i think most of the community now uses chef-vault to store there certificates
and it would be nice to use ssl-vault for this
https://github.com/onbeep-cookbooks/ssl-vault
its relatively easy do add this
include the ssl-vault cookbook
and set the attribute
default[:'ssl-vault'][:certificates] = ['YOURDATABAGNAME']