Why does SSL connection to HEC stop working with self-signed certificate?

[agoltzman]

Hi,

I created a splunk server on AWS and using the UI I constructed an HEC to listen for some logs.

I am using docker's splunk logging driver to send the logs.

If I leave the config the same on both servers, I receive the error:
"Error response from daemon: Options "https://<IP>:8088/services/collector/event/1.0": x509: certificate relies on legacy Common Name field, use SANs instead"

So I tried to change splunk config so that it will work with my self signed certificate (which uses SANs).

I did this by changing the inputs.conf (in which the HEC was configured, bizarrely enough under" $SPLUNK_HOME/etc/apps/search/...") to have the [http] stanza with the path of the self signed cert:

[root@machine introspection]# cat $SPLUNK_HOME/etc/apps/search/local/inputs.conf
[http]
serverCert = /opt/splunk/etc/auth/certs/root.pem

[http://test]
disabled = 0
host = <ip>
sourcetype = generic_single_line
token = <token>

I then moved the relevant [http] stanza to where I believe it should be, (.../apps/splunk_httpinputs/...) but this didn't help.

In fact, what happened was as soon as I put this stanza in, connections via SSL to the ip of splunk with the relevant port do not complete, for example:

openssl s_client -connect <ip>:8088

I would appreciate assistance with either fixing the original SANs issue (as it's splunk logging driver on docker), or with the issue of using self-signed on HEC.

Thanks!

[andl24]

Did you manage to solve this issue in the end? I'm facing something similar

[isoutamo]

Hi

there was some discussion and wondering why this is a requirement for Splunk_TA_aws. No one cannot find any real reason for that requirements. Unfortunately this seems to be coded inside TA and it seems that developers are not willing to change it (at least soon). Of course you can create a idea for allow also private certs into https://ideas.splunk.com and tell the Idea id here, so other can also vote for it.

r. Ismo