topic Re: Splunk not taking updated certificate (SSL) in Security

Splunk not taking updated certificate (SSL)

nawazns5038 — Sat, 19 Jan 2019 01:32:43 GMT

Hi,

The search head cluster uses our own certificates which are going to expire soon. So in order to update the certificates I have pushed the certs through the deployer and updated the SSL Password in server.conf and outputs.conf and the search heads restarted and everything is working fine without errors . But the certificates have not been updated. UI still shows the old certificate and I have checked the expiry through CLI as well. It shows the old certificate. The new certificates have been pushed in the backend.

What could be the reason ?? Anything that I have missed ?

I have double checked using btool , and the certs are pointing towards the right direction .

One thing I observed is that $SPLUNK_HOME is not set on the splunk-launch.conf file . Is that a problem ??

Re: Splunk not taking updated certificate (SSL)

MoniM — Sat, 19 Jan 2019 03:49:23 GMT

Hi @nawazns5038 ,

Have you gone through the below settings in web.conf ?

https://docs.splunk.com/Documentation/Splunk/7.2.3/Security/SecureSplunkWebusingasignedcertificate#Configure_Splunk_Web_to_use_the_key_and_certificate_files

Re: Splunk not taking updated certificate (SSL)

johnansett — Thu, 24 Mar 2022 01:52:27 GMT

Hello! Did you get this working? I am having the same issue - the privKeyPath and serverCert show up correctly when I run btool, but it still seems to be using the old self signed certs.....