How add multiple certificate authority path files to web.conf using sslRootCAPath

alfredoh14 — Fri, 07 Jun 2024 15:55:13 GMT

hello,
I have 2 files that contains the path of the root Certificate Authority that issued my server certificate.
Not sure if the above is logically correct but i do have 2 files that have the paths to the certificate authority, and I must use both of them somehow/someway in web.conf.

my web.conf settings are similar to the below:
### START SPLUNK WEB USING HTTPS:8443 ###
enableSplunkWebSSL = 1
httpport = 8443
### SSL CERTIFICATE FILES ###
privKeyPath = $SPLUNK_HOME\etc\auth\DOD.web.certificates\privkey.pem
serverCert = $SPLUNK_HOME\etc\auth\DOD.web.certificates\cert.pem
sslRootCAPath =

However, for "sslRootCAPath =", i need to add both of the files i have.
However, the splunk documentation does not specify how I would be able to add these files, or if I can add them with ",", or if there is another property that would allow additional files with certificate authority paths.

the files and sample of their content are below.
Basically they are made-up of "noise" except for the header and footer section of the file.
So not sure how I would combine them into a single file if that is what splunk would like.
ca-200.pem -----BEGIN CERTIFICATE-----
MIIEjzCCA3egAwIBAgICAwMwDQYJKoZIhvcNAQELBQAwWzELMAkGA1UEBhMCVVMxGDAWBgNVBAoT
-----END CERTIFICATE-----

MyCompanyRootCA3.pem
-----BEGIN CERTIFICATE-----
MIIDczCCAlugAwIBAgIBATANBgkqhkiG9w0BAQsFADBbMQswCQYDVQQGEwJVUzEY
-----END CERTIFICATE----

any help is apreciated.

Re: How add multiple certificate authority path files to web.conf using sslRootCAPath

tscroggins — Sat, 08 Jun 2024 22:57:43 GMT

Hi @alfredoh14,

The "noise" is the Base64 certificate data. To combine multiple PEM certificate files into a single file, simply concatenate the files:

-----BEGIN CERTIFICATE----- ... -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- ... -----END CERTIFICATE-----

General information on PEM is readily available online. Splunk also provides a quick tutorial at https://docs.splunk.com/Documentation/Splunk/latest/Security/HowtoprepareyoursignedcertificatesforSplunk#How_to_configure_a_certificate_chain.

You can reference the combined PEM file in the server.conf [sslConfig] stanza sslRootCAPath setting, e.g.:

# $SPLUNK_HOME\etc\system\local\server.conf [sslConfig] sslRootCAPath = X:\path\to\cacerts.pem

topic Re: How add multiple certificate authority path files to web.conf using sslRootCAPath in Alerting

How add multiple certificate authority path files to web.conf using sslRootCAPath

Re: How add multiple certificate authority path files to web.conf using sslRootCAPath