Installation

Missing "server.pem" file

Yogen
New Member

Hi everyone, I faced an error while accepting the license for Splunk. I am using Linux Ubuntu OS. The details of the error are as shown below:

This appears to be your first time running this version of Splunk.
ERROR: "/home/yogen6116/download/splunk/etc/auth/server.pem": not found
ERROR while running renew-certs migration.

I found that the "server.pem" file is missing from the Splunk package that I have downloaded. Can anyone direct me on how to solve this error?

Tags (1)
0 Karma
1 Solution

nychawk
Communicator

Did you download from Splunk, or copy from somewhere else?

I suggest you download the 32 or 64 bit tar file and start over again.

View solution in original post

0 Karma

nychawk
Communicator

Did you download from Splunk, or copy from somewhere else?

I suggest you download the 32 or 64 bit tar file and start over again.

0 Karma

splunk24
Path Finder

i am also seeing the same in my production env .. server.pem is missing
can we generate the same again ?
we want to use server.pem for forwarders to indexers secure data trasnsfer ssl using certs
please help

0 Karma

renjith_nair
Legend

Which version of splunk you are using? Looks like you are doing an upgrade. Is it ?

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

vanallp
Explorer

I'm upgrading from 6.3.2 to 6.3.3 on a rhel7.2 machine, that is NOT in TEST of PROD. I was just running through the update procedure.

tar -zxf splunkforwarder-6.3.3-f44afce176d0-Linux-x86_64.tgz  -C /opt
chown -R root:root /opt/splunkforwarder
/opt/splunkforwarder/bin/splunk start
... accept license... 
Perform migration and upgrade without previewing configuration changes? [y/n] n

-- Migration information is being logged to '/opt/splunkforwarder/var/log/splunk/migration.log.2016-02-10.13-41-10' --

Migrating to:
VERSION=6.3.3
BUILD=f44afce176d0
PRODUCT=splunk
PLATFORM=Linux-x86_64
********** BEGIN PREVIEW OF CONFIGURATION FILE MIGRATION **********

ERROR: "/opt/splunkforwarder/etc/auth/server.pem": not found
ERROR while running renew-certs migration.
[root@master ~]#

It's looking for something that does not exist. what I see is:

[root@master ~]# ll /opt/splunkforwarder/etc/auth/
total 20
-rw-r--r--. 1 root root 3908 Jan 31 14:44 appsCA.pem
-rw-------. 1 root root  912 Jan 28 12:49 cacert.pem
-rw-r--r--. 1 root root  912 Jan 31 14:44 cacert.pem.default
-rw-------. 1 root root 1828 Jan 28 12:49 ca.pem
-rw-r--r--. 1 root root 1828 Jan 31 14:44 ca.pem.default
[root@master ~]#

So I looked at my real test environment and my master/indeder/search heads have:

-rw-r--r-- 1 root root 3908 Dec  9 07:07 appsCA.pem
-rw------- 1 root root  912 Jan 12 22:38 cacert.pem
-rw-r--r-- 1 root root  912 Dec  9 07:07 cacert.pem.default
-rw------- 1 root root 1828 Jan 12 22:38 ca.pem
-rw-r--r-- 1 root root 1828 Dec  9 07:07 ca.pem.default
-rw------- 1 root root   17 Jan 12 22:38 ca.srl
-rw------- 1 root root 1041 Jan 12 22:38 privKeySecure.pem
-rw------- 1 root root  595 Jan 12 22:38 req.pem
-rw------- 1 root root 2767 Jan 12 22:38 server.pem
-r-------- 1 root root  255 Jan 12 22:38 splunk.secret
drwx------ 2 root root   39 Jan 12 22:38 splunkweb

So my general assumption is that when I update a 'real' machine, the update will continue.

cheers,
paul

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...