topic Error installing self signed / ca signed certificates in splunk in Security

Error installing self signed / ca signed certificates in splunk

zerocool443 — Wed, 30 Sep 2020 02:12:45 GMT

Following is the error after i update web.conf with certificate and keys i have from a CA authority.

Splunk> CSI: Logfiles.

Checking prerequisites...
Checking http port [8000]: open
Checking mgmt port [8089]: open
Checking appserver port [127.0.0.1:8065]: open
Checking kvstore port [8191]: open
Checking configuration... Done.
Checking critical directories... Done
Checking indexes...
Validated: _xxxxxx
Done
Checking filesystem compatibility... Done
Checking conf files for problems...
Done
Checking default conf files for edits...
Validating installed files against hashes from '/opt/splunk/splunk-7. 2.3-06d57c595b80-linux-2.6-x86_64-manifest'
File '/opt/splunk/etc/system/default/web.conf' changed.
Problems were found, please review your files and move customizations to local
All preliminary checks passed.

+++ FIX +++

Issue was fixed by copying certificate files to mycert directory i.e default directory with splunk installation. for my case opt/splunk/etc/auth directory, and use the relative path in config file rather than absolute.

Re: Error installing self signed / ca signed certificates in splunk

zerocool443 — Wed, 30 Sep 2020 02:12:47 GMT

Checking weservice logs for splunk gives no error.

attaching info messages:

2019-09-17 11:30:53,577 INFO [5d807694a97f935f818050] root:657 - CONFIG: privKeyPath (str):
2019-09-17 11:30:53,579 INFO [5d807694a97f935f818050] root:657 - CONFIG: serverCert (str):
2019-09-17 11:39:46,885 INFO [5d8078a9f27fc6d8154090] root:657 - CONFIG: serverCert (str): $SPLUNK_HOME/etc/auth/splunkweb/mycer.pem
2019-09-17 11:42:24,773 INFO [5d807947cb7f7b3b943090] root:657 - CONFIG: serverCert (str): $SPLUNK_HOME/etc/auth/splunkweb/mycer.pem
2019-09-17 11:47:40,686 INFO [5d807a83be7f4170b84090] root:657 - CONFIG: privKeyPath (str):
2019-09-17 11:47:40,688 INFO [5d807a83be7f4170b84090] root:657 - CONFIG: serverCert (str):

Re: Error installing self signed / ca signed certificates in splunk

zerocool443 — Tue, 17 Sep 2019 06:39:37 GMT

Ok i found the issue here :
09-17-2019 12:07:58.979 +0530 ERROR SSLCommon - Can't read certificate file /opt/splunk/ errno=33558530 error:02001002:system library:fopen:No such file or directory
09-17-2019 12:07:58.979 +0530 ERROR HTTPServer - SSL context could not be created - error in cert or password is wrong

This point that splunk is not able to file the find in directory but the file exists there.

Now after i check splunk documentation, i have given an absolute path instead of relative to $SPLUNK_HOME$.

Any splunk devs for rescue ?

Re: Error installing self signed / ca signed certificates in splunk

zerocool443 — Tue, 17 Sep 2019 06:58:07 GMT

Issue fixed by copying files to mycert directory in /splunk/etc/auth directory.

and use the relative path in config file rather than absolute.

Re: Error installing self signed / ca signed certificates in splunk

zerocool443 — Tue, 24 Sep 2019 06:01:27 GMT

Issue fixed by copying files to mycert directory in /splunk/etc/auth directory.

and use the relative path in config file rather than absolute.

For some reason config file parser isn't working as expected for absolute path.

Re: Error installing self signed / ca signed certificates in splunk

richgalloway — Tue, 24 Sep 2019 13:08:43 GMT

@zerocool443 If your problem is resolved, please accept the answer to help future readers.