topic Re: Splunk Web SSL Certificate Error from 3rd party in Security

Splunk Web SSL Certificate Error from 3rd party

Prakash493 — Fri, 06 Sep 2019 02:54:26 GMT

Hi ,
I am in a situation , we have 3 search heads clustered using a 3rd party SSL certs placed in web.conf after the splunk web ui is not accessed.

i received 2 certs from a 3rd party company one is , .pem and one is .key certs, i placed those 2 certs under /opt/splunk/etc/auth/xyz folder and then i go to /opt/splunk/etc/system/local folder edited the web.conf and updated it as splunk mentioned
[settings]
enableSplunkWebSSL = true
privKeyPath = /opt/splunk/etc/auth/mycerts/mySplunkWebPrivateKey.key
serverCert = /opt/splunk/etc/auth/mycerts/mySplunkWebCertificate.pem

then i restart the splunk but the UI didnt comes up.

What mistakes i did ? Please if anyone can help will be great ?

Re: Splunk Web SSL Certificate Error from 3rd party

harsmarvania57 — Fri, 06 Sep 2019 08:43:36 GMT

Hi,

Any error in $SPLUNK_HOME/var/log/splunk/splunkd.log OR web_access.log OR web_service.log ? As you are using search head in clustered, how are you accessing Search Head Web (Through any Load Balancer ? If yes then have you tried to access Search Head Web directly like https://SEARCH_HEAD_SERVER:8000 ?)

Re: Splunk Web SSL Certificate Error from 3rd party

Prakash493 — Fri, 06 Sep 2019 22:36:40 GMT

Thanks harsa ,

Problem resolved , I updated my .key file which was password protected and splunk was unable to read the key file , after removing the password from key file splunk is able to read it and problem resolved.

Re: Splunk Web SSL Certificate Error from 3rd party

Prakash493 — Fri, 06 Sep 2019 22:37:03 GMT