Security

Wildcard certificate and PDF 1.3 failed to generate PDF: 400 Bad Request

Splunk Employee
Splunk Employee

PDF 1.3 under Splunk 4.3.3 was working fine until I replaced the current cert with a new wildcard certificate.

I get the email alert but instead of the expected results, the contents have the error message:

An error occurred while generating a PDF of this report: Failed to generate PDF: Appserver failed to dispatch report request to /services/pdfserver/renderpdf: 400 Bad Request

The python.log also reports the following:

XMLSyntaxError: PCDATA invalid Char value 26, line 164, column 1
2012-09-04 17:00:41,204 ERROR PCDATA invalid Char value 26, line 164, column 1
Traceback (most recent call last):
  File "/opt/splunk/bin/rest_handler.py", line 84, in <module>
    print splunk.rest.dispatch(**params)
  File "/opt/splunk/lib/python2.7/site-packages/splunk/rest/__init__.py", line 52, in dispatch
    requestXml = et.fromstring(requestInfo)
  File "lxml.etree.pyx", line 2532, in lxml.etree.fromstring (src/lxml/lxml.etree.c:48634)
  File "parser.pxi", line 1545, in lxml.etree._parseMemoryDocument (src/lxml/lxml.etree.c:72245)
  File "parser.pxi", line 1424, in lxml.etree._parseDoc (src/lxml/lxml.etree.c:71106)
  File "parser.pxi", line 938, in lxml.etree._BaseParser._parseDoc (src/lxml/lxml.etree.c:67875)
  File "parser.pxi", line 539, in lxml.etree._ParserContext._handleParseResultDoc (src/lxml/lxml.etree.c:64257)
  File "parser.pxi", line 625, in lxml.etree._handleParseResult (src/lxml/lxml.etree.c:65178)
  File "parser.pxi", line 565, in lxml.etree._raiseParseError (src/lxml/lxml.etree.c:64521)
XMLSyntaxError: PCDATA invalid Char value 26, line 164, column 1
2012-09-04 17:00:41,258 ERROR An error occurred while generating a PDF of this report: Failed to generate PDF: Appserver failed to dispatch report request to /services/pdfserver/renderpdf: 400 Bad Request
2012-09-04 17:00:41,259 DEBUG simpleRequest > GET https://127.0.0.1:8089/services/search/jobs/scheduler__admin__search_ZGF2ZWgtcGRmdGVzd_at_1346778000... [] sessionSource=direct
2012-09-04 17:00:41,274 DEBUG simpleRequest < server responded status=200 responseTime=0.0149s
2012-09-04 17:00:41,274 DEBUG getStatus - elapsed=0.0153450965881 nextRetry=0.0500000289067
2012-09-04 17:00:58,024 INFO Sending email. subject="Splunk Alert: booboos-pdftest", results_link="https://mycompany.com:443/app/search/@go?sid=scheduler__admin__search_ZGF2ZWgtcGRmdGVzd_at_1346778000_662428414fef0f15", recepients="['yogibear@mycompany.com']"
Tags (2)
1 Solution

Splunk Employee
Splunk Employee

By temporarily enabling debug mode for python eg. creating $SPLUNK_HOME/etc/log-local.cfg to include

[python]
splunk = DEBUG

Review of python.log showed control character, ^Z at the end of the certificate specification.

Found ^Z in both the .crt and .pem files. Once removed, PDF generation was working again.

View solution in original post

Splunk Employee
Splunk Employee

By temporarily enabling debug mode for python eg. creating $SPLUNK_HOME/etc/log-local.cfg to include

[python]
splunk = DEBUG

Review of python.log showed control character, ^Z at the end of the certificate specification.

Found ^Z in both the .crt and .pem files. Once removed, PDF generation was working again.

View solution in original post