- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Re: secure splunk web with signed certificate
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
secure splunk web with signed certificate
I generate Key & csr files from my splunk machine
then got the signed certificate from .pem & root , sub certificates , i put them in on single file in order
-----BEGIN CERTIFICATE-----
... (certificate for your server)...
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
... (the intermediate certificate)...
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
... (the root certificate for the CA)...
-----END CERTIFICATE-----
also configured web.conf to be like below
[settings]
enableSplunkWebSSL = true
privKeyPath = C:\Program Files\Splunk\etc\auth\mycerts\mySplunkWebPrivateKey.key
serverCert = C:\Program Files\Splunk\etc\auth\mycerts\mySplunkWebCert.pem
but after trying to restart splunk service
am waiting much time in starting web server process more than 10 min and i have to revert back my configuration to can access splunk GUI again
anyone can help ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Can you confirm that you have put all the certificates in your .pem file?
Also can you check what error are you getting in Splunkd.log when you start your Splunk with this configurations?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Are you having the intermediate certificate?!?!
Troubleshoot your Splunk Web authentication
If you are unable to verify your certificate configuration, you can use the web_service.log in $SPLUNK_HOME/var/log/splunk to view and troubleshoot any errors that occur upon restart.
Look for SSL configuration warnings. For example, if you provide an incorrect path to the server certificate declared in serverCert, Splunk Web fails to start and the following error appears:
2010-12-21 16:25:02,804 ERROR [4d11455df3182e6710] root:442 - [Errno 2] No such file or directory: '/opt/splunk/share/splunk/mycerts/mySplunkWebCertificate.pem'
Note: If the private key is provided in privKeyPath is password protected, no error is provided but your browser won't load Splunk Web.
https://docs.splunk.com/Documentation/Splunk/7.0.0/Security/TroubleshootyourSplunkWebauthentication
Sekar
PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
no warning in this file related to the certificate
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Are you having the intermediate certificate?!?!
Sekar
PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
yes I have ca-root & ca-subcertificate & webserver certificate
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
when you start Splunk, did it show error or just showing Splunk web starting?
Ensure,
privKeyPath
caCertPath
serverCert
are all reflected in btool output of web.conf
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
which path can i write in CAcert as i have only one .pem file ?
Enterprise Security Content Update (ESCU) | New Releases
Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?
Index This | What are the 12 Days of Splunk-mas?
