sslRootCAPath at server.conf

[inventsekar]

SSL is already complex one, this poor documentation adds the fuel to the fire

https://docs.splunk.com/Documentation/Splunk/6.4.4/Security/ConfigureSplunkforwardingtousesignedcert...
this says, we should update server.conf with sslRootCAPath info, but when splunkd restarts, it says the other way around.

[root@UF /app/JE0/splunkforwarder/etc/twoCerts]#/app/splunkforwarder/bin/splunk restart
Stopping splunkd...
Shutting down. Please wait, as this may take a few minutes.
............ [ OK ]
Stopping splunk helpers...
[ OK ]
Done.

Splunk> All batbelt. No tights.

Checking prerequisites...
Checking mgmt port [8089]: open
Checking conf files for problems...
*Invalid key in stanza [sslConfig] in /app/splunkforwarder/etc/system/local/server.conf, line 19: sslRootCAPath (value: /app/splunkforwarder/etc/twoCerts/cacert.pem). *
Your indexes and inputs configurations are not internally consistent. For more information, run 'splunk btool check --debug'
Done
Checking default conf files for edits...
Validating installed files against hashes from '/app/splunkforwarder/splunkforwarder-6.3.4-cae2458f4aef-linux-2.6-x86_64-manifest'
All installed files intact.
Done
All preliminary checks passed.

Starting splunk server daemon (splunkd)...
Done
[ OK ]
[root@UF /app/splunkforwarder/etc/twoCerts]#

[splunkreal]

Agreed, this is misleading.

[satyenshah]

Two pitfalls to watch out for:

2) The 'deprecated' settings don't appear to be really deprecated. Using v7.0.0, I still have to set caCertFile. If I try to set sslRootCAPath I get error "setting ignored under Windows". The Splunk docs for v7.0.0 say caCertFile is deprecated, but in practice it's not.

2) Splunk's SSL handling is intolerant of extra lines in PEM files. For example, if you start with a certificate in PFX and export to PEM, you end up with a lot of 'bag attributes' in the output PEM file. They look like comments in between the actual certificates. You have to manually strip out those lines so that the PEM file only contains lines that are either BEGIN, END, or Base64 encoded.

edit: Splunk appears to have fixed the sslRootCAPath problem in v7.1.2:
2018-06-15
SPL-149190, SPL-141808
(Windows Only) Support sslRootCAPath on Windows

[horsefez]

Hi inventsekar,

there is a parameter named caCertPath which is depreciated in recent splunk versions, but served as the sslRootCAPath parameter in past splunk versions.

You seem to use a splunkforwarder with the version 6.3.4. In this version caCertPath should work.

[inventsekar]

Thanks Pyro_wood,
sslRootCAPath works fine, but on inputs.conf file(not server.conf).

the document should be updated properly. if "SSL" is not updated properly, how a simple user can read this document and deploy SSL ?!?!?! hope splunk guys will check this and update soon.
the wiki.splunk on SSL also got multiple issues.