Issue enabling HTTPS on Splunk Web using external SSL certificate

[kn450]

Hello everyone,
I’m encountering an issue when trying to enable secure HTTPS access on Splunk Web using an SSL certificate issued by a trusted external CA.

---

What I did:

• Placed the SSL certificate file (splunkWeb.pem) in the following path:
  $SPLUNK_HOME/etc/apps/webTLS/certs/splunkWeb.pem

• Edited the web.conf file with the following settings:

  ini

  CopyEdit

  [settings]
  enableSplunkWebSSL = true
  serverCert = $SPLUNK_HOME/etc/apps/webTLS/certs/splunkWeb.pem
  privKeyPath = $SPLUNK_HOME/etc/apps/webTLS/certs/splunkWeb.pem

• Restarted the Splunk service.

  ---

  Issue:
  After restarting, Splunk hangs during startup and the web interface does not become available over HTTPS.

  ---

  Questions:

  • Are there additional steps required when using an external SSL certificate?

  • Is the web.conf configuration correct, especially regarding the privKeyPath pointing to the same .pem file as serverCert?

  • Should the private key be in a separate file from the certificate?

  • Any advice or similar experiences would be greatly appreciated.

    ---

    Thank you in advance for your help!

[PrewinThomas]

@kn450 

In your config, both (serverCert and privKeyPath both pointing to splunkWeb.pem).

Is your splunkWeb.pem contains both private key and cert together? Its better to have privatekey and certificate separate.
If your splunkWeb.pem contains both, you can use openssl command to split both.

Ref
#https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/9.4/secure-splunk-...

Regards,
Prewin
Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!

[livehybrid]

Hi @kn450 

You should put the Cert/Intermediate(s)/CA in splunkWeb.pem but not the key, that should go in its own file (e.g. splunkWeb.key) and use the privKeyPath setting to set the location for this.

[settings]
enableSplunkWebSSL = true
privKeyPath = /opt/splunk/etc/apps/webTLS/certs/splunkWeb.key
serverCert = /opt/splunk/etc/apps/webTLS/certs/splunkWeb.pem

Note: You may use absolute paths when you configure these settings by prepending a / to the path. Non-absolute paths are relative to the Splunk installation directory ($SPLUNK_HOME). If you use a non-absolute path, do not add $SPLUNK_HOME to the path

 If this does not work, please could you look in $SPLUNK_HOME/var/log/splunk/splunkd.log for any error logs which might indicate what is preventing it from starting?

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing