Splunk Enterprise

SAML SSO idp cert cannot be found

vennemp
Observer

I've configured okta with splunk a dozen times.  However this time it keeps telling me that:

 

Failed to load trusted certificate: Error: failed to load pem certificate. Verify the full path including the filename is correct and points to the certificate from the IDP.

and in logs:

Saml - Unable to load cert(s) from path="/opt/splunk/etc/auth/idpCerts/idpCert.pem".

 

But the cert exists there and splunk has ownership of the full and the entire path to the file.  What gives??

Labels (1)
Tags (2)
0 Karma

DaveMack
Observer

@vennemp @Anurag_Byakod 

I had this same problem and it stemmed from certificate file formatting. I ended up running an

openssl x509 -in idpCert.pem -out idpCert1.pem

And I pointed the SAML config at the idpCert1.pem, reloaded auth, logged out of the admin account and I was logged right in. 

After diff-ing the two, it seems that when copying and pasting (into cat, in my case) the cert info from Okta, it doesn't maintain the format. And while running an openssl x509 -in idpCert.pem -noout -text _will_ give you the correct output for the cert, something in Splunk barfs when it sees the bad formatting. Outputting it to a new pem using openssl formats it correctly. 

Good luck

Tags (2)
0 Karma

Anurag_Byakod
Observer

Hi @vennemp 

Were you able to get the issue fixed? I am facing the same issue with OKTA Splunk SAML integration.

Tags (2)
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...