Splunk Enterprise

SAML SSO idp cert cannot be found


I've configured okta with splunk a dozen times.  However this time it keeps telling me that:


Failed to load trusted certificate: Error: failed to load pem certificate. Verify the full path including the filename is correct and points to the certificate from the IDP.

and in logs:

Saml - Unable to load cert(s) from path="/opt/splunk/etc/auth/idpCerts/idpCert.pem".


But the cert exists there and splunk has ownership of the full and the entire path to the file.  What gives??

Labels (1)
Tags (2)
0 Karma


@vennemp @Anurag_Byakod 

I had this same problem and it stemmed from certificate file formatting. I ended up running an

openssl x509 -in idpCert.pem -out idpCert1.pem

And I pointed the SAML config at the idpCert1.pem, reloaded auth, logged out of the admin account and I was logged right in. 

After diff-ing the two, it seems that when copying and pasting (into cat, in my case) the cert info from Okta, it doesn't maintain the format. And while running an openssl x509 -in idpCert.pem -noout -text _will_ give you the correct output for the cert, something in Splunk barfs when it sees the bad formatting. Outputting it to a new pem using openssl formats it correctly. 

Good luck

Tags (2)
0 Karma


Hi @vennemp 

Were you able to get the issue fixed? I am facing the same issue with OKTA Splunk SAML integration.

Tags (2)
0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...