All Apps and Add-ons

splunk kafka connector SSL setting

superbenben79
New Member

hi all, I am trying to set up a POC to use the connector. The splunk HEC end point is SSL enabled and the cert does not match the end point and the connector is throwing this error. The HEC end point has a splunk signed cert (CN=SplunkServerDefaultCert)

[2019-12-02 10:58:19,689] ERROR encountered io exception (com.splunk.hecclient.Indexer:143)
javax.net.ssl.SSLPeerUnverifiedException: Certificate for doesn't match any of the subject alternative names: []

What configuration can I setup so the connector does not perform host name validation? I have no control on the splunk side

0 Karma

ilya_resh
Engager

Hi, 

If you trust the host, you can either ignore the SSL validation at all by using this setting in the connector instance configuration (the one that you will create by using curl POST)

"splunk.hec.ssl.validate.certs": "false" 

 or you can add CA that was used to sign the HEC certificate to a truststore and

option 1: let SC4K connector instance know to use it when you are configuring the connector instance (using curl)

    "splunk.hec.ssl.trust.store.path": "<KEYSTORE_LOCATION>",   // ~/cert/keystore.jks
    "splunk.hec.ssl.trust.store.password": "<PASSWORD_KEYSTORE>",

option 2: configure the Connect Worker to use it in the connect-distributed.properties  file

ssl.truststore.location=~/cert/kafka.client.truststore.jks
ssl.truststore.password=test1234

 

 

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...