topic Why is KV Store certificate renewal not working? in Knowledge Management

Why is KV Store certificate renewal not working?

conwaw — Thu, 18 Aug 2022 15:24:05 GMT

Hi,

Does anyone know where may I find official documentation which will help me to resolve this problem?

I have renewed a certificate using this tutorial, but for some reason, MongoDB is still not starting.

https://splunkonbigdata.com/2019/07/03/failed-to-start-kv-store-process-see-mongod-log-and-splunkd-log-for-details/

mongodb.log is showing this error...

2020-04-11T10:27:08.899Z W CONTROL [main] net.ssl.sslCipherConfig is deprecated. It will be removed in a future release. 2020-04-11T10:27:08.902Z F NETWORK [main] The provided SSL certificate is expired or not yet valid. 2020-04-11T10:27:08.902Z F - [main] Fatal Assertion 28652 at src/mongo/util/net/ssl_manager.cpp 1145 2020-04-11T10:27:08.902Z F - [main] ***aborting after fassert() failure

Can anyone here help?

Cheers
Konrad

Re: kvstore certificate renewal is not working...

PavelP — Mon, 13 Apr 2020 11:37:10 GMT

Hello @conwaw ,

did you find a solution for your problem?

If still not, try this command on the same host and post here a (redacted) output:

openssl s_client -connect localhost:8191

Re: kvstore certificate renewal is not working...

conwaw — Tue, 14 Apr 2020 15:03:03 GMT

I cannot use Your command because nothing listen on port 8191. This is my problem, its not starting.

Re: kvstore certificate renewal is not working...

PavelP — Tue, 14 Apr 2020 16:06:40 GMT

Hello Konrad,

ah, I see " The provided SSL certificate is expired or not yet valid." message. Lets check the start and end validity of the certificate.

I assume you used a createssl command with the same parameters as mentioned in the blog post and a new certificate named "server.pem" was (re)created.

can you provide output of following commands:

ls -ltr /opt/splunk/etc/auth

openssl x509 -in /opt/splunk/etc/auth/server.pem -noout -text

and other question: you have a stand alone splunk and not a (SH) cluster, right?

Re: kvstore certificate renewal is not working...

vinod94 — Tue, 14 Apr 2020 17:53:52 GMT

Hi dyude @conwaw ,

Try this,

Stop the Splunk service.
Rename the server.pem($SPLUNK_HOME/etc/auth) to server.pemck or move the pem file.
Start the Splunk service.

It will generate a new server.pem

Let me know if this helps. 🙂

Re: kvstore certificate renewal is not working...

Eduardo_Perez — Fri, 03 Jul 2020 19:44:38 GMT

Thanks, it worked for me.

Re: kvstore certificate renewal is not working...

SirDrake7 — Thu, 17 Dec 2020 01:10:18 GMT

Thank you for this fix big time.

Re: kvstore certificate renewal is not working...

rmendoza — Thu, 18 Aug 2022 14:59:35 GMT

This did the trick, thank you!

Re: Why is KV Store certificate renewal not working?

helge — Tue, 01 Nov 2022 20:27:02 GMT

On Windows, you may get the following error message in mongod.log:

Fatal Assertion 50755 at src\mongo\util\net\ssl_manager_windows.cpp 1609

To fix the error that causes mongod to terminate, you need the following in addition to deleting server.pem:

Open Windows certificate management MMC for the local computer
Navigate to Personal > Certificates
Delete any entries named SplunkServerDefaultCert

Re: kvstore certificate renewal is not working...

freddy_Guo — Wed, 09 Nov 2022 23:56:06 GMT

That worked beautifully for us. Thank you.

Re: kvstore certificate renewal is not working...

Gregski11 — Fri, 06 Jan 2023 18:30:35 GMT

awesome, thank you, that did it

Re: Why is KV Store certificate renewal not working?

Gregski11 — Fri, 06 Jan 2023 18:31:06 GMT

appreciate you, thank you so much

Re: kvstore certificate renewal is not working...

fabiofox — Sat, 14 Jan 2023 21:17:42 GMT

it's working! thank you for this 🙏

Re: kvstore certificate renewal is not working...

juhatamminen — Mon, 23 Jan 2023 13:56:21 GMT

Hi,

I also have to do the same for server_pkcs1.pem file.

Re: Why is KV Store certificate renewal not working?

pavankumarh — Fri, 07 Jul 2023 15:07:19 GMT

This worked after lot of research. Thank You..

Just for others.. Dont run certmgr.msc on server. Instead run certlm.msc to see the "SplunkServerDefaultCert" entries.

I was doing this wrong.

Re: kvstore certificate renewal is not working...

linhmai_bne — Tue, 12 Sep 2023 04:59:30 GMT

This solution is the one I have been looking for. Thank you.

Re: kvstore certificate renewal is not working...

Ola — Tue, 03 Oct 2023 00:01:37 GMT

Thank you so much . It works for me!!!

Re: kvstore certificate renewal is not working...

jmrubio — Mon, 23 Oct 2023 17:07:15 GMT

Three years later and this worked! Thanks!!

Re: kvstore certificate renewal is not working...

tfrederick74656 — Fri, 09 Feb 2024 20:54:59 GMT

Still working in 2024, thanks so much!!

Re: Why is KV Store certificate renewal not working?

robertlynch2020 — Wed, 06 Mar 2024 11:21:41 GMT

worked for me - but - surely this is something that should not happen- there are no warnings in Splunk it just bang - Splunk is down in production