I've created some certificates to use with our forwarders to secure forwarded traffic. I've created an indexer_discovery app which contains outputs, a cert directory containing my certificate etc. but I've hit a snag...
I also included app/local/server.conf with an [sslConfig] stanza containing the cert location, sslKeysfilePassword etc. but Splunk doesn't seem to read the password from this file. After a forwarder restart the password remains unencrypted and the forwarder can't decrypt the cert producing lots of errors in splunkd.log.
The only workaround is to modify /opt/splunkforwarder/etc/system/local/server.conf and add [sslConfig] with the sslKeysfilePassword parameter. This means when we deploy the indexer discovery app we'll also need to login to each server to change the local server.conf file.
I'm not saying you're wrong but if you are correct then why does SSL forwarding work when I move the sslKeysfilePassword parameter to etc/system/local/server.conf? I can confirm that it also uses the cert we've pushed down with the app along with the cert location in server.conf within the app context.