sslKeysfilePassword not working in a deployed forwarder app

[stepheneardley]

I've created some certificates to use with our forwarders to secure forwarded traffic. I've created an indexer_discovery app which contains outputs, a cert directory containing my certificate etc. but I've hit a snag...

I also included app/local/server.conf with an [sslConfig] stanza containing the cert location, sslKeysfilePassword etc. but Splunk doesn't seem to read the password from this file. After a forwarder restart the password remains unencrypted and the forwarder can't decrypt the cert producing lots of errors in splunkd.log.

The only workaround is to modify /opt/splunkforwarder/etc/system/local/server.conf and add [sslConfig] with the sslKeysfilePassword parameter. This means when we deploy the indexer discovery app we'll also need to login to each server to change the local server.conf file.

Please tell me I'm doing it wrong 🙂

[jplumsdaine22]

You are indeed doing it wrong 🙂

The forwarder SSL doesn't use the server.conf file - it uses inputs.conf & outputs.conf.

First go and read dwaddles SSL guides:
http://www.duanewaddle.com/splunk-conf-2014/

The relevant splunk documentation is here:

http://docs.splunk.com/Documentation/Splunk/6.4.2/Security/ConfigureSplunkforwardingtousesignedcerti...

[stepheneardley]

I'm not saying you're wrong but if you are correct then why does SSL forwarding work when I move the sslKeysfilePassword parameter to etc/system/local/server.conf? I can confirm that it also uses the cert we've pushed down with the app along with the cert location in server.conf within the app context.

[jplumsdaine22]

Odd - I don't actually use the SSL forwarding myself, so I couldn't tell you for sure. My guess would be that when you put the parameter in system/local it gets ignored

On your indexer run ./bin/splunk cmd btool inputs list

If you're using ssl you should have an input stanza like [splunktcp-ssl:9997]. If its [splunktcp://9997] then you're not actually using SSL

The server.conf controls the ssl settings for the splunkd port, 8089