Splunk Enterprise
Highlighted

Why is Splunk Web SSL not using given 3rd party certificates?

Engager

Hello.

I'm using splunk-6.2.5-272645-linux-2.6-x86_64.rpm on Centos7.
The problem is that Splunk is not using desired 3rd party SSL certificates for splunkweb.
Current configuration:

cat /opt/splunk/etc/system/local/web.conf
[settings]
httpport = 8443
enableSplunkWebSSL = true
privKeyPath = etc/auth/splunkweb/mySplunkWebPrivateKeyRSA.key
caCertPath = etc/auth/splunkweb/bundled_base64.cer

The desired certificate and the CA certificate are bundled as required (server certificate first, then the CA certificate):

cat /opt/splunk/etc/auth/splunkweb/bundled_base64.cer
-----BEGIN CERTIFICATE-----
MIIF6TC.......HuQ=
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIID......kA==
-----END CERTIFICATE-----

When restarting Splunk, the certificate used on the https page is some weird self-generated certificate which uses the Subject fields from my desired certificate.

Any ideas? Thanks.

Highlighted

Re: Why is Splunk Web SSL not using given 3rd party certificates?

Engager

Finally resolved the issue. The Splunk installation was at a client's site and was accessed over a VPN. The client also had a proxy inbetween me and the splunk server which messed up the SSL sessions and presented me with the weird certificate.
So, my problem had nothing to with Splunk misbehaving.

View solution in original post

0 Karma