Getting Data In

Why does SSL connection to HEC stop working with self-signed certificate?

agoltzman
New Member

Hi,

 

I created a splunk server on AWS and using the UI I constructed an HEC to listen for some logs.

I am using docker's splunk logging driver to send the logs.

If I leave the config the same on both servers, I receive the error:
"Error response from daemon: Options "https://<IP>:8088/services/collector/event/1.0": x509: certificate relies on legacy Common Name field, use SANs instead"

So I tried to change splunk config so that it will work with my self signed certificate (which uses SANs).

I did this by changing the inputs.conf (in which the HEC was configured, bizarrely enough under" $SPLUNK_HOME/etc/apps/search/...") to have the [http] stanza with the path of the self signed cert:

 

 

 

[root@machine introspection]# cat $SPLUNK_HOME/etc/apps/search/local/inputs.conf
[http]
serverCert = /opt/splunk/etc/auth/certs/root.pem

[http://test]
disabled = 0
host = <ip>
sourcetype = generic_single_line
token = <token>

 

 

 

I then moved the relevant [http] stanza to where I believe it should be, (.../apps/splunk_httpinputs/...) but this didn't help.

In fact, what happened was as soon as I put this stanza in, connections via SSL to the ip of splunk with the relevant port do not complete, for example:

 

 

 

openssl s_client -connect <ip>:8088

 

 

 

 

I would appreciate assistance with either fixing the original SANs issue (as it's splunk logging driver on docker), or with the issue of using self-signed on HEC.

Thanks!

Labels (2)
0 Karma

andl24
New Member

Did you manage to solve this issue in the end? I'm facing something similar

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

there was some discussion and wondering why this is a requirement for Splunk_TA_aws. No one cannot find any real reason for that requirements. Unfortunately this seems to be coded inside TA and it seems that developers are not willing to change it (at least soon). Of course you can create a idea for allow also private certs into https://ideas.splunk.com and tell the Idea id here, so other can also vote for it.

r. Ismo

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...