Alerting

How add multiple certificate authority path files to web.conf using sslRootCAPath

alfredoh14
Explorer

hello,
I have 2 files that contains the path of the root Certificate Authority that issued my server certificate.
Not sure if the above is logically correct but i do have 2 files that have the paths to the certificate authority, and I must use both of them somehow/someway in web.conf.

my web.conf settings are similar to the below:
### START SPLUNK WEB USING HTTPS:8443 ###
enableSplunkWebSSL = 1
httpport = 8443
### SSL CERTIFICATE FILES ###
privKeyPath = $SPLUNK_HOME\etc\auth\DOD.web.certificates\privkey.pem
serverCert = $SPLUNK_HOME\etc\auth\DOD.web.certificates\cert.pem
sslRootCAPath =

However, for "sslRootCAPath =", i need to add both of the files i have.
However, the splunk documentation does not specify how I would be able to add these files, or if I can add them with ",", or if there is another property that would allow additional files with certificate authority paths.

the files and sample of their content are below.
Basically they are made-up of "noise" except for the header and footer section of the file.
So not sure how I would combine them into a single file if that is what splunk would like.
ca-200.pem -----BEGIN CERTIFICATE-----
MIIEjzCCA3egAwIBAgICAwMwDQYJKoZIhvcNAQELBQAwWzELMAkGA1UEBhMCVVMxGDAWBgNVBAoT
-----END CERTIFICATE-----

MyCompanyRootCA3.pem
-----BEGIN CERTIFICATE-----
MIIDczCCAlugAwIBAgIBATANBgkqhkiG9w0BAQsFADBbMQswCQYDVQQGEwJVUzEY
-----END CERTIFICATE----

any help is apreciated.

 

0 Karma
1 Solution

tscroggins
Influencer

Hi @alfredoh14,

The "noise" is the Base64 certificate data. To combine multiple PEM certificate files into a single file, simply concatenate the files:

-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----

General information on PEM is readily available online. Splunk also provides a quick tutorial at https://docs.splunk.com/Documentation/Splunk/latest/Security/HowtoprepareyoursignedcertificatesforSp....

You can reference the combined PEM file in the server.conf [sslConfig] stanza sslRootCAPath setting, e.g.:

# $SPLUNK_HOME\etc\system\local\server.conf

[sslConfig]
sslRootCAPath = X:\path\to\cacerts.pem

 

View solution in original post

0 Karma

tscroggins
Influencer

Hi @alfredoh14,

The "noise" is the Base64 certificate data. To combine multiple PEM certificate files into a single file, simply concatenate the files:

-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----

General information on PEM is readily available online. Splunk also provides a quick tutorial at https://docs.splunk.com/Documentation/Splunk/latest/Security/HowtoprepareyoursignedcertificatesforSp....

You can reference the combined PEM file in the server.conf [sslConfig] stanza sslRootCAPath setting, e.g.:

# $SPLUNK_HOME\etc\system\local\server.conf

[sslConfig]
sslRootCAPath = X:\path\to\cacerts.pem

 

0 Karma
Get Updates on the Splunk Community!

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...

The Visibility Gap: Hybrid Networks and IT Services

The most forward thinking enterprises among us see their network as much more than infrastructure – it's their ...

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...