Splunk Enterprise

SAML SSO idp cert cannot be found


I've configured okta with splunk a dozen times.  However this time it keeps telling me that:


Failed to load trusted certificate: Error: failed to load pem certificate. Verify the full path including the filename is correct and points to the certificate from the IDP.

and in logs:

Saml - Unable to load cert(s) from path="/opt/splunk/etc/auth/idpCerts/idpCert.pem".


But the cert exists there and splunk has ownership of the full and the entire path to the file.  What gives??

Labels (1)
Tags (2)
0 Karma


@vennemp @Anurag_Byakod 

I had this same problem and it stemmed from certificate file formatting. I ended up running an

openssl x509 -in idpCert.pem -out idpCert1.pem

And I pointed the SAML config at the idpCert1.pem, reloaded auth, logged out of the admin account and I was logged right in. 

After diff-ing the two, it seems that when copying and pasting (into cat, in my case) the cert info from Okta, it doesn't maintain the format. And while running an openssl x509 -in idpCert.pem -noout -text _will_ give you the correct output for the cert, something in Splunk barfs when it sees the bad formatting. Outputting it to a new pem using openssl formats it correctly. 

Good luck

Tags (2)
0 Karma


Hi @vennemp 

Were you able to get the issue fixed? I am facing the same issue with OKTA Splunk SAML integration.

Tags (2)
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...