Getting Data In

sslRootCAPath at server.conf

Super Champion

SSL is already complex one, this poor documentation adds the fuel to the fire
this says, we should update server.conf with sslRootCAPath info, but when splunkd restarts, it says the other way around.

[root@UF /app/JE0/splunkforwarder/etc/twoCerts]#/app/splunkforwarder/bin/splunk restart
Stopping splunkd...
Shutting down. Please wait, as this may take a few minutes.
............ [ OK ]
Stopping splunk helpers...
[ OK ]

Splunk> All batbelt. No tights.

Checking prerequisites...
Checking mgmt port [8089]: open
Checking conf files for problems...
*Invalid key in stanza [sslConfig] in /app/splunkforwarder/etc/system/local/server.conf, line 19: sslRootCAPath (value: /app/splunkforwarder/etc/twoCerts/cacert.pem). *
Your indexes and inputs configurations are not internally consistent. For more information, run 'splunk btool check --debug'
Checking default conf files for edits...
Validating installed files against hashes from '/app/splunkforwarder/splunkforwarder-6.3.4-cae2458f4aef-linux-2.6-x86_64-manifest'
All installed files intact.
All preliminary checks passed.

Starting splunk server daemon (splunkd)...
[ OK ]
[root@UF /app/splunkforwarder/etc/twoCerts]#

>>> Happy Splunking !


Agreed, this is misleading.

0 Karma

Path Finder

Two pitfalls to watch out for:

2) The 'deprecated' settings don't appear to be really deprecated. Using v7.0.0, I still have to set caCertFile. If I try to set sslRootCAPath I get error "setting ignored under Windows". The Splunk docs for v7.0.0 say caCertFile is deprecated, but in practice it's not.

2) Splunk's SSL handling is intolerant of extra lines in PEM files. For example, if you start with a certificate in PFX and export to PEM, you end up with a lot of 'bag attributes' in the output PEM file. They look like comments in between the actual certificates. You have to manually strip out those lines so that the PEM file only contains lines that are either BEGIN, END, or Base64 encoded.

edit: Splunk appears to have fixed the sslRootCAPath problem in v7.1.2:
SPL-149190, SPL-141808
(Windows Only) Support sslRootCAPath on Windows


Hi inventsekar,

there is a parameter named caCertPath which is depreciated in recent splunk versions, but served as the sslRootCAPath parameter in past splunk versions.

You seem to use a splunkforwarder with the version 6.3.4. In this version caCertPath should work.

Super Champion

Thanks Pyro_wood,
sslRootCAPath works fine, but on inputs.conf file(not server.conf).

the document should be updated properly. if "SSL" is not updated properly, how a simple user can read this document and deploy SSL ?!?!?! hope splunk guys will check this and update soon.
the wiki.splunk on SSL also got multiple issues.

>>> Happy Splunking !
Get Updates on the Splunk Community!

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...