Security

pdf server problem with wildcard ssl certificate

Path Finder

We installed wildcard certificates on our search heads (*.company.com) issued by "Trusted Secure Certificate Authority" this weekend (good 8/8/12- 8/9/15) and the PDF server stopped working. Web browsers (IE/Firefox/chrome) have no issues with the certificate using the splunk web GUI.

Splunk 4.3.3.
PDF server 1.3 (re-downloaded today).
PDF server is on local search head

The error in the PDF email is:
An error occurred while generating a PDF of this report:
Failed to generate PDF: Appserver failed to dispatch report request to /services/pdfserver/renderpdf: 400 Bad Request

Not quite the same error, I have tried this, and it still doesn't work:
http://splunk-base.splunk.com/answers/56947/how-do-i-fix-the-pdf-server-on-43-when-using-a-self-sign...

The logs in python.log are:

2012-09-04 13:03:30,644 ERROR PCDATA invalid Char value 26, line 164, column 1
Traceback (most recent call last):
File "/opt/splunk/bin/rest_handler.py", line 84, in <module>
print splunk.rest.dispatch(**params)
File "/opt/splunk/lib/python2.7/site-packages/splunk/rest/__init__.py", line 52, in dispatch requestXml = et.fromstring(requestInfo)
File "lxml.etree.pyx", line 2532, in lxml.etree.fromstring (src/lxml/lxml.etree.c:48634)
File "parser.pxi", line 1545, in lxml.etree._parseMemoryDocument (src/lxml/lxml.etree.c:72245)
File "parser.pxi", line 1424, in lxml.etree._parseDoc (src/lxml/lxml.etree.c:71106)
File "parser.pxi", line 938, in lxml.etree._BaseParser._parseDoc (src/lxml/lxml.etree.c:67875)
File "parser.pxi", line 539, in lxml.etree._ParserContext._handleParseResultDoc (src/lxml/lxml.etree.c:64257)
File "parser.pxi", line 625, in lxml.etree._handleParseResult (src/lxml/lxml.etree.c:65178)
File "parser.pxi", line 565, in lxml.etree._raiseParseError (src/lxml/lxml.etree.c:64521)
XMLSyntaxError: PCDATA invalid Char value 26, line 164, column 1
2012-09-04 13:03:30,738 ERROR An error occurred while generating a PDF of this report: Failed to generate PDF: Appserver failed to dispatch report request to /services/pdfserver/renderpdf: 400 Bad Request
2012-09-04 13:03:30,738 DEBUG simpleRequest > GET https://127.0.0.1:8089/services/search/jobs/scheduler__mylogin__search_dGVzdF9oZWFkMTAwMA_at_1346763... [] sessionSource=direct
2012-09-04 13:03:30,817 DEBUG simpleRequest < server responded status=200 responseTime=0.0781s
2012-09-04 13:03:30,817 DEBUG getStatus - elapsed=0.0789680480957 nextRetry=0.0500039395281
2012-09-04 13:03:31,248 INFO Sending email. subject="Splunk Alert: test_head1000" , results_link="https://lab.company.com:443/app/search/@go?sid=scheduler__mylogin__search_dGVzdF9oZWFkMTAwMA_at_1346763600_416e77d67eeee6a0", recepients="['me@company.com']"
Tags (1)
0 Karma

Path Finder

We had it too when we were at v.4.3
Could not make it work, even with Splunk Support.
Ended up sacrificing SSL in favor of PDF.
Now we're on v.5.0.5 and have no issues, but the PDF mechanism has changed in v.5 completely.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!