How to fix missing SSL settings in Splunk 6.5.0?


We have 6.4.3 in production, and I'm just starting to test 6.5.0. When configuring SSL, I've found a few of the deprecated settings, and have fixed them. It works when I use the default Splunk certificates, but when I try to specify my own certificates, located in a different directory, I receive this error:

ERROR TcpInputConfig - SSL context cannot be created due to missing settings, Will not open Splunk to Splunk (SSL) IPv4 port 999

I swap between the certificates by changing inputs.conf/serverCert and server.conf/sslRootCAPath to point to the appropriate certificates. I've not found anything in splunkd.log to indicate what settings are missing.

In case it matters, my certificates were created using a version of that was modified to use -sha256 instead of -sha1, and I invoke it with -l 2048, as our security compliance requires the longer key and sha256.

0 Karma


Double check your certificate paths in server.conf and inputs.conf. I had a typo in one of my cert paths and it generated this error.

If that isn't it, I'd try running the following to make sure your SSL configuration is coming from where you expect:

bin/splunk cmd btool inputs list --debug
bin/splunk cmd btool server list --debug
0 Karma

Path Finder

Hi Rkilen,

I had this error show up on an indexer I'm configuring just now. Turns out that I had forgotten to place an [SSL] config stanza in my inputs.conf file on the indexer.

Here's the config that I have that is now working - both under etc/system/local/ on the indexer:


sslRootCAPath = /etc/pki/tls/certs/acmecorp-root-ca.pem
sslPassword = [redacted]
sslVersions = tls1.2
sslVerifyServerCert = true
serverCert = /etc/pki/tls/certs/splunk-indexer.pem
sendStrictTransportSecurityHeader = true


disabled = false
password = [redacted]
rootCA = /etc/pki/tls/certs/acmecorp-root-ca.pem
serverCert = /etc/pki/tls/certs/splunk-indexer.pem

Hope this helps.

0 Karma


Adding a comment, as this isn't really a solution...

I got my certificates to work by manually invoking Splunk's createssl command to create server.pem. Unfortunately, it is sha1, even though cacert.pem is sha256, and createssl doesn't appear to have an option to specify sha256.

As far as I can tell, when splunkd first starts with the default SSL certificates configured, it knows to create server.pem in the default directory, but when starting with certificates in a different directory it doesn't create server.pem for some reason. Is this the intended behavior for 6.5.0?

I tried adding the deprecated caPath to see if it would generate the server.pem, but that didn't work (not surprising, really).

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...