Encryption on the port 9997

[damucka]

Hello,

I have the following inputs.conf on my indexer:

[default]
host = mo-7ee963859.zone1.mo.sap.corp

[monitor:///var/log/messages]
sourcetype = syslog


#[splunktcp://9997]
#disabled = 0

######### SSL Configuration
[splunktcp-ssl://9997]

[SSL]
serverCert = $SPLUNK_HOME/etc/auth/server.pem
password = $1$ydTZu0KhCtct
rootCA = $SPLUNK_HOME/etc/auth/cacert.pem
#requireClientCert = false

When I restart splunk with the above, the port 9997 is not active / splunk does not listen on it (netstat -an | grep 9997). When I uncomment the "unencrypted version" in the above config and restart, the port 9997 pops up in the netstat list.

Can you please help?

Kind Regards,
Kamil

[harsmarvania57 · Accepted solution]

As per inputs.conf spec file rootCA = $SPLUNK_HOME/etc/auth/cacert.pem is deprecated, do you have sslRootCAPath in server.conf ?

rootCA = <path>
* This setting is DEPRECATED.
* Do not use this setting. Use 'server.conf/[sslConfig]/sslRootCAPath' instead.
* Used only if 'sslRootCAPath' is unset.

password must be your certificate key password and first time you need to provide in plain text and after that when you restart splunk will automatically encrypt it.

[damucka]

@harsmarvania57

Thank you.
It was my misunderstanding, I thought I can set my own password.
It helped.

Kind Regards,
Kamil