Why is Splunk Web SSL not using given 3rd party certificates?

[heikis]

Hello.

I'm using splunk-6.2.5-272645-linux-2.6-x86_64.rpm on Centos7.
The problem is that Splunk is not using desired 3rd party SSL certificates for splunkweb.
Current configuration:

cat /opt/splunk/etc/system/local/web.conf
[settings]
httpport = 8443
enableSplunkWebSSL = true
privKeyPath = etc/auth/splunkweb/mySplunkWebPrivateKeyRSA.key
caCertPath = etc/auth/splunkweb/bundled_base64.cer

The desired certificate and the CA certificate are bundled as required (server certificate first, then the CA certificate):

cat /opt/splunk/etc/auth/splunkweb/bundled_base64.cer
-----BEGIN CERTIFICATE-----
MIIF6TC.......HuQ=
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIID......kA==
-----END CERTIFICATE-----

When restarting Splunk, the certificate used on the https page is some weird self-generated certificate which uses the Subject fields from my desired certificate.

Any ideas? Thanks.

[heikis · Accepted solution]

Finally resolved the issue. The Splunk installation was at a client's site and was accessed over a VPN. The client also had a proxy inbetween me and the splunk server which messed up the SSL sessions and presented me with the weird certificate.
So, my problem had nothing to with Splunk misbehaving.