SSL mixed mode warning on splunkweb login page

[jeff]

Situation: SSL enabled SplunkWeb. Enterprise evaluation license. Upon connecting to the log-in page, users are presented with a warning that some of the content is unencrypted.

Aside from the login page, this warning does not present itself anywhere else (that I've found yet) in SplunkWeb. The offending code seems to be a result of two calls over http to quickdraw.splunk.com.

We've trained our users to pay attention to warnings, so this is something we'd like to clear up. Is there any way to disable those calls, encrypt them, etc? If this is a license check, perhaps a call directly from the splunkweb server to the source instead of through the client's browser?

[rayfoo]

In addition to jeff's answer:

This arises because of the way updates are checked everytime a user goes to the login page: the file is requested over HTTP, which causes the mixed mode warning.

One way would be to set (as jeff said) $SPLUNK_HOME/etc/system/local/web.conf

[settings] updateCheckerBaseURL = 0

Another way would be for Splunk to modify the login page to detect when it is being served over HTTPS and call the version checks over HTTPS too 😉

[jeff · Accepted solution]

To disable automatic checking, add to your $SPLUNK_HOME/etc/system/local/web.conf in

[settings]
updateCheckerBaseURL = 0

This tip is from this answers posting.