
|<span aria-hidden="true">🔍</span> Latest deploy log | https://app.netlify.com/sites/chef-automate/deploys/64a5470c8472030008447c3c |
sonarqube-for-infrastructure-prod[bot]: **SonarQube Quality Gate**

[![Quality Gate passed](https://raw.githubusercontent.com/SonarSource/sonarqube-static-resources/master/v97/checks/QualityGateBadge/passed-16px.png 'Quality Gate passed')](https://sonar.progress.com/dashboard?id=chef_automate_AYeOVEbqJ4YHsO5MtKWC&pullRequest=8037)

[![Bug](https://raw.githubusercontent.com/SonarSource/sonarqube-static-resources/master/v97/common/bug-16px.png 'Bug')](https://sonar.progress.com/project/issues?id=chef_automate_AYeOVEbqJ4YHsO5MtKWC&pullRequest=8037&resolved=false&types=BUG) [![A](https://raw.githubusercontent.com/SonarSource/sonarqube-static-resources/master/v97/checks/RatingBadge/A-16px.png 'A')](https://sonar.progress.com/project/issues?id=chef_automate_AYeOVEbqJ4YHsO5MtKWC&pullRequest=8037&resolved=false&types=BUG) [0 Bugs](https://sonar.progress.com/project/issues?id=chef_automate_AYeOVEbqJ4YHsO5MtKWC&pullRequest=8037&resolved=false&types=BUG)  
[![Vulnerability](https://raw.githubusercontent.com/SonarSource/sonarqube-static-resources/master/v97/common/vulnerability-16px.png 'Vulnerability')](https://sonar.progress.com/project/issues?id=chef_automate_AYeOVEbqJ4YHsO5MtKWC&pullRequest=8037&resolved=false&types=VULNERABILITY) [![A](https://raw.githubusercontent.com/SonarSource/sonarqube-static-resources/master/v97/checks/RatingBadge/A-16px.png 'A')](https://sonar.progress.com/project/issues?id=chef_automate_AYeOVEbqJ4YHsO5MtKWC&pullRequest=8037&resolved=false&types=VULNERABILITY) [0 Vulnerabilities](https://sonar.progress.com/project/issues?id=chef_automate_AYeOVEbqJ4YHsO5MtKWC&pullRequest=8037&resolved=false&types=VULNERABILITY)  
[![Security Hotspot](https://raw.githubusercontent.com/SonarSource/sonarqube-static-resources/master/v97/common/security_hotspot-16px.png 'Security Hotspot')](https://sonar.progress.com/security_hotspots?id=chef_automate_AYeOVEbqJ4YHsO5MtKWC&pullRequest=8037) [![A](https://raw.githubusercontent.com/SonarSource/sonarqube-static-resources/master/v97/checks/RatingBadge/A-16px.png 'A')](https://sonar.progress.com/security_hotspots?id=chef_automate_AYeOVEbqJ4YHsO5MtKWC&pullRequest=8037) [0 Security Hotspots](https://sonar.progress.com/security_hotspots?id=chef_automate_AYeOVEbqJ4YHsO5MtKWC&pullRequest=8037)  
[![Code Smell](https://raw.githubusercontent.com/SonarSource/sonarqube-static-resources/master/v97/common/code_smell-16px.png 'Code Smell')](https://sonar.progress.com/project/issues?id=chef_automate_AYeOVEbqJ4YHsO5MtKWC&pullRequest=8037&resolved=false&types=CODE_SMELL) [![A](https://raw.githubusercontent.com/SonarSource/sonarqube-static-resources/master/v97/checks/RatingBadge/A-16px.png 'A')](https://sonar.progress.com/project/issues?id=chef_automate_AYeOVEbqJ4YHsO5MtKWC&pullRequest=8037&resolved=false&types=CODE_SMELL) [0 Code Smells](https://sonar.progress.com/project/issues?id=chef_automate_AYeOVEbqJ4YHsO5MtKWC&pullRequest=8037&resolved=false&types=CODE_SMELL)

[![No Coverage information](https://raw.githubusercontent.com/SonarSource/sonarqube-static-resources/master/v97/checks/CoverageChart/NoCoverageInfo-16px.png 'No Coverage information')](https://sonar.progress.com/component_measures?id=chef_automate_AYeOVEbqJ4YHsO5MtKWC&pullRequest=8037&metric=coverage&view=list) No Coverage information  
[![No Duplication information](https://raw.githubusercontent.com/SonarSource/sonarqube-static-resources/master/v97/checks/Duplications/NoDuplicationInfo-16px.png 'No Duplication information')](https://sonar.progress.com/component_measures?id=chef_automate_AYeOVEbqJ4YHsO5MtKWC&pullRequest=8037&metric=duplicated_lines_density&view=list) No Duplication information



Patch:
diff --git a/VERSION b/VERSION
index 0012ba224..37573c7a4 100644
--- a/VERSION
+++ b/VERSION
@@ -1,1 +1,1 @@
-4.7.151
\ No newline at end of file
+4.7.158
\ No newline at end of file
diff --git a/components/automate-cli/cmd/chef-automate/deployedConfig.go b/components/automate-cli/cmd/chef-automate/deployedConfig.go
index ce04b5efa..95005e18c 100644
--- a/components/automate-cli/cmd/chef-automate/deployedConfig.go
+++ b/components/automate-cli/cmd/chef-automate/deployedConfig.go
@@ -99,6 +99,8 @@ func CopyExistingInfra(existingInfraConfig *ExistingInfraConfigToml) *config.HaD
 		},
 		ChefServer: &config.ChefServerSettings{
 			Config: &config.ConfigChefServerSettings{
+				ChefServerFqdn:    existingInfraChefServerSettings.Fqdn,
+				FqdnRootCA:        existingInfraChefServerSettings.RootCA,
 				EnableCustomCerts: existingInfraChefServerSettings.EnableCustomCerts,
 				InstanceCount:     existingInfraChefServerSettings.InstanceCount,
 				PrivateKey:        existingInfraChefServerSettings.PrivateKey,
@@ -227,6 +229,8 @@ func CopyAws(awsConfig *AwsConfigToml) *config.HaDeployConfig {
 		},
 		ChefServer: &config.ChefServerSettings{
 			Config: &config.ConfigChefServerSettings{
+				ChefServerFqdn:    awsConfigChefServerSettings.Fqdn,
+				FqdnRootCA:        awsConfigChefServerSettings.RootCA,
 				EnableCustomCerts: awsConfigChefServerSettings.EnableCustomCerts,
 				InstanceCount:     awsConfigChefServerSettings.InstanceCount,
 				PrivateKey:        awsConfigChefServerSettings.PrivateKey,
diff --git a/components/automate-cli/cmd/chef-automate/pullAndGenerateConfig.go b/components/automate-cli/cmd/chef-automate/pullAndGenerateConfig.go
index f017f9861..bd2d5281a 100644
--- a/components/automate-cli/cmd/chef-automate/pullAndGenerateConfig.go
+++ b/components/automate-cli/cmd/chef-automate/pullAndGenerateConfig.go
@@ -2,6 +2,7 @@ package main
 
 import (
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io/ioutil"
 	"net/url"
@@ -35,63 +36,62 @@ type ObjectStorageConfig struct {
 }
 
 type HAAwsAutoTfvars struct {
-	AwsProfile                         string      `json:"aws_profile"`
-	AwsRegion                          string      `json:"aws_region"`
-	Endpoint                           string      `json:"endpoint"`
-	SecretKey                          string      `json:"secret_key"`
-	AccessKey                          string      `json:"access_key"`
-	BucketName                         string      `json:"bucket_name"`
-	Architecture                       string      `json:"architecture"`
-	SshKeyFileName                     string      `json:"aws_ssh_key_pair_name"`
-	AwsVpcId                           string      `json:"aws_vpc_id"`
-	AmiID                              string      `json:"aws_ami_id"`
-	AwsCidrBlockAddr                   string      `json:"aws_cidr_block_addr"`
-	PrivateCustomSubnets               []string    `json:"private_custom_subnets"`
-	PublicCustomSubnets                []string    `json:"public_custom_subnets"`
-	AutomateLbCertificateArn           string      `json:"automate_lb_certificate_arn"`
-	ChefServerLbCertificateArn         string      `json:"chef_server_lb_certificate_arn"`
-	AwsManagedRdsPostgresqlCertificate string      `json:"managed_rds_certificate"`
-	ManagedRdsDbuserPassword           string      `json:"managed_rds_dbuser_password"`
-	ManagedRdsDbuserUsername           string      `json:"managed_rds_dbuser_username"`
-	ManagedRdsSuperuserPassword        string      `json:"managed_rds_superuser_password"`
-	ManagedRdsSuperuserUsername        string      `json:"managed_rds_superuser_username"`
-	ManagedRdsInstanceUrl              string      `json:"managed_rds_instance_url"`
-	OsSnapshotUserAccessKeySecret      string      `json:"os_snapshot_user_access_key_secret"`
-	OsSnapshotUserAccessKeyId          string      `json:"os_snapshot_user_access_key_id"`
-	AwsOsSnapshotRoleArn               string      `json:"aws_os_snapshot_role_arn"`
-	ManagedOpensearchCertificate       string      `json:"managed_opensearch_certificate"`
-	ManagedOpensearchUserPassword      string      `json:"managed_opensearch_user_password"`
-	ManagedOpensearchUsername          string      `json:"managed_opensearch_username"`
-	ManagedOpensearchDomainUrl         string      `json:"managed_opensearch_domain_url"`
-	ManagedOpensearchDomainName        string      `json:"managed_opensearch_domain_name"`
-	AwsSetupManagedServices            bool        `json:"setup_managed_services"`
-	ExistingPostgresqlPrivateIps       []string    `json:"existing_postgresql_private_ips"`
-	ExistingOpensearchPrivateIps       []string    `json:"existing_opensearch_private_ips"`
-	ExistingChefServerPrivateIps       []string    `json:"existing_chef_server_private_ips"`
-	ExistingAutomatePrivateIps         []string    `json:"existing_automate_private_ips"`
-	BackupConfigS3                     string      `json:"backup_config_s3"`
-	BackupConfigEFS                    string      `json:"backup_config_efs"`
-	LBAccessLogs                       string      `json:"lb_access_logs"`
-	DeleteOnTermination                string      `json:"delete_on_termination"`
-	AutomateServerInstanceType         string      `json:"automate_server_instance_type"`
-	AutomateEbsVolumeIops              string      `json:"automate_ebs_volume_iops"`
-	AutomateEbsVolumeSize              string      `json:"automate_ebs_volume_size"`
-	AutomateEbsVolumeType              string      `json:"automate_ebs_volume_type"`
-	ChefServerInstanceType             string      `json:"chef_server_instance_type"`
-	ChefEbsVolumeIops                  string      `json:"chef_ebs_volume_iops"`
-	ChefEbsVolumeSize                  string      `json:"chef_ebs_volume_size"`
-	ChefEbsVolumeType                  string      `json:"chef_ebs_volume_type"`
-	OpensearchServerInstanceType       string      `json:"opensearch_server_instance_type"`
-	OpensearchEbsVolumeIops            string      `json:"opensearch_ebs_volume_iops"`
-	OpensearchEbsVolumeSize            string      `json:"opensearch_ebs_volume_size"`
-	OpensearchEbsVolumeType            string      `json:"opensearch_ebs_volume_type"`
-	PostgresqlServerInstanceType       string      `json:"postgresql_server_instance_type"`
-	PostgresqlEbsVolumeIops            string      `json:"postgresql_ebs_volume_iops"`
-	PostgresqlEbsVolumeSize            string      `json:"postgresql_ebs_volume_size"`
-	PostgresqlEbsVolumeType            string      `json:"postgresql_ebs_volume_type"`
+	AwsProfile                         string   `json:"aws_profile"`
+	AwsRegion                          string   `json:"aws_region"`
+	Endpoint                           string   `json:"endpoint"`
+	SecretKey                          string   `json:"secret_key"`
+	AccessKey                          string   `json:"access_key"`
+	BucketName                         string   `json:"bucket_name"`
+	Architecture                       string   `json:"architecture"`
+	SshKeyFileName                     string   `json:"aws_ssh_key_pair_name"`
+	AwsVpcId                           string   `json:"aws_vpc_id"`
+	AmiID                              string   `json:"aws_ami_id"`
+	AwsCidrBlockAddr                   string   `json:"aws_cidr_block_addr"`
+	PrivateCustomSubnets               []string `json:"private_custom_subnets"`
+	PublicCustomSubnets                []string `json:"public_custom_subnets"`
+	AutomateLbCertificateArn           string   `json:"automate_lb_certificate_arn"`
+	ChefServerLbCertificateArn         string   `json:"chef_server_lb_certificate_arn"`
+	AwsManagedRdsPostgresqlCertificate string   `json:"managed_rds_certificate"`
+	ManagedRdsDbuserPassword           string   `json:"managed_rds_dbuser_password"`
+	ManagedRdsDbuserUsername           string   `json:"managed_rds_dbuser_username"`
+	ManagedRdsSuperuserPassword        string   `json:"managed_rds_superuser_password"`
+	ManagedRdsSuperuserUsername        string   `json:"managed_rds_superuser_username"`
+	ManagedRdsInstanceUrl              string   `json:"managed_rds_instance_url"`
+	OsSnapshotUserAccessKeySecret      string   `json:"os_snapshot_user_access_key_secret"`
+	OsSnapshotUserAccessKeyId          string   `json:"os_snapshot_user_access_key_id"`
+	AwsOsSnapshotRoleArn               string   `json:"aws_os_snapshot_role_arn"`
+	ManagedOpensearchCertificate       string   `json:"managed_opensearch_certificate"`
+	ManagedOpensearchUserPassword      string   `json:"managed_opensearch_user_password"`
+	ManagedOpensearchUsername          string   `json:"managed_opensearch_username"`
+	ManagedOpensearchDomainUrl         string   `json:"managed_opensearch_domain_url"`
+	ManagedOpensearchDomainName        string   `json:"managed_opensearch_domain_name"`
+	AwsSetupManagedServices            bool     `json:"setup_managed_services"`
+	ExistingPostgresqlPrivateIps       []string `json:"existing_postgresql_private_ips"`
+	ExistingOpensearchPrivateIps       []string `json:"existing_opensearch_private_ips"`
+	ExistingChefServerPrivateIps       []string `json:"existing_chef_server_private_ips"`
+	ExistingAutomatePrivateIps         []string `json:"existing_automate_private_ips"`
+	BackupConfigS3                     string   `json:"backup_config_s3"`
+	BackupConfigEFS                    string   `json:"backup_config_efs"`
+	LBAccessLogs                       string   `json:"lb_access_logs"`
+	DeleteOnTermination                string   `json:"delete_on_termination"`
+	AutomateServerInstanceType         string   `json:"automate_server_instance_type"`
+	AutomateEbsVolumeIops              string   `json:"automate_ebs_volume_iops"`
+	AutomateEbsVolumeSize              string   `json:"automate_ebs_volume_size"`
+	AutomateEbsVolumeType              string   `json:"automate_ebs_volume_type"`
+	ChefServerInstanceType             string   `json:"chef_server_instance_type"`
+	ChefEbsVolumeIops                  string   `json:"chef_ebs_volume_iops"`
+	ChefEbsVolumeSize                  string   `json:"chef_ebs_volume_size"`
+	ChefEbsVolumeType                  string   `json:"chef_ebs_volume_type"`
+	OpensearchServerInstanceType       string   `json:"opensearch_server_instance_type"`
+	OpensearchEbsVolumeIops            string   `json:"opensearch_ebs_volume_iops"`
+	OpensearchEbsVolumeSize            string   `json:"opensearch_ebs_volume_size"`
+	OpensearchEbsVolumeType            string   `json:"opensearch_ebs_volume_type"`
+	PostgresqlServerInstanceType       string   `json:"postgresql_server_instance_type"`
+	PostgresqlEbsVolumeIops            string   `json:"postgresql_ebs_volume_iops"`
+	PostgresqlEbsVolumeSize            string   `json:"postgresql_ebs_volume_size"`
+	PostgresqlEbsVolumeType            string   `json:"postgresql_ebs_volume_type"`
 }
 
-
 type HATfvars struct {
 	Region                        string      `json:"region"`
 	Endpoint                      string      `json:"endpoint"`
@@ -434,6 +434,12 @@ func (p *PullConfigsImpl) fetchInfraConfig() (*ExistingInfraConfigToml, error) {
 		sharedConfigToml.Automate.Config.Fqdn = a2Fqdn
 	}
 
+	root_ca, fqdn, err := getChefServerFqdnAndLBRootCA(EXISTING_INFRA_MODE)
+	if err != nil {
+		return nil, status.Wrap(err, status.ConfigError, "unable to fetch Chef Server FQDN and LB_ROOT_CA")
+	}
+	sharedConfigToml.ChefServer.Config.RootCA, sharedConfigToml.ChefServer.Config.Fqdn = root_ca, fqdn
+
 	return sharedConfigToml, nil
 }
 
@@ -501,6 +507,23 @@ func setExternalPGDetails(instanceUrl, superUserName, superUserPassword, dBUserN
 	}
 }
 
+func getChefServerFqdnAndLBRootCA(deploymentType string) (string, string, error) {
+	if deploymentType == EXISTING_INFRA_MODE {
+		ExistingInfraConfig, err := getExistingInfraConfig(filepath.Join(initConfigHabA2HAPathFlag.a2haDirPath, "config.toml"))
+		if err != nil {
+			return "", "", err
+		}
+		return ExistingInfraConfig.ChefServer.Config.RootCA, ExistingInfraConfig.ChefServer.Config.Fqdn, nil
+	} else if deploymentType == AWS_MODE {
+		AWSConfig, err := getAwsConfig(filepath.Join(initConfigHabA2HAPathFlag.a2haDirPath, "config.toml"))
+		if err != nil {
+			return "", "", err
+		}
+		return AWSConfig.ChefServer.Config.RootCA, AWSConfig.ChefServer.Config.Fqdn, nil
+	}
+	return "", "", errors.New("deployment type unknown")
+}
+
 func (p *PullConfigsImpl) getOsCertsByIp(osConfigMap map[string]*ConfigKeys) []CertByIP {
 	var osCerts []CertByIP
 	nodesDnMap := make(map[string]bool)
@@ -741,6 +764,12 @@ func (p *PullConfigsImpl) fetchAwsConfig() (*AwsConfigToml, error) {
 		sharedConfigToml.Aws.Config.OsUserAccessKeySecret = objStorageConfig.secrectKey
 	}
 
+	root_ca, fqdn, err := getChefServerFqdnAndLBRootCA(AWS_MODE)
+	if err != nil {
+		return nil, status.Wrap(err, status.ConfigError, "unable to fetch Chef Server FQDN and LB_ROOT_CA")
+	}
+	sharedConfigToml.ChefServer.Config.RootCA, sharedConfigToml.ChefServer.Config.Fqdn = root_ca, fqdn
+
 	return sharedConfigToml, nil
 }
 
diff --git a/components/automate-cli/cmd/chef-automate/verify.go b/components/automate-cli/cmd/chef-automate/verify.go
index c739f2927..db83b33d6 100644
--- a/components/automate-cli/cmd/chef-automate/verify.go
+++ b/components/automate-cli/cmd/chef-automate/verify.go
@@ -454,7 +454,7 @@ func (v *verifyCmdFlow) runVerifyServiceForRemote(batchCheckConfig models.Config
 	}
 
 	if len(hostIPsToCopyLatestCLI) > 0 {
-		v.Writer.Printf("Copying CLI to the follwoing IPs: %v", hostIPsToCopyLatestCLI)
+		v.Writer.Printf("Copying CLI to the follwoing IPs: %v\n", hostIPsToCopyLatestCLI)
 		// Copying Latest CLI binary to remote nodes
 		err = v.copyCLIOnRemoteNodes(destFileName, sshConfig, hostIPsToCopyLatestCLI)
 		if err != nil {
diff --git a/components/automate-cli/pkg/verifyserver/constants/fqdn.go b/components/automate-cli/pkg/verifyserver/constants/fqdn.go
index 7e1c5492b..37a868e82 100644
--- a/components/automate-cli/pkg/verifyserver/constants/fqdn.go
+++ b/components/automate-cli/pkg/verifyserver/constants/fqdn.go
@@ -3,7 +3,7 @@ package constants
 const (
 	FQDN_TITLE                     = "FQDN is reachable"
 	FQDN_ERROR_MESSAGE             = "FQDN is not reachable"
-	FQDN_RESOLUTION_MESSAGE        = "Ensure your Port 443 is open and load balancer is able to reach to the machine on port 443. Review security group or firewall settings."
+	FQDN_RESOLUTION_MESSAGE        = "Ensure FQDN is reachable and mapped to load balancer.Also, ensure your Port 443 is open and load balancer is able to reach to the machine on port 443. Review security group or firewall settings."
 	NODE_TITLE                     = "Nodes are reachable"
 	NODE_SUCCESS_MESSAGE           = "All nodes are reachable"
 	NODE_ERROR_MESSAGE             = "%v is not reachable"
diff --git a/components/automate-cli/pkg/verifyserver/server/api/v1/fqdn.go b/components/automate-cli/pkg/verifyserver/server/api/v1/fqdn.go
index cf813cfa3..7244abab2 100644
--- a/components/automate-cli/pkg/verifyserver/server/api/v1/fqdn.go
+++ b/components/automate-cli/pkg/verifyserver/server/api/v1/fqdn.go
@@ -18,9 +18,9 @@ func (h *Handler) CheckFqdn(c *fiber.Ctx) error {
 		return fiber.NewError(http.StatusBadRequest, "Invalid Body Request")
 	}
 
-	if strings.TrimSpace(req.Fqdn) == "" || strings.TrimSpace(req.RootCert) == "" || len(req.Nodes) == 0 {
-		h.Logger.Error("fqdn, root_cert and nodes can't be empty.")
-		return fiber.NewError(http.StatusBadRequest, "fqdn, root_cert and nodes can't be empty, Please provide all the required fields.")
+	if strings.TrimSpace(req.Fqdn) == "" || len(req.Nodes) == 0 {
+		h.Logger.Error("fqdn, nodes can't be empty.")
+		return fiber.NewError(http.StatusBadRequest, "fqdn, nodes can't be empty, Please provide all the required fields.")
 	}
 
 	for _, ip := range req.Nodes {
diff --git a/components/automate-cli/pkg/verifyserver/services/batchcheckservice/trigger/nfsmountbackupchecktrigger/nfsmountbackupcheck.go b/components/automate-cli/pkg/verifyserver/services/batchcheckservice/trigger/nfsmountbackupchecktrigger/nfsmountbackupcheck.go
index 1dc91abae..593aa285b 100644
--- a/components/automate-cli/pkg/verifyserver/services/batchcheckservice/trigger/nfsmountbackupchecktrigger/nfsmountbackupcheck.go
+++ b/components/automate-cli/pkg/verifyserver/services/batchcheckservice/trigger/nfsmountbackupchecktrigger/nfsmountbackupcheck.go
@@ -2,8 +2,8 @@ package nfsmountbackupchecktrigger
 
 import (
 	"encoding/json"
-	"net/http"
 	"errors"
+	"net/http"
 
 	"github.com/chef/automate/components/automate-cli/pkg/verifyserver/constants"
 	"github.com/chef/automate/components/automate-cli/pkg/verifyserver/models"
@@ -34,7 +34,7 @@ func (nbc *NfsBackupConfigCheck) Run(config *models.Config) []models.CheckTrigge
 	if config.Hardware == nil {
 		return trigger.HardwareNil(constants.NFS_BACKUP_CONFIG, true, true, false)
 	}
-	if config.Backup.FileSystem == nil {
+	if config.Backup == nil || config.Backup.FileSystem == nil {
 		return trigger.ConstructNilResp(config, constants.NFS_BACKUP_CONFIG)
 	}
 	if isMountLocationEmpty(config.Backup) {
@@ -53,7 +53,7 @@ func (nbc *NfsBackupConfigCheck) Run(config *models.Config) []models.CheckTrigge
 	//Triggers only one API call for nfs mount API
 	nfsMountAPIResponse, err := nbc.triggerCheckForMountService(nfsMountReq)
 	if err != nil {
-		if nfsMountAPIResponse!= nil {
+		if nfsMountAPIResponse != nil {
 			return constructErrorResult(config, nfsMountAPIResponse.Error.Message, nfsMountAPIResponse.Error.Code)
 		}
 		return constructErrorResult(config, err.Error(), 500)
diff --git a/components/automate-cli/pkg/verifyserver/services/batchcheckservice/trigger/opensearchs3bucketaccesschecktrigger/opensearchs3bucketaccesscheck.go b/components/automate-cli/pkg/verifyserver/services/batchcheckservice/trigger/opensearchs3bucketaccesschecktrigger/opensearchs3bucketaccesscheck.go
index e3362b54e..4e03c8c65 100644
--- a/components/automate-cli/pkg/verifyserver/services/batchcheckservice/trigger/opensearchs3bucketaccesschecktrigger/opensearchs3bucketaccesscheck.go
+++ b/components/automate-cli/pkg/verifyserver/services/batchcheckservice/trigger/opensearchs3bucketaccesschecktrigger/opensearchs3bucketaccesscheck.go
@@ -8,8 +8,8 @@ import (
 	"github.com/chef/automate/components/automate-cli/pkg/verifyserver/models"
 	"github.com/chef/automate/components/automate-cli/pkg/verifyserver/services/batchcheckservice/trigger"
 	"github.com/chef/automate/components/automate-cli/pkg/verifyserver/utils/checkutils"
-	"github.com/chef/automate/lib/logger"
 	cfg "github.com/chef/automate/lib/config"
+	"github.com/chef/automate/lib/logger"
 )
 
 type OpensearchS3BucketAccessCheck struct {
@@ -27,7 +27,7 @@ func NewOpensearchS3BucketAccessCheck(log logger.Logger, port string) *Opensearc
 }
 
 func (osb *OpensearchS3BucketAccessCheck) Run(config *models.Config) []models.CheckTriggerResponse {
-	if config.ExternalOS == nil || config.Backup.ObjectStorage == nil {
+	if config.ExternalOS == nil || config.Backup == nil || config.Backup.ObjectStorage == nil {
 		return []models.CheckTriggerResponse{
 			trigger.SkippedTriggerCheckResp("-", constants.AWS_OPENSEARCH_S3_BUCKET_ACCESS, constants.OPENSEARCH),
 		}
diff --git a/components/automate-cli/pkg/verifyserver/services/batchcheckservice/trigger/s3backupchecktrigger/s3backupconfigchecktrigger.go b/components/automate-cli/pkg/verifyserver/services/batchcheckservice/trigger/s3backupchecktrigger/s3backupconfigchecktrigger.go
index 9174d0eed..4c27ea2e6 100644
--- a/components/automate-cli/pkg/verifyserver/services/batchcheckservice/trigger/s3backupchecktrigger/s3backupconfigchecktrigger.go
+++ b/components/automate-cli/pkg/verifyserver/services/batchcheckservice/trigger/s3backupchecktrigger/s3backupconfigchecktrigger.go
@@ -29,7 +29,7 @@ func (svc *S3BackupConfigCheck) Run(config *models.Config) []models.CheckTrigger
 		}
 	}
 
-	if config.Backup.ObjectStorage == nil {
+	if config.Backup == nil || config.Backup.ObjectStorage == nil {
 		return s3ConfigSkippedResponse(config, constants.S3_BACKUP_CONFIG)
 	}
 
diff --git a/components/automate-cli/pkg/verifyserver/services/certificatevalidation/certificatevalidation.go b/components/automate-cli/pkg/verifyserver/services/certificatevalidation/certificatevalidation.go
index 303791738..2b6047505 100644
--- a/components/automate-cli/pkg/verifyserver/services/certificatevalidation/certificatevalidation.go
+++ b/components/automate-cli/pkg/verifyserver/services/certificatevalidation/certificatevalidation.go
@@ -82,7 +82,7 @@ func (vc *ValidateCertificateService) validateCertificateExpiry(certificates map
 		remainingDays = int(certificate.NotAfter.Sub(currentTime).Hours() / 24)
 
 		if currentTime.After(certificate.NotAfter) {
-			vc.log.Debugf("%s certificate will expire in %d days", key, remainingDays)
+			vc.log.Debugf("%s certificate has expired already", key)
 			expiredCerts += key + ", "
 			continue
 		}
@@ -94,6 +94,7 @@ func (vc *ValidateCertificateService) validateCertificateExpiry(certificates map
 			aboutToExpireCerts += key + ", "
 			continue
 		}
+
 	}
 
 	if aboutToExpireCerts != "" {
@@ -105,7 +106,6 @@ func (vc *ValidateCertificateService) validateCertificateExpiry(certificates map
 		vc.log.Debug("Certificates are not expired")
 		return createCheck(constants.CERTIFICATE_EXPIRY_TITLE, true, constants.CERTIFICATE_VALID, "", "")
 	}
-
 	errorMessage := createErrorMessage(expiredCerts)
 	return createCheck(constants.CERTIFICATE_EXPIRY_TITLE, false, "", errorMessage, constants.CERTIFICATE_EXPIRY_RESOLUTION_MESSAGE)
 }
diff --git a/components/automate-cli/pkg/verifyserver/services/fqdnservice/fqdnservice.go b/components/automate-cli/pkg/verifyserver/services/fqdnservice/fqdnservice.go
index cf601f829..9e4f88394 100644
--- a/components/automate-cli/pkg/verifyserver/services/fqdnservice/fqdnservice.go
+++ b/components/automate-cli/pkg/verifyserver/services/fqdnservice/fqdnservice.go
@@ -39,12 +39,23 @@ func (fq *FqdnService) createClient(rootCert string) *http.Client {
 	caCertPool := x509.NewCertPool()
 	caCertPool.AppendCertsFromPEM([]byte(rootCert))
 
+	// If root-ca is passed then we are using it, otherwise we are making insecure call
+	var tlsConfig = new(tls.Config)
+	if rootCert == "" {
+		tlsConfig = &tls.Config{
+			InsecureSkipVerify: true,
+			MinVersion:         tls.VersionTLS12,
+		}
+	} else {
+		tlsConfig = &tls.Config{
+			RootCAs:    caCertPool,
+			MinVersion: tls.VersionTLS12,
+		}
+	}
+
 	client := &http.Client{
 		Transport: &http.Transport{
-			TLSClientConfig: &tls.Config{
-				RootCAs:    caCertPool,
-				MinVersion: tls.VersionTLS12,
-			},
+			TLSClientConfig: tlsConfig,
 		},
 		Timeout: fq.timeout * time.Second,
 	}
@@ -241,7 +252,7 @@ func (fq *FqdnService) CheckFqdnReachability(req models.FqdnRequest, port string
 	certificateValidityCheck := true
 	fqdnReachabilityCheck := true
 
-	if !req.IsAfterDeployment {
+	if !req.IsAfterDeployment && strings.TrimSpace(req.RootCert) != "" {
 		check := fq.validateCertificate(req.RootCert)
 		certificateValidityCheck = check.Passed
 		response.Checks = append(response.Checks, check)
diff --git a/lib/config/hadeployconfigverify.go b/lib/config/hadeployconfigverify.go
index a19bbb86b..5094b6e73 100644
--- a/lib/config/hadeployconfigverify.go
+++ b/lib/config/hadeployconfigverify.go
@@ -127,6 +127,10 @@ func (c *HaDeployConfig) verifyConfigInitials(configInitials *ConfigInitials) er
 func (c *HaDeployConfig) validateExistingInfraBackupConfig() error {
 	// validate existing infra backup config
 	backupConfig := c.Architecture.ExistingInfra.BackupConfig
+	// backup config is optional
+	if backupConfig == "" {
+		return nil
+	}
 
 	if err := validateRequiredString(backupConfig, "backup_config", "object_storage", "file_system"); err != nil {
 		return err
@@ -148,6 +152,10 @@ func (c *HaDeployConfig) validateExistingInfraBackupConfig() error {
 }
 
 func (c *HaDeployConfig) validateAwsBackupConfig() error {
+	// backup config is optional
+	if c.Architecture.Aws.BackupConfig == "" {
+		return nil
+	}
 	// validate aws backup config
 	if err := checkForValidS3Bucket(c); err != nil {
 		return err
@@ -205,8 +213,10 @@ func (c *HaDeployConfig) verifyAutomateSettings() error {
 	if err := validatePort(automateSettings.TeamsPort, "teams_port", false); err != nil {
 		errorList.PushBack(err)
 	}
-	if err := validateFqdnRootCA(automateSettings.FqdnRootCA, AUTOMATE); err != nil {
-		errorList.PushBack(err)
+	if automateSettings.FqdnRootCA != "" {
+		if err := validateFqdnRootCA(automateSettings.FqdnRootCA, AUTOMATE); err != nil {
+			errorList.PushBack(err)
+		}
 	}
 	if automateSettings.EnableCustomCerts {
 		if err := validateAutomateCerts(c); err != nil {
diff --git a/lib/config/helper.go b/lib/config/helper.go
index 9c2268210..4e084d00a 100644
--- a/lib/config/helper.go
+++ b/lib/config/helper.go
@@ -59,8 +59,13 @@ func validateRequiredPathField(value string, fieldName string) error {
 	if len(value) == 0 {
 		return fmt.Errorf(INVALID_EMPTY_VALUE, fieldName)
 	}
-	if _, err := os.Stat(value); err != nil {
-		return fmt.Errorf("invalid %s: %s (%v)", fieldName, value, err)
+	home := os.Getenv("HOME")
+	path := value
+	if strings.Index(path, "~") == 0 {
+		path = strings.Replace(path, "~", home, 1)
+	}
+	if _, err := os.Stat(path); err != nil {
+		return fmt.Errorf("invalid %s: %s no such file or directory", fieldName, value)
 	}
 	return nil
 }


Test patch:
diff --git a/components/automate-cli/pkg/verifyserver/models/testdata/HaAwsManaged.toml b/components/automate-cli/pkg/verifyserver/models/testdata/HaAwsManaged.toml
index 8b8ee59ad..d37dafaeb 100644
--- a/components/automate-cli/pkg/verifyserver/models/testdata/HaAwsManaged.toml
+++ b/components/automate-cli/pkg/verifyserver/models/testdata/HaAwsManaged.toml
@@ -526,10 +526,10 @@ opensearch_server_instance_type = "m5.large"
 postgresql_server_instance_type = "m5.large"
 
 # eg: automate_lb_certificate_arn = "arn:aws:acm...."
-automate_lb_certificate_arn = "arn:aws:acm:ca-central-1:112758395563:certificate/1754e15c-5834-44b0-82a7-0508c3155601"
+automate_lb_certificate_arn = "arn:aws:acm...."
 
 # eg: chef_server_lb_certificate_arn = "arn:aws:acm...."
-chef_server_lb_certificate_arn = "arn:aws:acm:ca-central-1:112758395563:certificate/1754e15c-5834-44b0-82a7-0508c3155601"
+chef_server_lb_certificate_arn = "arn:aws:acm...."
 
 # eg: automate_ebs_volume_iops = "100"
 automate_ebs_volume_iops = "100"
diff --git a/components/automate-cli/pkg/verifyserver/server/api/v1/fqdn_test.go b/components/automate-cli/pkg/verifyserver/server/api/v1/fqdn_test.go
index 1956188e8..b8ab1c85c 100644
--- a/components/automate-cli/pkg/verifyserver/server/api/v1/fqdn_test.go
+++ b/components/automate-cli/pkg/verifyserver/server/api/v1/fqdn_test.go
@@ -141,7 +141,7 @@ func TestCheckFqdn(t *testing.T) {
 				"result": null,
 				"error": {
 					"code": 400,
-					"message": "fqdn, root_cert and nodes can't be empty, Please provide all the required fields."
+					"message": "fqdn, nodes can't be empty, Please provide all the required fields."
 				}
 			}`,
 		},
diff --git a/components/automate-cli/pkg/verifyserver/services/batchcheckservice/trigger/fqdnchecktrigger/fqdncheck_test.go b/components/automate-cli/pkg/verifyserver/services/batchcheckservice/trigger/fqdnchecktrigger/fqdncheck_test.go
index ce4b729c6..56456b3c3 100644
--- a/components/automate-cli/pkg/verifyserver/services/batchcheckservice/trigger/fqdnchecktrigger/fqdncheck_test.go
+++ b/components/automate-cli/pkg/verifyserver/services/batchcheckservice/trigger/fqdnchecktrigger/fqdncheck_test.go
@@ -77,7 +77,7 @@ const (
 			  "passed": false,
 			  "success_msg": "",
 			  "error_msg": "FQDN is not reachable",
-			  "resolution_msg": "Ensure your Port 443 is open and load balancer is able to reach to the machine on port 443. Review security group or firewall settings."
+			  "resolution_msg": "Ensure FQDN is reachable and mapped to load balancer.Also, ensure your Port 443 is open and load balancer is able to reach to the machine on port 443. Review security group or firewall settings."
 			},
 			{
 			  "title": "Nodes are reachable",
@@ -179,7 +179,7 @@ const (
 						"passed": false,
 						"success_msg": "",
 						"error_msg": "FQDN is not reachable",
-						"resolution_msg": "Ensure your Port 443 is open and load balancer is able to reach to the machine on port 443. Review security group or firewall settings."
+						"resolution_msg": "Ensure FQDN is reachable and mapped to load balancer.Also, ensure your Port 443 is open and load balancer is able to reach to the machine on port 443. Review security group or firewall settings."
 					},
 					{
 						"title": "Nodes are reachable",
@@ -212,7 +212,7 @@ const (
 						"passed": false,
 						"success_msg": "",
 						"error_msg": "FQDN is not reachable",
-						"resolution_msg": "Ensure your Port 443 is open and load balancer is able to reach to the machine on port 443. Review security group or firewall settings."
+						"resolution_msg": "Ensure FQDN is reachable and mapped to load balancer.Also, ensure your Port 443 is open and load balancer is able to reach to the machine on port 443. Review security group or firewall settings."
 					},
 					{
 						"title": "Nodes are reachable",
@@ -246,7 +246,7 @@ const (
 						"passed": false,
 						"success_msg": "",
 						"error_msg": "FQDN is not reachable",
-						"resolution_msg": "Ensure your Port 443 is open and load balancer is able to reach to the machine on port 443. Review security group or firewall settings."
+						"resolution_msg": "Ensure FQDN is reachable and mapped to load balancer.Also, ensure your Port 443 is open and load balancer is able to reach to the machine on port 443. Review security group or firewall settings."
 					},
 					{
 						"title": "Nodes are reachable",
@@ -277,7 +277,7 @@ const (
 						"passed": false,
 						"success_msg": "",
 						"error_msg": "FQDN is not reachable",
-						"resolution_msg": "Ensure your Port 443 is open and load balancer is able to reach to the machine on port 443. Review security group or firewall settings."
+						"resolution_msg": "Ensure FQDN is reachable and mapped to load balancer.Also, ensure your Port 443 is open and load balancer is able to reach to the machine on port 443. Review security group or firewall settings."
 					},
 					{
 						"title": "Nodes are reachable",
@@ -410,10 +410,10 @@ func TestFqdnCheck_Run(t *testing.T) {
 					APIToken:    token,
 				},
 			},
-			isPassed:   false,
-			response:   "Internal Server Error",
-			httpStatus: http.StatusInternalServerError,
-			isError:    true,
+			isPassed:               false,
+			response:               "Internal Server Error",
+			httpStatus:             http.StatusInternalServerError,
+			isError:                true,
 			requiredStatusResponse: `{"error":{"code":500,"message":"Internal Server Error"}}`,
 		},
 		{
@@ -428,10 +428,10 @@ func TestFqdnCheck_Run(t *testing.T) {
 					APIToken:    token,
 				},
 			},
-			isPassed:   false,
-			response:   "fqdn, root_cert and nodes can't be empty, Please provide all the required fields.",
-			httpStatus: http.StatusBadRequest,
-			isError:    true,
+			isPassed:               false,
+			response:               "fqdn, root_cert and nodes can't be empty, Please provide all the required fields.",
+			httpStatus:             http.StatusBadRequest,
+			isError:                true,
 			requiredStatusResponse: `{"error":{"code":400,"message":"fqdn, root_cert and nodes can't be empty, Please provide all the required fields."}}`,
 		},
 		{
diff --git a/lib/config/hadeployconfig_test.go b/lib/config/hadeployconfig_test.go
index 50cf22f71..633f32ca6 100644
--- a/lib/config/hadeployconfig_test.go
+++ b/lib/config/hadeployconfig_test.go
@@ -517,8 +517,8 @@ Dv6bUUXSsZF4fb1diLIBpmD1hh8OGNY65LUPpzAxJeZvo5w=
 						ChefServerInstanceType:        "t3.medium",
 						OpensearchServerInstanceType:  "m5.large",
 						PostgresqlServerInstanceType:  "m5.large",
-						AutomateLbCertificateArn:      "arn:aws:acm:ca-central-1:112758395563:certificate/1754e15c-5834-44b0-82a7-0508c3155601",
-						ChefServerLbCertificateArn:    "arn:aws:acm:ca-central-1:112758395563:certificate/1754e15c-5834-44b0-82a7-0508c3155601",
+						AutomateLbCertificateArn:      "arn:aws:acm....",
+						ChefServerLbCertificateArn:    "arn:aws:acm....",
 						AutomateEbsVolumeIops:         "100",
 						AutomateEbsVolumeSize:         "50",
 						AutomateEbsVolumeType:         "gp3",
diff --git a/lib/config/hadeployconfigverify_test.go b/lib/config/hadeployconfigverify_test.go
index 7a6c610ec..337e73687 100644
--- a/lib/config/hadeployconfigverify_test.go
+++ b/lib/config/hadeployconfigverify_test.go
@@ -21,13 +21,13 @@ func TestParseAndVerify(t *testing.T) {
 			name:    "Verify AWS Config",
 			args:    args{configFile: "./testdata/HaAws.toml"},
 			wantErr: true,
-			err:     errors.New("invalid or empty: ssh_user\ninvalid or empty: ssh_key_file\ninvalid or empty s3_bucketName\ninvalid or empty: aws profile name\ninvalid or empty: aws region\ninvalid or empty: aws aws_vpc_id\ninvalid or empty: aws private_custom_subnets\ninvalid or empty: aws public_custom_subnets\ninvalid or empty: aws ssh_key_pair_name\ninvalid or empty: aws ami_id\ninvalid or empty: aws automate_server_instance_type\ninvalid or empty: aws automate_lb_certificate_arn\nempty value: aws automate_ebs_volume_iops\nempty value: aws automate_ebs_volume_size\ninvalid or empty: aws automate_ebs_volume_type\nempty value: aws chef_ebs_volume_iops\nempty value: aws chef_ebs_volume_size\ninvalid or empty: aws chef_ebs_volume_type\ninvalid or empty: aws chef_server_instance_type\ninvalid or empty: aws chef_server_lb_certificate_arn\ninvalid or empty: aws opensearch_server_instance_type\ninvalid or empty: aws postgresql_server_instance_type\nempty value: aws opensearch_ebs_volume_iops\nempty value: aws opensearch_ebs_volume_size\ninvalid or empty: aws opensearch_ebs_volume_type\nempty value: aws postgresql_ebs_volume_iops\nempty value: aws postgresql_ebs_volume_size\ninvalid or empty: aws postgresql_ebs_volume_type\ninvalid or empty URL: automate fqdn\nempty value: automate instance_count\nautomate root_ca is missing\nempty value: chef server instance_count\nempty value: opensearch instance_count\nempty value: postgresql instance_count"),
+			err:     errors.New("invalid or empty: ssh_user\ninvalid or empty: ssh_key_file\ninvalid or empty s3_bucketName\ninvalid or empty: aws profile name\ninvalid or empty: aws region\ninvalid or empty: aws aws_vpc_id\ninvalid or empty: aws private_custom_subnets\ninvalid or empty: aws public_custom_subnets\ninvalid or empty: aws ssh_key_pair_name\ninvalid or empty: aws ami_id\ninvalid or empty: aws automate_server_instance_type\ninvalid or empty: aws automate_lb_certificate_arn\nempty value: aws automate_ebs_volume_iops\nempty value: aws automate_ebs_volume_size\ninvalid or empty: aws automate_ebs_volume_type\nempty value: aws chef_ebs_volume_iops\nempty value: aws chef_ebs_volume_size\ninvalid or empty: aws chef_ebs_volume_type\ninvalid or empty: aws chef_server_instance_type\ninvalid or empty: aws chef_server_lb_certificate_arn\ninvalid or empty: aws opensearch_server_instance_type\ninvalid or empty: aws postgresql_server_instance_type\nempty value: aws opensearch_ebs_volume_iops\nempty value: aws opensearch_ebs_volume_size\ninvalid or empty: aws opensearch_ebs_volume_type\nempty value: aws postgresql_ebs_volume_iops\nempty value: aws postgresql_ebs_volume_size\ninvalid or empty: aws postgresql_ebs_volume_type\ninvalid or empty URL: automate fqdn\nempty value: automate instance_count\nempty value: chef server instance_count\nempty value: opensearch instance_count\nempty value: postgresql instance_count"),
 		},
 		{
 			name:    "Verify AWS Managed Config",
 			args:    args{configFile: "./testdata/HaAwsManaged.toml"},
 			wantErr: true,
-			err:     errors.New("invalid ssh_key_file: ~/.ssh/central.pem (stat ~/.ssh/central.pem: no such file or directory)\ninvalid or empty URL: automate fqdn"),
+			err:     errors.New("invalid ssh_key_file: ~/.ssh/central.pem no such file or directory\ninvalid or empty URL: automate fqdn"),
 		},
 		{
 			name:    "Verify OnPrem Config",
@@ -39,7 +39,7 @@ func TestParseAndVerify(t *testing.T) {
 			name:    "Verify OnPrem Db Self-Managed Config",
 			args:    args{configFile: "./testdata/HaOnPremDbSelfManaged.toml"},
 			wantErr: true,
-			err:     errors.New("invalid ssh_key_file: ~/.ssh/A2HA.pem (stat ~/.ssh/A2HA.pem: no such file or directory)\ninvalid or empty: dbuser_username\ninvalid or empty: dbuser_password\ninvalid or empty URL: instance_url\ninvalid or empty: postgresql_root_cert\ninvalid or empty: superuser_password\ninvalid or empty: superuser_username\ninvalid or empty: opensearch_domain_name\ninvalid or empty URL: opensearch_domain_url\ninvalid or empty: opensearch_root_cert\ninvalid or empty: opensearch_user_password\ninvalid or empty: opensearch_username\nautomate root_ca is missing"),
+			err:     errors.New("invalid ssh_key_file: ~/.ssh/A2HA.pem no such file or directory\ninvalid or empty: dbuser_username\ninvalid or empty: dbuser_password\ninvalid or empty URL: instance_url\ninvalid or empty: postgresql_root_cert\ninvalid or empty: superuser_password\ninvalid or empty: superuser_username\ninvalid or empty: opensearch_domain_name\ninvalid or empty URL: opensearch_domain_url\ninvalid or empty: opensearch_root_cert\ninvalid or empty: opensearch_user_password\ninvalid or empty: opensearch_username"),
 		},
 		{
 			name:    "Verify OnPrem Db Aws Managed Config",
@@ -51,19 +51,19 @@ func TestParseAndVerify(t *testing.T) {
 			name:    "Verify Aws Chef Managed Config",
 			args:    args{configFile: "./testdata/HaAwsChefManaged.toml"},
 			wantErr: true,
-			err:     errors.New("invalid value '1234567' for field 'ssh_port' port number must be between 1 and 65535\ninvalid or empty: ssh_key_file\ninvalid or empty: aws profile name\ninvalid or empty: aws region\ninvalid or empty: aws aws_vpc_id\nminimum number of aws private_custom_subnets required is 3\ninvalid or empty: aws public_custom_subnets\ninvalid or empty: aws ssh_key_pair_name\ninvalid or empty: aws ami_id\ninvalid or empty: aws automate_server_instance_type\ninvalid or empty: aws automate_lb_certificate_arn\nempty value: aws automate_ebs_volume_iops\nempty value: aws automate_ebs_volume_size\ninvalid or empty: aws automate_ebs_volume_type\nempty value: aws chef_ebs_volume_iops\nempty value: aws chef_ebs_volume_size\ninvalid or empty: aws chef_ebs_volume_type\ninvalid or empty: aws chef_server_instance_type\ninvalid or empty: aws chef_server_lb_certificate_arn\ninvalid or empty: aws opensearch_server_instance_type\ninvalid or empty: aws postgresql_server_instance_type\nempty value: aws opensearch_ebs_volume_iops\nempty value: aws opensearch_ebs_volume_size\ninvalid or empty: aws opensearch_ebs_volume_type\nempty value: aws postgresql_ebs_volume_iops\nempty value: aws postgresql_ebs_volume_size\ninvalid or empty: aws postgresql_ebs_volume_type\ninvalid or empty URL: automate fqdn\npassword is too short (must be at least 8 characters)\nempty value: automate instance_count\nautomate root_ca is missing\nautomate public_key and/or private_key are missing. Otherwise set enable_custom_certs to false\nempty value: chef server instance_count\nchefServer public_key and/or private_key are missing. Otherwise set enable_custom_certs to false\nempty value: opensearch instance_count\nopensearch root_ca and/or admin_key and/or admin_cert and/or public_key and/or private_key are missing. Otherwise set enable_custom_certs to false\nempty value: postgresql instance_count\npostgresql root_ca and/or public_key and/or private_key are missing. Otherwise set enable_custom_certs to false"),
+			err:     errors.New("invalid value '1234567' for field 'ssh_port' port number must be between 1 and 65535\ninvalid or empty: ssh_key_file\ninvalid or empty: aws profile name\ninvalid or empty: aws region\ninvalid or empty: aws aws_vpc_id\nminimum number of aws private_custom_subnets required is 3\ninvalid or empty: aws public_custom_subnets\ninvalid or empty: aws ssh_key_pair_name\ninvalid or empty: aws ami_id\ninvalid or empty: aws automate_server_instance_type\ninvalid or empty: aws automate_lb_certificate_arn\nempty value: aws automate_ebs_volume_iops\nempty value: aws automate_ebs_volume_size\ninvalid or empty: aws automate_ebs_volume_type\nempty value: aws chef_ebs_volume_iops\nempty value: aws chef_ebs_volume_size\ninvalid or empty: aws chef_ebs_volume_type\ninvalid or empty: aws chef_server_instance_type\ninvalid or empty: aws chef_server_lb_certificate_arn\ninvalid or empty: aws opensearch_server_instance_type\ninvalid or empty: aws postgresql_server_instance_type\nempty value: aws opensearch_ebs_volume_iops\nempty value: aws opensearch_ebs_volume_size\ninvalid or empty: aws opensearch_ebs_volume_type\nempty value: aws postgresql_ebs_volume_iops\nempty value: aws postgresql_ebs_volume_size\ninvalid or empty: aws postgresql_ebs_volume_type\ninvalid or empty URL: automate fqdn\npassword is too short (must be at least 8 characters)\nempty value: automate instance_count\nautomate public_key and/or private_key are missing. Otherwise set enable_custom_certs to false\nempty value: chef server instance_count\nchefServer public_key and/or private_key are missing. Otherwise set enable_custom_certs to false\nempty value: opensearch instance_count\nopensearch root_ca and/or admin_key and/or admin_cert and/or public_key and/or private_key are missing. Otherwise set enable_custom_certs to false\nempty value: postgresql instance_count\npostgresql root_ca and/or public_key and/or private_key are missing. Otherwise set enable_custom_certs to false"),
 		},
 		{
 			name:    "Verify Failed Ha Aws Managed Config",
 			args:    args{configFile: "./testdata/HaAwsManagedFailed.toml"},
 			wantErr: true,
-			err:     errors.New("invalid or empty: secrets_key_file\ninvalid or empty: secrets_store_file\ninvalid value 'awss' for field 'architecture'. Expected values are: aws, existing_nodes, deployment\ninvalid value '/hab/a3_deploy_workspace' for field 'workspace_path'. Expected values are: /hab/a2_deploy_workspace\ninvalid or empty: ssh_user\ninvalid or empty: ssh_key_file\ninvalid or empty s3_bucketName\ninvalid or empty: aws profile name\ninvalid or empty: aws region\ninvalid or empty: aws private_custom_subnets\ninvalid or empty: aws public_custom_subnets\ninvalid or empty: aws ssh_key_pair_name\ninvalid value 'aws lb_access_logs' for field 'fals'\ninvalid or empty: aws ami_id\ninvalid or empty: aws automate_server_instance_type\ninvalid or empty: aws automate_lb_certificate_arn\nempty value: aws automate_ebs_volume_iops\nempty value: aws automate_ebs_volume_size\ninvalid or empty: aws automate_ebs_volume_type\nempty value: aws chef_ebs_volume_iops\nempty value: aws chef_ebs_volume_size\ninvalid or empty: aws chef_ebs_volume_type\ninvalid or empty: aws chef_server_instance_type\ninvalid or empty: aws chef_server_lb_certificate_arn\ninvalid or empty: aws managed_opensearch_domain_name\ninvalid or empty URL: aws managed_opensearch_domain_url\ninvalid or empty: aws managed_opensearch_user_password\ninvalid or empty: aws managed_opensearch_username\ninvalid or empty: aws managed_rds_dbuser_password\ninvalid or empty: aws managed_rds_dbuser_username\ninvalid or empty URL: aws managed_rds_instance_url\ninvalid or empty: aws managed_rds_superuser_password\ninvalid or empty: aws managed_rds_superuser_username\ninvalid or empty URL: automate fqdn\nempty value: automate instance_count\nautomate root_ca is missing\nempty value: chef server instance_count"),
+			err:     errors.New("invalid or empty: secrets_key_file\ninvalid or empty: secrets_store_file\ninvalid value 'awss' for field 'architecture'. Expected values are: aws, existing_nodes, deployment\ninvalid value '/hab/a3_deploy_workspace' for field 'workspace_path'. Expected values are: /hab/a2_deploy_workspace\ninvalid or empty: ssh_user\ninvalid or empty: ssh_key_file\ninvalid or empty s3_bucketName\ninvalid or empty: aws profile name\ninvalid or empty: aws region\ninvalid or empty: aws private_custom_subnets\ninvalid or empty: aws public_custom_subnets\ninvalid or empty: aws ssh_key_pair_name\ninvalid value 'aws lb_access_logs' for field 'fals'\ninvalid or empty: aws ami_id\ninvalid or empty: aws automate_server_instance_type\ninvalid or empty: aws automate_lb_certificate_arn\nempty value: aws automate_ebs_volume_iops\nempty value: aws automate_ebs_volume_size\ninvalid or empty: aws automate_ebs_volume_type\nempty value: aws chef_ebs_volume_iops\nempty value: aws chef_ebs_volume_size\ninvalid or empty: aws chef_ebs_volume_type\ninvalid or empty: aws chef_server_instance_type\ninvalid or empty: aws chef_server_lb_certificate_arn\ninvalid or empty: aws managed_opensearch_domain_name\ninvalid or empty URL: aws managed_opensearch_domain_url\ninvalid or empty: aws managed_opensearch_user_password\ninvalid or empty: aws managed_opensearch_username\ninvalid or empty: aws managed_rds_dbuser_password\ninvalid or empty: aws managed_rds_dbuser_username\ninvalid or empty URL: aws managed_rds_instance_url\ninvalid or empty: aws managed_rds_superuser_password\ninvalid or empty: aws managed_rds_superuser_username\ninvalid or empty URL: automate fqdn\nempty value: automate instance_count\nempty value: chef server instance_count"),
 		},
 		{
 			name:    "Verify Failed Ha On Prem Aws Managed Config",
 			args:    args{configFile: "./testdata/HaOnPremDbAwsManagedFailed.toml"},
 			wantErr: true,
-			err:     errors.New("invalid or empty: os_snapshot_user_access_key_id\ninvalid or empty: os_snapshot_user_access_key_secret\nautomate root_ca is missing"),
+			err:     errors.New("invalid or empty: os_snapshot_user_access_key_id\ninvalid or empty: os_snapshot_user_access_key_secret"),
 		},
 		{
 			name:    "Invalid Architecture toml file",
diff --git a/lib/config/helper_test.go b/lib/config/helper_test.go
index 4e7b784a5..c5eb9fc3f 100644
--- a/lib/config/helper_test.go
+++ b/lib/config/helper_test.go
@@ -87,7 +87,9 @@ func TestValidateRequiredPathField(t *testing.T) {
 		{value: "./testdata/A2HA.pem", fieldName: "file", expected: nil},
 		{value: "./testdata", fieldName: "directory", expected: nil},
 		{value: "", fieldName: "empty", expected: fmt.Errorf(INVALID_EMPTY_VALUE, "empty")},
-		{value: "/nonexistent/file.txt", fieldName: "nonexistent", expected: fmt.Errorf("invalid nonexistent: /nonexistent/file.txt (stat /nonexistent/file.txt: no such file or directory)")},
+		{value: "/nonexistent/file.txt", fieldName: "nonexistent", expected: fmt.Errorf("invalid nonexistent: /nonexistent/file.txt no such file or directory")},
+		{value: "./testdata/.ssh/A2HA.pem", fieldName: "file", expected: nil},
+		{value: "~", fieldName: "directory", expected: nil},
 	}
 
 	for _, test := range tests {
diff --git a/lib/config/testdata/.ssh/A2HA.pem b/lib/config/testdata/.ssh/A2HA.pem
new file mode 100644
index 000000000..e69de29bb
diff --git a/lib/config/testdata/HaAwsManaged.toml b/lib/config/testdata/HaAwsManaged.toml
index abbe98601..566b1499a 100644
--- a/lib/config/testdata/HaAwsManaged.toml
+++ b/lib/config/testdata/HaAwsManaged.toml
@@ -526,10 +526,10 @@ opensearch_server_instance_type = "m5.large"
 postgresql_server_instance_type = "m5.large"
 
 # eg: automate_lb_certificate_arn = "arn:aws:acm...."
-automate_lb_certificate_arn = "arn:aws:acm:ca-central-1:112758395563:certificate/1754e15c-5834-44b0-82a7-0508c3155601"
+automate_lb_certificate_arn = "arn:aws:acm...."
 
 # eg: chef_server_lb_certificate_arn = "arn:aws:acm...."
-chef_server_lb_certificate_arn = "arn:aws:acm:ca-central-1:112758395563:certificate/1754e15c-5834-44b0-82a7-0508c3155601"
+chef_server_lb_certificate_arn = "arn:aws:acm...."
 
 # eg: automate_ebs_volume_iops = "100"
 automate_ebs_volume_iops = "100"