cacert.pem - Why does Splunk need it to start?

[ebdavis]

Quick details: We are running Splunk 6.4.2 on Windows 2k8 as a standalone deployment. We are using third part certs with the root and intermediary certs in the cert chain. I have specified web.conf to use that particular certificate and the generated server key.

Issue: Our IAVM scanner and STIG scans report the self-signing CA and [out of the box] Splunk self-signed certs as a finding. As a troubleshooting step, I archived them and removed them from the Splunk directory and restarted Splunk. Now it will not start as it is complaining that it is unable to locate "cacert.pem" and is unable to generate the SSL certificates. I'm a bit confused as we have installed this on another host and removed the certs in the same fashion with no issue.

[splunkreal]

Hello, what about ca.pem, what is its role? Thanks.

[hardikJsheth]

The cacert.pem is used by Splunk's management port. In case you don't want to use it, you need to update the certificate used by management port.

To do this you need to perform two steps:
1) Create one .pem file with both private key and public key of your certificate. Copy this file into $SPLUNK_HOME/etc/auth/. (This is required because Splunk provides only single parameter for defining certificate for management port.

2) Use this certificate for your management port by adding following configuration in $SPLUNK_HOME/etc/system/local/server.conf

[sslConfig]
sslKeysfile = splunkweb/mysplunk.pem
sslKeysfilePassword =