Splunk Enterprise Security

Splunk not taking updated certificate server.pem

clacroixdurant
Explorer

We noticed this morning that all the certificates for our Splunk servers are expired since a week (discovered whilst investigating why KVStore stopped this weekend). 

I followed recommendation from other community ask by renaming server.pem to server.pem.old and restarting the Splunk service to create a new one. 

It correctly creates  a new server.pem with a valid expiration date, however it still displays the old cerficate in my browser. 

I already checked with btool, and it seems fine (pointing to server.pem). I also already checked web.conf and tried to manually indicate the file path but it's still not working...


Am I missing something? 

Labels (3)
Tags (2)
0 Karma
1 Solution

clacroixdurant
Explorer

Well, I finally found what was missing. 

 

There's another certificate for the web interface in /opt/splunk/etc/auth/splunkweb

I did the same as the other certificate (rename it to .old and restart the service) and it automatically recreated a new updated certificate. 

View solution in original post

0 Karma

clacroixdurant
Explorer

Well, I finally found what was missing. 

 

There's another certificate for the web interface in /opt/splunk/etc/auth/splunkweb

I did the same as the other certificate (rename it to .old and restart the service) and it automatically recreated a new updated certificate. 

0 Karma

DFreeze
Observer

Is it the Splund service you restart or restart Splunk from the web console?

0 Karma
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...