Installation

After upgrading from Splunk 6.2.3 to 6.3.0, why am I getting renew-certs startup error "not a renewed Splunk certificate: aborting renewal"?

davebo1896
Communicator

Hi,

I was doing an upgrade from Splunk 6.2.3 to 6.3.0. Installation went fine, but when I start Splunk for the first time, I'm getting the error below:

ERROR: "/opt/splunk/etc/auth/ca.pem.default": not a renewed Splunk certificate: aborting renewal
ERROR while running renew-certs migration.

Thanks!

Labels (1)
1 Solution

davebo1896
Communicator

I had replaced the entire etc/auth directory from the old install (parallel install), the upgrade did not recognize the certs.
To rectify this, copy only the following files from the old etc dir

etc/passwd
etc/auth/splunk.secret
etc/auth/distServerKeys/*
etc/auth/<your self generated keys, if any>/*

View solution in original post

0 Karma

neelamsantosh
Path Finder

I could able to resolve the issue by replacing from backup-auth folder.
Hope u too have taken backup.

remove the auth folder which is generated after installation and replace from my backup folder.
start the splunk .

commands:
sudo su splunk

rm -rf /opt/splunk/etc/auth
mv //opt/splunk/etc/auth/ /opt/splunk/etc/

sudo chown -R splunk.splunk /opt/splunk

/opt/splunk/bin/splunk start --accept-license --answer-yes

0 Karma

neelshah
Path Finder

HI All,
I had a similar issue in my environment.

I just deleted $SPLUNK_HOME/etc/auth/ca.pem (Old Certificate) ...and then tried to start the splunk. Things worked fine for me.
(Well do take backup before you delete)

Regards,
Neel Shah

davebo1896
Communicator

I had replaced the entire etc/auth directory from the old install (parallel install), the upgrade did not recognize the certs.
To rectify this, copy only the following files from the old etc dir

etc/passwd
etc/auth/splunk.secret
etc/auth/distServerKeys/*
etc/auth/<your self generated keys, if any>/*
0 Karma

davebo1896
Communicator

and etc/splunk-launch.conf !

Note: You will also need apps and users dirs. Get only app "local" dirs for apps that come packaged with Splunk.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...