Security

how do I define an intermediate certificate authority for SplunkWeb?

matt
Splunk Employee
Splunk Employee

I have an SSL cert signed by a third-party CA. I point to it in the in the web.conf file (caCertPath=/certs/cert.pem), restart splunkweb and connect via https://server:8000. I can see my cert file is being read, but the connection is untrusted because I haven't installed the intermediate cert file anywhere. HOW/WHERE do I install the intermediate cert?

1 Solution

dwaddle
SplunkTrust
SplunkTrust

Hi Matt,

This should work, based on my reading of the Python SSL stuff in Python 2.6 w/ Cherrypy (which is what sits under mrsparkle)

Put both your intermediate cert and your issued cert in the cert.pem file, one after the other. Borrowing from the python docs:

-----BEGIN CERTIFICATE-----
... (certificate for your server)...
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
... (the intermediate certificate)...
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
... (the root certificate for the CA)...
-----END CERTIFICATE-----

If you don't have the root cert I don't think it is strictly necessary, as the client's browser should have it.

View solution in original post

dwaddle
SplunkTrust
SplunkTrust

Hi Matt,

This should work, based on my reading of the Python SSL stuff in Python 2.6 w/ Cherrypy (which is what sits under mrsparkle)

Put both your intermediate cert and your issued cert in the cert.pem file, one after the other. Borrowing from the python docs:

-----BEGIN CERTIFICATE-----
... (certificate for your server)...
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
... (the intermediate certificate)...
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
... (the root certificate for the CA)...
-----END CERTIFICATE-----

If you don't have the root cert I don't think it is strictly necessary, as the client's browser should have it.

adamw
Communicator

What about using Apache in front of Splunkweb. I would very much recommend it. There are other solutions on answers using Mod_proxy in Apache to do this.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...