SAML SSO idp cert cannot be found

[vennemp]

I've configured okta with splunk a dozen times.  However this time it keeps telling me that:

Failed to load trusted certificate: Error: failed to load pem certificate. Verify the full path including the filename is correct and points to the certificate from the IDP.

and in logs:

Saml - Unable to load cert(s) from path="/opt/splunk/etc/auth/idpCerts/idpCert.pem".

But the cert exists there and splunk has ownership of the full and the entire path to the file.  What gives??

[DaveMack]

@vennemp @Anurag_Byakod 

I had this same problem and it stemmed from certificate file formatting. I ended up running an

openssl x509 -in idpCert.pem -out idpCert1.pem

And I pointed the SAML config at the idpCert1.pem, reloaded auth, logged out of the admin account and I was logged right in. 

After diff-ing the two, it seems that when copying and pasting (into cat, in my case) the cert info from Okta, it doesn't maintain the format. And while running an openssl x509 -in idpCert.pem -noout -text _will_ give you the correct output for the cert, something in Splunk barfs when it sees the bad formatting. Outputting it to a new pem using openssl formats it correctly. 

Good luck

[Anurag_Byakod]

Hi @vennemp 

Were you able to get the issue fixed? I am facing the same issue with OKTA Splunk SAML integration.