Splunk Enterprise

After installation of ES over the NFR Splunk Enteprise platform, https secure connection to the platform does not work

unluakin
Loves-to-Learn Lots

Until I install the ES on the enterprise platform I could connect via 127.0.0.1:8000 via secure https connection. However after the ES installation, https stops connecting and I have to connect through non-secure connection.

Changing EnableWebSSL parameter to Yes or No does not have any impact.

How can I connect secure to my NFR Enterprise environment?

Thanks.

Ugur

Labels (2)
0 Karma

unluakin
Loves-to-Learn Lots

Thanks for the feedback.

 

How can I check this?

 

3.web.conf should n't override in the ES App.

 

 

0 Karma

thahir
Communicator

Hi @unluakin 

 

use the below btool command and check

 

$SPLUNK_HOME/bin/splunk btool web list --debug

0 Karma

thahir
Communicator

Check web.conf settings

Make sure the following key is present and correct

[settings]
enableWebSSL = true
privKeyPath = $SPLUNK_HOME/etc/auth/mycerts/your_private.key
serverCert = $SPLUNK_HOME/etc/auth/mycerts/your_certificate.pem

 

If you're not using custom certificates, Splunk will default to:

 

privKeyPath = $SPLUNK_HOME/etc/auth/splunkweb/privkey.pem
serverCert = $SPLUNK_HOME/etc/auth/splunkweb/cert.pem

 

And confirm that ES is not over writing web.conf

you can use the below command to find the directory

 

find $SPLUNK_HOME/etc/apps/SplunkEnterpriseSecuritySuite -name web.conf

 

modify the command based on your app setup, if you found any config check the stanza like below

 

[settings]
enableWebSSL = false

 

use the below btool command and validate the stanza

$SPLUNK_HOME/bin/splunk btool web list --debug

Once you modified restart the Splunk services.

 Quick overview:

1.enableWebSSL= true in the /system/local/web.conf

2.Privkeypath and Servercert should be exist and readable

3.web.conf should n't override in the ES App.

0 Karma

kiran_panchavat
Champion

@unluakin 

Refer this

ERROR: IP address 127.0.0.1 not in server certificate. Please see server.conf/[sslConfig]/cliVerifyS...

Configure TLS certificate host name validation for secured connections between Splunk software compo...

Did this help? If yes, please consider giving kudos, marking it as the solution, or commenting for clarification — your feedback keeps the community going!
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Level Up Your .conf25: Splunk Arcade Comes to Boston

With .conf25 right around the corner in Boston, there’s a lot to look forward to — inspiring keynotes, ...

Manual Instrumentation with Splunk Observability Cloud: How to Instrument Frontend ...

Although it might seem daunting, as we’ve seen in this series, manual instrumentation can be straightforward ...

Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform

Ready to make your IT operations smarter and more efficient? Discover how to automate Splunk alerts with Red ...