Why is the SSL connection between forwarder and indexer fails when password less certificates are used?

[strive]

Hi,

In the SSL/TLS world, it is not mandatory to have passwords for the private key. However, in case of Splunk, the SSL connection between forwarder and indexer fails when password less certificates are used.

After a bit of debugging, I found that Splunk adds password attribute to the [SSL] stanza of inputs.conf. I have a inputs.conf in /opt/splunk/etc/system/local/ directory. I haven't specified password (since the certificates that I am using are password less). Upon Splunk restart, it adds the password attribute with some hashed value. Due to this I am getting error as: ERROR TcpInputConfig - SSL server certificate not found, or password is wrong - SSL ports will not be opened

Splunk adding password attribute to inputs.conf is a bug or is it intended behavior? If it is intended behavior, then how to stop Splunk from editing files in /opt/splunk/etc/system/local/ directory?

Regards,
Strive

[strive · Accepted solution]

I dug deeper and found a way of making it work. I just concentrated on this portion of error - " error:0906D06C:PEM routines:PEM_read_bio:no start line".

Combining the cert and key into one file solved the issue.

The link that helped me with this is: https://snippets.aktagon.com/snippets/543-how-to-fix-pem-read-bio-no-start-line-error-nginx-error