https://community.splunk.com/t5/Deployment-Architecture/What-are-the-passphrases-for-the-pem-files-in-the-Universal/m-p/411925#M14764 <P>I don't know why it matters or why you would care but Splunk <EM>typically</EM> uses the name as the value for defaults (like the default <CODE>password</CODE> is <CODE>password</CODE>), so try <CODE>passphrase</CODE> or null/nothing.</P> Tue, 23 Apr 2019 05:21:08 GMT woodcock 2019-04-23T05:21:08Z https://community.splunk.com/t5/Deployment-Architecture/What-are-the-passphrases-for-the-pem-files-in-the-Universal/m-p/411924#M14763 <P>Hello!</P> <P>What are the passphrases for the <CODE>client.pem</CODE> and <CODE>server.pem</CODE> files in the Universal Forwarder Credentials file, <CODE>splunkclouduf.spl</CODE>?</P> <P>I've tried the following passphrases without success:</P> <OL> <LI>my Splunk account password. It had the maximum allowed characters, 64.</LI> <LI><CODE>changeme</CODE></LI> <LI> updating my password to something simpler in <A href="https://www.splunk.com/my-account/en_us#/profile-details">https://www.splunk.com/my-account/en_us#/profile-details</A> , re-downloading the <CODE>splunkclouduf.spl</CODE> and trying new password for the passphrase with this command: <CODE>openssl rsa -in client.pem -out no_client.pem</CODE>.</LI> </OL> <P>Thank you in advance!</P> <P>P.S. For a little background, I'm trialing Splunk Cloud. I'm trying to send logs from my kubernetes cluster to Splunk Cloud using <A href="https://github.com/splunk/splunk-connect-for-kubernetes">https://github.com/splunk/splunk-connect-for-kubernetes</A>.</P> <P>I've opened a Splunk account, created the indexes and downloaded the Universal Forwarder Credentials file, <CODE>splunkclouduf.spl</CODE> and untarred it which produced the 5 files: <CODE>cacert.pem</CODE> , <CODE>client.pem</CODE>, <CODE>limits.conf</CODE>, <CODE>outputs.conf</CODE> and <CODE>server.pem</CODE>.</P> <P>The problem is that the .pem files have passphrases. So setting just setting them in the <CODE>global.splunk.hec.clientCert</CODE>, <CODE>global.splunk.hec.clientKey</CODE> and <CODE>global.splunk.hec.caFile</CODE> settings is producing TLS errors.</P> Fri, 19 Apr 2019 12:14:41 GMT https://community.splunk.com/t5/Deployment-Architecture/What-are-the-passphrases-for-the-pem-files-in-the-Universal/m-p/411924#M14763 frankcryptact 2019-04-19T12:14:41Z https://community.splunk.com/t5/Deployment-Architecture/What-are-the-passphrases-for-the-pem-files-in-the-Universal/m-p/411925#M14764 <P>I don't know why it matters or why you would care but Splunk <EM>typically</EM> uses the name as the value for defaults (like the default <CODE>password</CODE> is <CODE>password</CODE>), so try <CODE>passphrase</CODE> or null/nothing.</P> Tue, 23 Apr 2019 05:21:08 GMT https://community.splunk.com/t5/Deployment-Architecture/What-are-the-passphrases-for-the-pem-files-in-the-Universal/m-p/411925#M14764 woodcock 2019-04-23T05:21:08Z https://community.splunk.com/t5/Deployment-Architecture/What-are-the-passphrases-for-the-pem-files-in-the-Universal/m-p/411926#M14765 <P>@woodcock Thank you for the reply. Those weren't accepted as the passphrase, but the <CODE>outputs.conf</CODE> file has a line entry of <CODE>sslPassword = xxxxx</CODE>, where <CODE>xxxxx</CODE> seems to be the passphrase.</P> Tue, 23 Apr 2019 11:28:44 GMT https://community.splunk.com/t5/Deployment-Architecture/What-are-the-passphrases-for-the-pem-files-in-the-Universal/m-p/411926#M14765 frankcryptact 2019-04-23T11:28:44Z https://community.splunk.com/t5/Deployment-Architecture/What-are-the-passphrases-for-the-pem-files-in-the-Universal/m-p/411927#M14766 <P>OK, you should click <CODE>Accept</CODE> to close the question.</P> Tue, 23 Apr 2019 15:56:07 GMT https://community.splunk.com/t5/Deployment-Architecture/What-are-the-passphrases-for-the-pem-files-in-the-Universal/m-p/411927#M14766 woodcock 2019-04-23T15:56:07Z