How to fix missing SSL settings in Splunk 6.5.0?


We have 6.4.3 in production, and I'm just starting to test 6.5.0. When configuring SSL, I've found a few of the deprecated settings, and have fixed them. It works when I use the default Splunk certificates, but when I try to specify my own certificates, located in a different directory, I receive this error:

ERROR TcpInputConfig - SSL context cannot be created due to missing settings, Will not open Splunk to Splunk (SSL) IPv4 port 999

I swap between the certificates by changing inputs.conf/serverCert and server.conf/sslRootCAPath to point to the appropriate certificates. I've not found anything in splunkd.log to indicate what settings are missing.

In case it matters, my certificates were created using a version of that was modified to use -sha256 instead of -sha1, and I invoke it with -l 2048, as our security compliance requires the longer key and sha256.

0 Karma


Double check your certificate paths in server.conf and inputs.conf. I had a typo in one of my cert paths and it generated this error.

If that isn't it, I'd try running the following to make sure your SSL configuration is coming from where you expect:

bin/splunk cmd btool inputs list --debug
bin/splunk cmd btool server list --debug
0 Karma

Path Finder

Hi Rkilen,

I had this error show up on an indexer I'm configuring just now. Turns out that I had forgotten to place an [SSL] config stanza in my inputs.conf file on the indexer.

Here's the config that I have that is now working - both under etc/system/local/ on the indexer:


sslRootCAPath = /etc/pki/tls/certs/acmecorp-root-ca.pem
sslPassword = [redacted]
sslVersions = tls1.2
sslVerifyServerCert = true
serverCert = /etc/pki/tls/certs/splunk-indexer.pem
sendStrictTransportSecurityHeader = true


disabled = false
password = [redacted]
rootCA = /etc/pki/tls/certs/acmecorp-root-ca.pem
serverCert = /etc/pki/tls/certs/splunk-indexer.pem

Hope this helps.

0 Karma


Adding a comment, as this isn't really a solution...

I got my certificates to work by manually invoking Splunk's createssl command to create server.pem. Unfortunately, it is sha1, even though cacert.pem is sha256, and createssl doesn't appear to have an option to specify sha256.

As far as I can tell, when splunkd first starts with the default SSL certificates configured, it knows to create server.pem in the default directory, but when starting with certificates in a different directory it doesn't create server.pem for some reason. Is this the intended behavior for 6.5.0?

I tried adding the deprecated caPath to see if it would generate the server.pem, but that didn't work (not surprising, really).

0 Karma
Get Updates on the Splunk Community!

Don't wait! Accept the Mission Possible: Splunk Adoption Challenge Now and Win ...

Attention everyone! We have exciting news to share! We are recruiting new members for the Mission Possible: ...

Unify Your SecOps with Splunk Mission Control

In today’s post, I'm excited to share some recent Splunk Mission Control innovations. With Splunk Mission ...

Data Preparation Made Easy: SPL2 for Edge Processor

By now, you may have heard the exciting news that Edge Processor, the easy-to-use Splunk data preparation tool ...