topic Re: Gett error while adding more apps in Splunk Enterprise

Gett error while adding more apps

viaykiroula — Sun, 01 May 2022 10:38:40 GMT

Error connecting: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed - please check the output of the `openssl verify` command for the certificates involved; note that if certificate verification is enabled (requireClientCert or sslVerifyServerCert set to "true"), the CA certificate and the server certificate should not have the same Common Name.. Your Splunk instance is specifying custom CAs to trust using sslRootCAPath configuration in server.conf's [sslConfig] stanza. Make sure the CAs in the appsCA.pem (located under $SPLUNK_HOME/etc/auth/appsCA.pem) are included in the CAs specified by sslRootCAPath. To do this, append appsCA.pem to the file specified by the sslRootCAPath parameter.

Re: Gett error while adding more apps

RichMahlerwein — Wed, 24 Jan 2024 20:57:59 GMT

Hi, I stumbled across this while searching the same error, and thought I'd provide an answer in case someone else comes along from the first hit in their favorite search engine. 🙂

Have you tried doing exactly what it says to do?

Specifically, here's the process on my own machine.

Note I'm starting out in /opt/splunk/etc/auth. From there, let's find the path of the sslRootCAPath file specified in server.conf

splunk@curie:/opt/splunk/etc/auth$ grep sslRootCAPath ../system/local/server.conf sslRootCAPath = /opt/splunk/etc/auth/mycerts/chain.pem

Now that I know the active cert, I can make a backup copy of it just in case

splunk@curie:/opt/splunk/etc/auth$ cp mycerts/chain.pem mycerts/chain.pem.2024-01-24

then append appsCA.pem to that file and restart Splunk.

splunk@curie:/opt/splunk/etc/auth$ cat appsCA.pem >> mycerts/chain.pem splunk@curie:/opt/splunk/etc/auth$ splunk restart

Worked like a charm.

Re: Gett error while adding more apps

VatsalJagani — Fri, 26 Jan 2024 12:08:47 GMT

@viaykiroula - Yes @RichMahlerwein is right usually this happens because you might have configured a custom cert and did not add appsCA.pem file content into your caCert.pem and serverCertChain.pem file. It should work after you add the content to these certificates.