Splunk Enterprise

Errors in log after enabling requireClientCert

Brian_O
Observer

In order to satisfy the "Upgrade readiness app" in 9.0.2 it seems we must set "requireClientCert = true" in our server.conf under the [sslConfig] stanza. However, when I do this I begin to see a lot of errors in splunkd.log of the following nature:

03-31-2023 10:53:36.274 -0400 ERROR ExecProcessor [1996726 ExecProcessor] - message from "/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/splunk_secure_gateway/bin/ssg_enable_modular_input.py" Enter PEM pass phrase:

Presumably this is because the key has a passphrase set on it, but we do have "sslPassword" set, so  I'm not sure what's causing the issue. Our complete sslConfig stanza looks like this:

 

[sslConfig]
enableSplunkdSSL = true
sslRootCAPath = /opt/splunk/etc/auth/certs/ca.pem
serverCert = /opt/splunk/etc/auth/certs/combined.pem
sslPassword = <REDACTED>
sslVerifyServerCert = true
verifyServerCert = true
requireClientCert = true

I haven't been able to find this issue mentioned anywhere. Any help would be appreciated. TIA

Labels (2)
0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...