Installation

Splunk Web Server SSL Access to Search Engine using v9.2.x

Ken_Taylor
Engager

Hi, 

I have been working for a day or so on getting this to work. 

Here is my web.conf file configuration 

[settings]
httpport = 443
loginBackgroundImageOption = custom
loginCustomBackgroundImage = search:logincustombg/Hub_Arial.jpg

enableSplunkWebSSL = true
privKeyPath = /opt/splunk/share/splunk/certs/decrypted-xxx_2025_wc.key
serverCert = /opt/splunk/share/splunk/certs/splunk-wc-xxx-com.pem

the key file is the decrypted certificate, the server cert is the server cert, the intermediate and root from godaddy g2. 

I am currently running splunk 9.2.x 

I am not finding a quick how to to complete this task and I am working if someone could give me a hand. 

I am using Wireshark off the firefox browser and sometimes I see the client request but never see the server request. 

I am not doing this from the command line or the web server, I am updating the files and restarting splunkd. 

Thanks in advance for your assistance.  Please let me know if there are any questions.  

Labels (1)
Tags (1)
0 Karma

Tom_Lundie
Contributor

Hi,

There could be a few things going on here.

I would hazard a guess that you're running Splunk as a non-root user trying to bind to port 443 which is a privileged-port. Check if Splunk is listening on 443/TCP:

 

 

ss -tlp

 

 

Also, check for web related messages under:

$SPLUNK_HOME/bin/splunk status
And UiHttpListener entries in /opt/splunk/var/log/splunk/splunkd.log.

If this is indeed your problem, I suggest that you use different port such as 8443. You could also try to allow Splunk to bind to the system ports, you will need to research how to do this securely for your environment.

If Splunk is listening on 443, start working your way out:

  • Are there any error entries in splunkd.log.
  • Can you curl it via local host

 

curl -kv https://localhost​

 

  • Are you dropping connections on the local FW?

 

firewall-cmd --list-all

 

  • Is there a routing issue / network firewall between your client browser and Splunk instance?
  • Is there an issue with client machine / browser?

Feel free to upload any relevant Splunkd.log entries, redacted appropriately to help troubleshooting.

 

 

 

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...