Only cacert.pem shall be placed in the certificate store. That file contains only the root certificate (public). server.pem contains also the private server key and ca.pem contains also the private root key and that will compromise the security. Not that it really matters in this case since Splunk default root CA is used. In case of using a trusted signed cert, keep this in mind. ... View more