Why is there certificate exception error while posting data to splunk?

[Venkat_Kumar]

Hi Team,

I am getting below error while trying to post data to my splunk using below url. I have installed the certificates in the source system by taking them from browser(lock sysmbol)

Can you please check and help what certificates are exactly installed to post data to below URL

end point url: https://prd-p-jmw56.splunkcloud.com:8088/services/collector/raw

Error Details

java.net.ConnectException: java.security.cert.CertificateException: No name matching prd-p-jmw56.splunkcloud.com found, cause: java.security.cert.CertificateException: No name matching prd-p-jmw56.splunkcloud.com found

thanks,

Venkat

[PickleRick]

Contrary to the certificate served on port 443, the one used on 8088 is a Splunk's internal cert (the cert created  by default on installation).

The one used on the web interface port is a wildcard certificate for the whole splunkcloud .com domain so I presume it's not directly installed on "your" search heads but is served from some HTTP loadbalancer which also works as HTTPS offloading proxy.

I haven't used the cloud yet but I suppose if you want a "proper" trusted certificate you should contact cloud support (you won't be able to upload a certificate and add ssl settings on your own anyway I think).

[diogofgm]

Are you sending the data with the HEC token?

Check this docs:
https://docs.splunk.com/Documentation/Splunk/latest/Data/HECExamples

[Venkat_Kumar]

Hello,

Yes, i am created  HEC token in splunk and using it while trying to send data.

Also, i have modified the end point as below(added "inputs.") as per https://docs.splunk.com/Documentation/Splunk/8.0.3/Data/UsetheHTTPEventCollector# 

end point url: https://inputs.prd-p-jmw56.splunkcloud.com:8088/services/collector/raw 

Based on error, looks like i need to install hostname dedicated certificate. Any idea on how to get it or enable anything in splunk to receive data.

Error Details

java.net.ConnectException: java.security.cert.CertificateException: No name matching inputs.prd-p-jmw56.splunkcloud.com found, cause: java.security.cert.CertificateException: No name matching inputs.prd-p-jmw56.splunkcloud.com found

[diogofgm]

I haven't had much experience with splunk cloud but I recall you can download a UF package that contains all the necessary bit to connect to the cloud instance including the cert chain.

[Venkat_Kumar]

@diogofgm Thanks for your response.

Can you please provide me the path where i can check UF package which contains certificate details.

[diogofgm]

In Splunk Cloud in the Apps menu you have a Universal forwarder app. In that app you can download the UF package

[Venkat_Kumar]

Hi Experts,

Can you please help to guide on below issue

I am getting below error while trying to post data to my splunk using below url. I have installed the certificates in the source system by taking them from browser(lock sysmbol)

Can you please check and help what certificates are exactly installed to post data to below URL

end point url: https://prd-p-jmw56.splunkcloud.com:8088/services/collector/raw

Error Details

java.net.ConnectException: java.security.cert.CertificateException: No name matching prd-p-jmw56.splunkcloud.com found, cause: java.security.cert.CertificateException: No name matching prd-p-jmw56.splunkcloud.com found

thanks,

Venkat