server_pkcs1.pem cert expired

[bfrisan]

Our Nessus vulnerability scanner is flagging that the server_pkcs1.pem certificate is expired.

I have verified that it is expired but unable to renew it.   Stopping service, renaming file and restarting service does not recreate it.  How do you renew this certificate?

[usd0872]

Found the same file mysteriously auto-created and after a bit of tinkering found what caused its creation, at least in my case:

splunk backup kvstore -pointInTime true -archiveName my_archive

The file vanishes again once the process finishes. But if for some reason it crashes/gets killed/whatever, the file is left in the filesystem.

[PickleRick]

Splunk doesn't by default come with a cert file called server_pkcs1.pem. It must be a piece of configuration explicitly done in your deployment. So you have to find

1) Where (if anywhere) its use is defined ( @marnall 's hint can help but it doesn't have to contain all possible references to certs - some addons can have use their own cert settings).

2) Where this cert comes from. As far as I remember, only the default cert can be automatically (re)created.

[marnall]

Can you run btool on the machine as the splunk user to make sure that the server_pkcs1.pem certificate is indeed the one used by splunk?

/opt/splunk/bin/splunk btool server list sslConfig

 Look for the serverCert variable

[bfrisan]

Sorry for delayed response, holidays got in the way.

I ran "splunk btool server list sslConfig" and it returned no data.  I tried it without sslconfig and searched for that cert name and nothing

When I run openssl.exe x509 -enddate -noout -text -in "c:\programs files\splunk\etc\auth\server_pkcs1.pem" it shows as the issuer being Splunk.

[PickleRick]

Just because the issuer is "Splunk something", doesn't mean the file itself couldn't have been - for example - manually renamed from the original file which was created by some built-in scripts.

Unfortunately you're using windows so I won't give you a find | grep oneliner to find whether it's referenced anywhere. You have to check for yourself if any *.conf file calls out to it.

[bfrisan]

Yea no reference to server_pkcs1.pem in server.conf.  I already renamed file, and finding is gone.  Just watching/waiting now to make sure no issues.  Thanks!