Splunk Enterprise

Why is KV store failing in Search Head Cluster evironment while enable SSL certificate in Splunk version 9.0.2?

restinlinux
Explorer

For KVstore, $Splunk_HOME/etc/system/local/sever.conf was configured to use SSL.
However, the following error is occurring and the kvstore process is not starting properly.
Regarding the Web UI, we recognise that there is no problem with the certificate itself, as TLS communication is possible using the same server signature.

Splunkd.log

ERROR MongodRunner [5072 MongodLogThread] - mongod exited abnormally (exit code 1, status: exited with code 1) - look at mongod.log to investigate.

Mongod.log

 CONTROL [main] Failed global initialisation: InvalidSSLConfiguration: Could not find private key attached to the Failed global initialisation: InvalidSSLConfiguration: Could not find private key attached to the selected certificate.

Please provide information on how to resolve the above issue.

Labels (1)
Tags (3)
0 Karma
1 Solution

Yogeshredhat14
Explorer

Hi @restinlinux ,

This is the product bug in 9.0.0, 9.0.1, 9.0.2, and 9.0.3 Splunk versions Specifically for the Windows-based operating systems.
 
Issue Number: SPL-233007, SPL234066
 
Issue Description: KV Store (mongod) fails to find the private key for a given certificate on Windows. It searches for -sslCertificateSelector subject=US
 
[Workaround]
 
In order to solve the issue, Splunk has given a workaround to use Splunkd’s default generated certificate in the following directory, $SPLUNK_HOME/etc/auth/server.pem

View solution in original post

Yogeshredhat14
Explorer

Hi @restinlinux ,

This is the product bug in 9.0.0, 9.0.1, 9.0.2, and 9.0.3 Splunk versions Specifically for the Windows-based operating systems.
 
Issue Number: SPL-233007, SPL234066
 
Issue Description: KV Store (mongod) fails to find the private key for a given certificate on Windows. It searches for -sslCertificateSelector subject=US
 
[Workaround]
 
In order to solve the issue, Splunk has given a workaround to use Splunkd’s default generated certificate in the following directory, $SPLUNK_HOME/etc/auth/server.pem
Get Updates on the Splunk Community!

Digital Resilience Assessment Launch | How prepared are you for disruption?

Disruption is inevitable. The question is – how prepared are you to handle it? In today’s fast-moving digital ...

Buttercup Games: Further Dashboarding Techniques (Part 2)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Index This | What is the next number in the series? 7,645 5,764 4,576…

February 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...