topic WARNING: Server Certificate Hostname Validation is disabled in Splunk Enterprise

WARNING: Server Certificate Hostname Validation is disabled

BRFZ — Tue, 08 Oct 2024 07:08:05 GMT

Hi Splunk Community,

I’ve generated self-signed SSL certificates and configured them in web.conf, but they don't seem to be taking effect. Additionally, I am receiving the following warning message when starting Splunk:

WARNING: Server Certificate Hostname Validation is disabled. Please see server.conf/[sslConfig]/cliVerifyServerName for details.

Could someone please help me resolve this issue? I want to ensure that Splunk uses the correct SSL certificates and that the hostname validation works properly.

Re: WARNING: Server Certificate Hostname Validation is disabled

marnall — Wed, 09 Oct 2024 20:01:15 GMT

Did you set cliVerifyServerName = true ?

It would be helpful if you post your server.conf [sslConfig] stanza (sanitized if it contains sensitive information)

Re: WARNING: Server Certificate Hostname Validation is disabled

PickleRick — Wed, 09 Oct 2024 20:07:01 GMT

1. What do you mean by "they don't seem to be taking an effect"?

2. Did you verify with btool that the settings you've put into your configs are effective?

3. Did you restart Splunk?

4. Self-signed certs don't actually raise your level of security much. You should be using an external CA-issued certs (even if it's your own CA).