Why is Splunk Web SSL not using given 3rd party certificates?

heikis — Wed, 02 Sep 2015 12:30:59 GMT

Hello.

I'm using splunk-6.2.5-272645-linux-2.6-x86_64.rpm on Centos7.
The problem is that Splunk is not using desired 3rd party SSL certificates for splunkweb.
Current configuration:

cat /opt/splunk/etc/system/local/web.conf
[settings]
httpport = 8443
enableSplunkWebSSL = true
privKeyPath = etc/auth/splunkweb/mySplunkWebPrivateKeyRSA.key
caCertPath = etc/auth/splunkweb/bundled_base64.cer

The desired certificate and the CA certificate are bundled as required (server certificate first, then the CA certificate):

cat /opt/splunk/etc/auth/splunkweb/bundled_base64.cer
-----BEGIN CERTIFICATE-----
MIIF6TC.......HuQ=
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIID......kA==
-----END CERTIFICATE-----

When restarting Splunk, the certificate used on the https page is some weird self-generated certificate which uses the Subject fields from my desired certificate.

Any ideas? Thanks.

Re: Why is Splunk Web SSL not using given 3rd party certificates?

heikis — Wed, 16 Sep 2015 08:46:12 GMT

Finally resolved the issue. The Splunk installation was at a client's site and was accessed over a VPN. The client also had a proxy inbetween me and the splunk server which messed up the SSL sessions and presented me with the weird certificate.
So, my problem had nothing to with Splunk misbehaving.

topic Why is Splunk Web SSL not using given 3rd party certificates? in Splunk Enterprise

Why is Splunk Web SSL not using given 3rd party certificates?

Re: Why is Splunk Web SSL not using given 3rd party certificates?