- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Following is the error after i update web.conf with certificate and keys i have from a CA authority.
Splunk> CSI: Logfiles.
Checking prerequisites...
Checking http port [8000]: open
Checking mgmt port [8089]: open
Checking appserver port [127.0.0.1:8065]: open
Checking kvstore port [8191]: open
Checking configuration... Done.
Checking critical directories... Done
Checking indexes...
Validated: _xxxxxx
Done
Checking filesystem compatibility... Done
Checking conf files for problems...
Done
Checking default conf files for edits...
Validating installed files against hashes from '/opt/splunk/splunk-7. 2.3-06d57c595b80-linux-2.6-x86_64-manifest'
File '/opt/splunk/etc/system/default/web.conf' changed.
Problems were found, please review your files and move customizations to local
All preliminary checks passed.
+++ FIX +++
Issue was fixed by copying certificate files to mycert directory i.e default directory with splunk installation. for my case opt/splunk/etc/auth directory, and use the relative path in config file rather than absolute.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Issue fixed by copying files to mycert directory in /splunk/etc/auth directory.
and use the relative path in config file rather than absolute.
For some reason config file parser isn't working as expected for absolute path.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Issue fixed by copying files to mycert directory in /splunk/etc/auth directory.
and use the relative path in config file rather than absolute.
For some reason config file parser isn't working as expected for absolute path.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content


@zerocool443 If your problem is resolved, please accept the answer to help future readers.
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Ok i found the issue here :
09-17-2019 12:07:58.979 +0530 ERROR SSLCommon - Can't read certificate file /opt/splunk/ errno=33558530 error:02001002:system library:fopen:No such file or directory
09-17-2019 12:07:58.979 +0530 ERROR HTTPServer - SSL context could not be created - error in cert or password is wrong
This point that splunk is not able to file the find in directory but the file exists there.
Now after i check splunk documentation, i have given an absolute path instead of relative to $SPLUNK_HOME$.
Any splunk devs for rescue ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Issue fixed by copying files to mycert directory in /splunk/etc/auth directory.
and use the relative path in config file rather than absolute.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Checking weservice logs for splunk gives no error.
attaching info messages:
2019-09-17 11:30:53,577 INFO [5d807694a97f935f818050] root:657 - CONFIG: privKeyPath (str):
2019-09-17 11:30:53,579 INFO [5d807694a97f935f818050] root:657 - CONFIG: serverCert (str):
2019-09-17 11:39:46,885 INFO [5d8078a9f27fc6d8154090] root:657 - CONFIG: serverCert (str): $SPLUNK_HOME/etc/auth/splunkweb/mycer.pem
2019-09-17 11:42:24,773 INFO [5d807947cb7f7b3b943090] root:657 - CONFIG: serverCert (str): $SPLUNK_HOME/etc/auth/splunkweb/mycer.pem
2019-09-17 11:47:40,686 INFO [5d807a83be7f4170b84090] root:657 - CONFIG: privKeyPath (str):
2019-09-17 11:47:40,688 INFO [5d807a83be7f4170b84090] root:657 - CONFIG: serverCert (str):
