Security

pdf server problem with wildcard ssl certificate

troywollenslege
Path Finder

We installed wildcard certificates on our search heads (*.company.com) issued by "Trusted Secure Certificate Authority" this weekend (good 8/8/12- 8/9/15) and the PDF server stopped working. Web browsers (IE/Firefox/chrome) have no issues with the certificate using the splunk web GUI.

Splunk 4.3.3.
PDF server 1.3 (re-downloaded today).
PDF server is on local search head

The error in the PDF email is:
An error occurred while generating a PDF of this report:
Failed to generate PDF: Appserver failed to dispatch report request to /services/pdfserver/renderpdf: 400 Bad Request

Not quite the same error, I have tried this, and it still doesn't work:
http://splunk-base.splunk.com/answers/56947/how-do-i-fix-the-pdf-server-on-43-when-using-a-self-sign...

The logs in python.log are:

2012-09-04 13:03:30,644 ERROR PCDATA invalid Char value 26, line 164, column 1
Traceback (most recent call last):
File "/opt/splunk/bin/rest_handler.py", line 84, in <module>
print splunk.rest.dispatch(**params)
File "/opt/splunk/lib/python2.7/site-packages/splunk/rest/__init__.py", line 52, in dispatch requestXml = et.fromstring(requestInfo)
File "lxml.etree.pyx", line 2532, in lxml.etree.fromstring (src/lxml/lxml.etree.c:48634)
File "parser.pxi", line 1545, in lxml.etree._parseMemoryDocument (src/lxml/lxml.etree.c:72245)
File "parser.pxi", line 1424, in lxml.etree._parseDoc (src/lxml/lxml.etree.c:71106)
File "parser.pxi", line 938, in lxml.etree._BaseParser._parseDoc (src/lxml/lxml.etree.c:67875)
File "parser.pxi", line 539, in lxml.etree._ParserContext._handleParseResultDoc (src/lxml/lxml.etree.c:64257)
File "parser.pxi", line 625, in lxml.etree._handleParseResult (src/lxml/lxml.etree.c:65178)
File "parser.pxi", line 565, in lxml.etree._raiseParseError (src/lxml/lxml.etree.c:64521)
XMLSyntaxError: PCDATA invalid Char value 26, line 164, column 1
2012-09-04 13:03:30,738 ERROR An error occurred while generating a PDF of this report: Failed to generate PDF: Appserver failed to dispatch report request to /services/pdfserver/renderpdf: 400 Bad Request
2012-09-04 13:03:30,738 DEBUG simpleRequest > GET https://127.0.0.1:8089/services/search/jobs/scheduler__mylogin__search_dGVzdF9oZWFkMTAwMA_at_1346763... [] sessionSource=direct
2012-09-04 13:03:30,817 DEBUG simpleRequest < server responded status=200 responseTime=0.0781s
2012-09-04 13:03:30,817 DEBUG getStatus - elapsed=0.0789680480957 nextRetry=0.0500039395281
2012-09-04 13:03:31,248 INFO Sending email. subject="Splunk Alert: test_head1000" , results_link="https://lab.company.com:443/app/search/@go?sid=scheduler__mylogin__search_dGVzdF9oZWFkMTAwMA_at_1346763600_416e77d67eeee6a0", recepients="['me@company.com']"
Tags (1)
0 Karma

cgisplunk
Path Finder

We had it too when we were at v.4.3
Could not make it work, even with Splunk Support.
Ended up sacrificing SSL in favor of PDF.
Now we're on v.5.0.5 and have no issues, but the PDF mechanism has changed in v.5 completely.

0 Karma
Get Updates on the Splunk Community!

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...