topic sslRootCAPath at server.conf in Getting Data In

sslRootCAPath at server.conf

inventsekar — Tue, 20 Jun 2017 13:29:50 GMT

SSL is already complex one, this poor documentation adds the fuel to the fire

https://docs.splunk.com/Documentation/Splunk/6.4.4/Security/ConfigureSplunkforwardingtousesignedcertificates
this says, we should update server.conf with sslRootCAPath info, but when splunkd restarts, it says the other way around.

[root@UF /app/JE0/splunkforwarder/etc/twoCerts]#/app/splunkforwarder/bin/splunk restart
Stopping splunkd...
Shutting down. Please wait, as this may take a few minutes.
............ [ OK ]
Stopping splunk helpers...
[ OK ]
Done.

Splunk> All batbelt. No tights.

Checking prerequisites...
Checking mgmt port [8089]: open
Checking conf files for problems...
*Invalid key in stanza [sslConfig] in /app/splunkforwarder/etc/system/local/server.conf, line 19: sslRootCAPath (value: /app/splunkforwarder/etc/twoCerts/cacert.pem). *
Your indexes and inputs configurations are not internally consistent. For more information, run 'splunk btool check --debug'
Done
Checking default conf files for edits...
Validating installed files against hashes from '/app/splunkforwarder/splunkforwarder-6.3.4-cae2458f4aef-linux-2.6-x86_64-manifest'
All installed files intact.
Done
All preliminary checks passed.

Starting splunk server daemon (splunkd)...
Done
[ OK ]
[root@UF /app/splunkforwarder/etc/twoCerts]#

Re: sslRootCAPath at server.conf

horsefez — Tue, 20 Jun 2017 14:00:07 GMT

Hi inventsekar,

there is a parameter named caCertPath which is depreciated in recent splunk versions, but served as the sslRootCAPath parameter in past splunk versions.

You seem to use a splunkforwarder with the version 6.3.4. In this version caCertPath should work.

Re: sslRootCAPath at server.conf

inventsekar — Wed, 21 Jun 2017 00:09:16 GMT

Thanks Pyro_wood,
sslRootCAPath works fine, but on inputs.conf file(not server.conf).

the document should be updated properly. if "SSL" is not updated properly, how a simple user can read this document and deploy SSL ?!?!?! hope splunk guys will check this and update soon.
the wiki.splunk on SSL also got multiple issues.

Re: sslRootCAPath at server.conf

satyenshah — Thu, 10 May 2018 21:25:08 GMT

Two pitfalls to watch out for:

2) The 'deprecated' settings don't appear to be really deprecated. Using v7.0.0, I still have to set caCertFile. If I try to set sslRootCAPath I get error "setting ignored under Windows". The Splunk docs for v7.0.0 say caCertFile is deprecated, but in practice it's not.

2) Splunk's SSL handling is intolerant of extra lines in PEM files. For example, if you start with a certificate in PFX and export to PEM, you end up with a lot of 'bag attributes' in the output PEM file. They look like comments in between the actual certificates. You have to manually strip out those lines so that the PEM file only contains lines that are either BEGIN, END, or Base64 encoded.

edit: Splunk appears to have fixed the sslRootCAPath problem in v7.1.2:
2018-06-15
SPL-149190, SPL-141808
(Windows Only) Support sslRootCAPath on Windows

Re: sslRootCAPath at server.conf

splunkreal — Tue, 04 Jan 2022 17:55:48 GMT

Agreed, this is misleading.