Security

pdf server problem with wildcard ssl certificate

troywollenslege
Path Finder

We installed wildcard certificates on our search heads (*.company.com) issued by "Trusted Secure Certificate Authority" this weekend (good 8/8/12- 8/9/15) and the PDF server stopped working. Web browsers (IE/Firefox/chrome) have no issues with the certificate using the splunk web GUI.

Splunk 4.3.3.
PDF server 1.3 (re-downloaded today).
PDF server is on local search head

The error in the PDF email is:
An error occurred while generating a PDF of this report:
Failed to generate PDF: Appserver failed to dispatch report request to /services/pdfserver/renderpdf: 400 Bad Request

Not quite the same error, I have tried this, and it still doesn't work:
http://splunk-base.splunk.com/answers/56947/how-do-i-fix-the-pdf-server-on-43-when-using-a-self-sign...

The logs in python.log are:

2012-09-04 13:03:30,644 ERROR PCDATA invalid Char value 26, line 164, column 1
Traceback (most recent call last):
File "/opt/splunk/bin/rest_handler.py", line 84, in <module>
print splunk.rest.dispatch(**params)
File "/opt/splunk/lib/python2.7/site-packages/splunk/rest/__init__.py", line 52, in dispatch requestXml = et.fromstring(requestInfo)
File "lxml.etree.pyx", line 2532, in lxml.etree.fromstring (src/lxml/lxml.etree.c:48634)
File "parser.pxi", line 1545, in lxml.etree._parseMemoryDocument (src/lxml/lxml.etree.c:72245)
File "parser.pxi", line 1424, in lxml.etree._parseDoc (src/lxml/lxml.etree.c:71106)
File "parser.pxi", line 938, in lxml.etree._BaseParser._parseDoc (src/lxml/lxml.etree.c:67875)
File "parser.pxi", line 539, in lxml.etree._ParserContext._handleParseResultDoc (src/lxml/lxml.etree.c:64257)
File "parser.pxi", line 625, in lxml.etree._handleParseResult (src/lxml/lxml.etree.c:65178)
File "parser.pxi", line 565, in lxml.etree._raiseParseError (src/lxml/lxml.etree.c:64521)
XMLSyntaxError: PCDATA invalid Char value 26, line 164, column 1
2012-09-04 13:03:30,738 ERROR An error occurred while generating a PDF of this report: Failed to generate PDF: Appserver failed to dispatch report request to /services/pdfserver/renderpdf: 400 Bad Request
2012-09-04 13:03:30,738 DEBUG simpleRequest > GET https://127.0.0.1:8089/services/search/jobs/scheduler__mylogin__search_dGVzdF9oZWFkMTAwMA_at_1346763... [] sessionSource=direct
2012-09-04 13:03:30,817 DEBUG simpleRequest < server responded status=200 responseTime=0.0781s
2012-09-04 13:03:30,817 DEBUG getStatus - elapsed=0.0789680480957 nextRetry=0.0500039395281
2012-09-04 13:03:31,248 INFO Sending email. subject="Splunk Alert: test_head1000" , results_link="https://lab.company.com:443/app/search/@go?sid=scheduler__mylogin__search_dGVzdF9oZWFkMTAwMA_at_1346763600_416e77d67eeee6a0", recepients="['me@company.com']"
Tags (1)
0 Karma

cgisplunk
Path Finder

We had it too when we were at v.4.3
Could not make it work, even with Splunk Support.
Ended up sacrificing SSL in favor of PDF.
Now we're on v.5.0.5 and have no issues, but the PDF mechanism has changed in v.5 completely.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Index This | What travels the world but is also stuck in place?

April 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Discover New Use Cases: Unlock Greater Value from Your Existing Splunk Data

Realizing the full potential of your Splunk investment requires more than just understanding current usage; it ...

Continue Your Journey: Join Session 2 of the Data Management and Federation Bootcamp ...

As data volumes continue to grow and environments become more distributed, managing and optimizing data ...