Hello! I've created the CRL, uploaded to my CA organization, verified ownership of the domain, adjusted the apache2 config file /etc/apache2/sites-enabled/default-ssl.conf to reflect the new keys and then restarted apache2. Success!
So, now to get Splunk to recognize the new keys. I followed another Question / Answer here with the subject "How to get tcp-ssl input for Splunk 6.0 to work". About half way down it gets in to version 6.5 and above.
So my /opt/splunk/etc/apps/Splunk_TA_paloalto/local/inputs.conf looks like this:
[udp://514]
connection_host = ip
sourcetype = pan:log
no_appending_timestamp = true
[tcp-ssl://6514]
disabled = false
sourcetype =
index =
source =
[SSL]
serverCert = /opt/splunk/etc/auth/mycerts/mydomain.com.pem
sslPassword = $7$ddDDWdhlFeaOT0RxI36AxCeZXeJsgMOnuJ8sb7aCc4xEVXL7fhDjgSOMvrlspg==
rootCA = /opt/splunk/etc/auth/mycerts/mydomain.com.pem
requireClientCert = false
I then change the following value in /opt/splunk/etc/system/local/server.conf
[sslConfig]
sslRootCAPath = /opt/splunk/etc/auth/mycerts/mydomain.com.pem
I restart Splunk and it does so successfully. What I've noticed wrong are two things. If I try to browse new apps I get this:
Error connecting: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed - please check the output of the openssl verify command for the certificates involved; note that if certificate verification is enabled (requireClientCert or sslVerifyServerCert set to "true"), the CA certificate and the server certificate should not have the same Common Name.. Your Splunk instance is specifying custom CAs to trust using sslRootCAPath configuration in server.conf's [sslConfig] stanza. Make sure the CAs in the appsCA.pem (located under $SPLUNK_HOME/etc/auth/appsCA.pem) are included in the CAs specified by sslRootCAPath. To do this, append appsCA.pem to the file specified by the sslRootCAPath parameter.
It's referencing the certs that came with it. I have tried to adjust the server.conf line with my new keys and Splunk won't even restart. Just hangs.
The second thing I'm noticing is my Palo Alto Traps secure syslogs are not authenticating either, but that will likely figure itself out if I get this first problem handled.
That's where I'm at currently. Any help would be appreciated!
