Getting Data In

Self-signed certificate in certificate while using CLI

dujas
Explorer

Hi All,

I am trying to list all tokens via splunk http-event-collector cli and it retruned error as below:

[centos8-1 mycerts]$ ~/splunk/bin/splunk http-event-collector list -uri https://centos8-1:8089
ERROR: certificate validation: self signed certificate in certificate chain
Cannot connect Splunk server

I used openssl to try to connect to my server, it returned code 0. However, if I used the splunk openssl, it will return code 19. And from splunkd.log it said:

01-14-2023 01:25:22.088 +0800 WARN  HttpListener [75758 HttpDedicatedIoThread-6] - Socket error from 192.168.30.128:59764 while idling: error:14094418:SSL routines:ssl3_read_bytes:tlsv1 alert unknown ca - please check the output of the `openssl verify` command for the certificates involved; note that if certificate verification is enabled (requireClientCert or sslVerifyServerCert set to "true"), the CA certificate and the server certificate should not have the same Common Name.

Once I commented out cliVerifyServerName in servers.conf, the cli works but with warning as below:

WARNING: Server Certificate Hostname Validation is disabled. Please see server.conf/[sslConfig]/cliVerifyServerName for details.

May I know if I missed any configuration here? The cert is generated on my own and indeed it is self-signed one.

Labels (1)
0 Karma

himaniarora20
Explorer

were you ever able to figure this out? I am facing the same issue

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...