topic Why is there certificate exception error while posting data to splunk? in Security

Why is there certificate exception error while posting data to splunk?

Venkat_Kumar — Wed, 23 Mar 2022 16:29:14 GMT

Hi Team,

I am getting below error while trying to post data to my splunk using below url. I have installed the certificates in the source system by taking them from browser(lock sysmbol)

Can you please check and help what certificates are exactly installed to post data to below URL

end point url: https://prd-p-jmw56.splunkcloud.com:8088/services/collector/raw

Error Details

java.net.ConnectException: java.security.cert.CertificateException: No name matching prd-p-jmw56.splunkcloud.com found, cause: java.security.cert.CertificateException: No name matching prd-p-jmw56.splunkcloud.com found

thanks,

Venkat

Re: Why is there certificate exception error while posting data to splunk?

Venkat_Kumar — Thu, 24 Mar 2022 11:28:35 GMT

Hi Experts,

Can you please help to guide on below issue

I am getting below error while trying to post data to my splunk using below url. I have installed the certificates in the source system by taking them from browser(lock sysmbol)

Can you please check and help what certificates are exactly installed to post data to below URL

end point url: https://prd-p-jmw56.splunkcloud.com:8088/services/collector/raw

Error Details

thanks,

Venkat

Re: Why is there certificate exception error while posting data to splunk?

diogofgm — Thu, 24 Mar 2022 13:03:45 GMT

Are you sending the data with the HEC token?

Check this docs:
https://docs.splunk.com/Documentation/Splunk/latest/Data/HECExamples

Re: Why is there certificate exception error while posting data to splunk?

Venkat_Kumar — Thu, 24 Mar 2022 13:39:03 GMT

Hello,

Yes, i am created HEC token in splunk and using it while trying to send data.

Also, i have modified the end point as below(added "inputs.") as per https://docs.splunk.com/Documentation/Splunk/8.0.3/Data/UsetheHTTPEventCollector#

end point url: https://inputs.prd-p-jmw56.splunkcloud.com:8088/services/collector/raw

Based on error, looks like i need to install hostname dedicated certificate. Any idea on how to get it or enable anything in splunk to receive data.

Error Details

java.net.ConnectException: java.security.cert.CertificateException: No name matching inputs.prd-p-jmw56.splunkcloud.com found, cause: java.security.cert.CertificateException: No name matching inputs.prd-p-jmw56.splunkcloud.com found

Re: Why is there certificate exception error while posting data to splunk?

diogofgm — Thu, 24 Mar 2022 13:44:34 GMT

I haven't had much experience with splunk cloud but I recall you can download a UF package that contains all the necessary bit to connect to the cloud instance including the cert chain.

Re: Why is there certificate exception error while posting data to splunk?

Venkat_Kumar — Thu, 24 Mar 2022 16:40:34 GMT

@diogofgm Thanks for your response.

Can you please provide me the path where i can check UF package which contains certificate details.

Re: Why is there certificate exception error while posting data to splunk?

diogofgm — Thu, 24 Mar 2022 17:07:38 GMT

In Splunk Cloud in the Apps menu you have a Universal forwarder app. In that app you can download the UF package

Re: Why is there certificate exception error while posting data to splunk?

PickleRick — Thu, 24 Mar 2022 20:37:52 GMT

Contrary to the certificate served on port 443, the one used on 8088 is a Splunk's internal cert (the cert created by default on installation).

The one used on the web interface port is a wildcard certificate for the whole splunkcloud .com domain so I presume it's not directly installed on "your" search heads but is served from some HTTP loadbalancer which also works as HTTPS offloading proxy.

I haven't used the cloud yet but I suppose if you want a "proper" trusted certificate you should contact cloud support (you won't be able to upload a certificate and add ssl settings on your own anyway I think).