Hi,
I created a splunk server on AWS and using the UI I constructed an HEC to listen for some logs.
I am using docker's splunk logging driver to send the logs.
If I leave the config the same on both servers, I receive the error: "Error response from daemon: Options "https://<IP>:8088/services/collector/event/1.0": x509: certificate relies on legacy Common Name field, use SANs instead"
So I tried to change splunk config so that it will work with my self signed certificate (which uses SANs).
I did this by changing the inputs.conf (in which the HEC was configured, bizarrely enough under" $SPLUNK_HOME/etc/apps/search/...") to have the [http] stanza with the path of the self signed cert:
[root@machine introspection]# cat $SPLUNK_HOME/etc/apps/search/local/inputs.conf
[http]
serverCert = /opt/splunk/etc/auth/certs/root.pem
[http://test]
disabled = 0
host = <ip>
sourcetype = generic_single_line
token = <token>
I then moved the relevant [http] stanza to where I believe it should be, (.../apps/splunk_httpinputs/...) but this didn't help.
In fact, what happened was as soon as I put this stanza in, connections via SSL to the ip of splunk with the relevant port do not complete, for example:
openssl s_client -connect <ip>:8088
I would appreciate assistance with either fixing the original SANs issue (as it's splunk logging driver on docker), or with the issue of using self-signed on HEC.
Thanks!
... View more