We have 6.4.3 in production, and I'm just starting to test 6.5.0. When configuring SSL, I've found a few of the deprecated settings, and have fixed them. It works when I use the default Splunk certificates, but when I try to specify my own certificates, located in a different directory, I receive this error:
ERROR TcpInputConfig - SSL context cannot be created due to missing settings, Will not open Splunk to Splunk (SSL) IPv4 port 999
I swap between the certificates by changing inputs.conf/serverCert and server.conf/sslRootCAPath to point to the appropriate certificates. I've not found anything in splunkd.log to indicate what settings are missing.
In case it matters, my certificates were created using a version of genRootCA.sh that was modified to use -sha256 instead of -sha1, and I invoke it with -l 2048, as our security compliance requires the longer key and sha256.
Adding a comment, as this isn't really a solution...
I got my certificates to work by manually invoking Splunk's createssl command to create server.pem. Unfortunately, it is sha1, even though cacert.pem is sha256, and createssl doesn't appear to have an option to specify sha256.
As far as I can tell, when splunkd first starts with the default SSL certificates configured, it knows to create server.pem in the default directory, but when starting with certificates in a different directory it doesn't create server.pem for some reason. Is this the intended behavior for 6.5.0?
I tried adding the deprecated caPath to see if it would generate the server.pem, but that didn't work (not surprising, really).