How to fix missing SSL settings in Splunk 6.5.0?

[rkilen]

We have 6.4.3 in production, and I'm just starting to test 6.5.0. When configuring SSL, I've found a few of the deprecated settings, and have fixed them. It works when I use the default Splunk certificates, but when I try to specify my own certificates, located in a different directory, I receive this error:

ERROR TcpInputConfig - SSL context cannot be created due to missing settings, Will not open Splunk to Splunk (SSL) IPv4 port 999

I swap between the certificates by changing inputs.conf/serverCert and server.conf/sslRootCAPath to point to the appropriate certificates. I've not found anything in splunkd.log to indicate what settings are missing.

In case it matters, my certificates were created using a version of genRootCA.sh that was modified to use -sha256 instead of -sha1, and I invoke it with -l 2048, as our security compliance requires the longer key and sha256.

[jsrobard]

Double check your certificate paths in server.conf and inputs.conf. I had a typo in one of my cert paths and it generated this error.

If that isn't it, I'd try running the following to make sure your SSL configuration is coming from where you expect:

bin/splunk cmd btool inputs list --debug
bin/splunk cmd btool server list --debug

[bowendenning]

Hi Rkilen,

I had this error show up on an indexer I'm configuring just now. Turns out that I had forgotten to place an [SSL] config stanza in my inputs.conf file on the indexer.

Here's the config that I have that is now working - both under etc/system/local/ on the indexer:

server.conf

[sslConfig]
sslRootCAPath = /etc/pki/tls/certs/acmecorp-root-ca.pem
sslPassword = [redacted]
sslVersions = tls1.2
sslVerifyServerCert = true
serverCert = /etc/pki/tls/certs/splunk-indexer.pem
sendStrictTransportSecurityHeader = true

inputs.conf

[splunktcp-ssl://9997]
disabled = false
[SSL]
password = [redacted]
rootCA = /etc/pki/tls/certs/acmecorp-root-ca.pem
serverCert = /etc/pki/tls/certs/splunk-indexer.pem

Hope this helps.

[rkilen]

Adding a comment, as this isn't really a solution...

I got my certificates to work by manually invoking Splunk's createssl command to create server.pem. Unfortunately, it is sha1, even though cacert.pem is sha256, and createssl doesn't appear to have an option to specify sha256.

As far as I can tell, when splunkd first starts with the default SSL certificates configured, it knows to create server.pem in the default directory, but when starting with certificates in a different directory it doesn't create server.pem for some reason. Is this the intended behavior for 6.5.0?

I tried adding the deprecated caPath to see if it would generate the server.pem, but that didn't work (not surprising, really).