Getting Data In

Command-line syntax to deploy universal forwarder with SSL certificates?

vonStauf
Explorer

Based on the documentation provided, the proper command-line arguments to be used when deploying certificates is CERTFILE= ROOTCAFILE= CERTPASSWORD=. This syntax will copy the specified certificates to the Program Files\SplunkUniveralForwarder\ etc\auth folder, however the .conf file references the location where the certificate files came from and NOT the default \etc\auth folder. Since we are creating the images in a seperate environment, the result is a client configuration that looks for certificates on a network share that is unavailable, even though the installation copied them to its own \etc\auth folder. Is this something that can be corrected in the next build or am I missing a syntax on my command-line?

1 Solution

vonStauf
Explorer

-UPDATE-

Fixed the problem by manually creating the c:\Program Files\SplunkUniversalForwarder\etc\auth folder and then copying the cert.pem files to it prior to running the install. Then when the install is run, I reference the pem files in the etc\auth folder so that the conf files refer to the correct location. Its still a problem with the installation logic, but a workable enough solution.

View solution in original post

vonStauf
Explorer

-UPDATE-

Fixed the problem by manually creating the c:\Program Files\SplunkUniversalForwarder\etc\auth folder and then copying the cert.pem files to it prior to running the install. Then when the install is run, I reference the pem files in the etc\auth folder so that the conf files refer to the correct location. Its still a problem with the installation logic, but a workable enough solution.

Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...