Splunk Enterprise

Why are there Splunk SSL Errors when setting sslVerifyServerCert to true?

efheem
Explorer

Hello,

 

When I enable  sslVerifyServerCert  in server.conf under [sslConfig], I am seeing the following errors. From where does it understands that there is an IP address mismatch? If it trying to resolve the CN mentioned in the certificate?

 

 

09-11-2023 11:40:01.284 +0300 WARN  X509Verify [1034989 TcpChannelThread] - Server  X509 certificate (CN=searche.test.local,OU=NIL,O=TEST,L=Loc,ST=Sta,C=NIL) failed validation; error=64, reason="IP addrsearche mismatch"
09-11-2023 11:40:01.285 +0300 WARN  X509Verify [1034990 TcpChannelThread] - Server  X509 certificate (CN=searche.test.local,OU=NIL,O=TEST,L=Loc,ST=Sta,C=NIL) failed validation; error=64, reason="IP addrsearche mismatch"
09-11-2023 11:40:01.286 +0300 WARN  X509Verify [1034986 TcpChannelThread] - Server  X509 certificate (CN=searche.test.local,OU=NIL,O=TEST,L=Loc,ST=Sta,C=NIL) failed validation; error=64, reason="IP addrsearche mismatch"
09-11-2023 11:40:03.998 +0300 WARN  X509Verify [1034777 DistHealthReporter] - Server  X509 certificate (CN=searche.test.local,OU=NIL,O=TEST,L=Loc,ST=Sta,C=NIL) failed validation; error=64, reason="IP addrsearche mismatch"
09-11-2023 11:40:03.998 +0300 WARN  X509Verify [1034786 DistributedPeerMonitorThread] - Server  X509 certificate (CN=searche.test.local,OU=NIL,O=TEST,L=Loc,ST=Sta,C=NIL) failed validation; error=64, reason="IP addrsearche mismatch"
09-11-2023 11:40:04.005 +0300 WARN  X509Verify [1034777 DistHealthReporter] - Server  X509 certificate (CN=searche.test.local,OU=NIL,O=TEST,L=Loc,ST=Sta,C=NIL) failed validation; error=64, reason="IP addrsearche mismatch"

 

 

Cheers.

Tags (2)
0 Karma
1 Solution

efheem
Explorer

I figured out why this was throwing the error and posting here the solution just in case if it help someone.

I was sure that I did not use any IP's while configuring the instances, however, I just noticed that when I used cluster manager URI in server.conf for searchhead mode, it picked the IP address of peers (default behavior I think) instead of fqdn. The cert SAN did not had IP address in it. To overcome this, I added the below line in server.conf in each cluster peer and it resolved the issue.

[clustering]
register_search_address = FQDN 

 

View solution in original post

efheem
Explorer

I figured out why this was throwing the error and posting here the solution just in case if it help someone.

I was sure that I did not use any IP's while configuring the instances, however, I just noticed that when I used cluster manager URI in server.conf for searchhead mode, it picked the IP address of peers (default behavior I think) instead of fqdn. The cert SAN did not had IP address in it. To overcome this, I added the below line in server.conf in each cluster peer and it resolved the issue.

[clustering]
register_search_address = FQDN 

 

Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...