topic Re: How to complete Certs definitions in config? in Monitoring Splunk

How to complete Certs definitions in config?

PickleRick — Tue, 19 Apr 2022 14:40:31 GMT

I'm trying to do my own "poor man's certificate check" 😉

Ideally I'd like to pick up from the config (btool output) the paths to certs so I could check them with openssl CLI tool. I don't want to do any python modular input stuff for that since I want it to run as a simple script on any machine with UF. The question therefore is where should I get my certs from.

serverCert, RootCA, clientCert, sslRootCAPath entries in inputs.conf, outputs.conf, servers.conf, deploymentclients.conf (of course they don't have to be defined in each file). For now I assume the "new" configuration format with a single pem.

Any files that I forgot? Any more entries I missed? 🙂

Re: How to complete Certs definitions in config?

isoutamo — Thu, 21 Apr 2022 20:23:22 GMT

At least authentication.conf and web.conf have some cert definitions over those which you already listed.

In some weird situation also /opt/splunk/splunk/etc/openldap/ldap.conf can have uncommented entries for those?

r. Ismo

Re: How to complete Certs definitions in config?

PickleRick — Thu, 21 Apr 2022 20:46:56 GMT

web.conf - sure; don't know how I omitted it.

authentication/ldap - you're right. I forgot about external authentication. I mostly use local accounts but of course makes sense.