Splunk Web Server SSL Access to Search Engine using v9.2.x

[Ken_Taylor]

Hi, 

I have been working for a day or so on getting this to work. 

Here is my web.conf file configuration 

[settings]
httpport = 443
loginBackgroundImageOption = custom
loginCustomBackgroundImage = search:logincustombg/Hub_Arial.jpg

enableSplunkWebSSL = true
privKeyPath = /opt/splunk/share/splunk/certs/decrypted-xxx_2025_wc.key
serverCert = /opt/splunk/share/splunk/certs/splunk-wc-xxx-com.pem

the key file is the decrypted certificate, the server cert is the server cert, the intermediate and root from godaddy g2. 

I am currently running splunk 9.2.x 

I am not finding a quick how to to complete this task and I am working if someone could give me a hand. 

I am using Wireshark off the firefox browser and sometimes I see the client request but never see the server request. 

I am not doing this from the command line or the web server, I am updating the files and restarting splunkd. 

Thanks in advance for your assistance.  Please let me know if there are any questions.  

[Tom_Lundie]

Hi,

There could be a few things going on here.

I would hazard a guess that you're running Splunk as a non-root user trying to bind to port 443 which is a privileged-port. Check if Splunk is listening on 443/TCP:

ss -tlp

Also, check for web related messages under:

$SPLUNK_HOME/bin/splunk status
And UiHttpListener entries in /opt/splunk/var/log/splunk/splunkd.log.

If this is indeed your problem, I suggest that you use different port such as 8443. You could also try to allow Splunk to bind to the system ports, you will need to research how to do this securely for your environment.

If Splunk is listening on 443, start working your way out:

• Are there any error entries in splunkd.log.
• Can you curl it via local host

curl -kv https://localhost​

• Are you dropping connections on the local FW?

firewall-cmd --list-all

• Is there a routing issue / network firewall between your client browser and Splunk instance?
• Is there an issue with client machine / browser?

Feel free to upload any relevant Splunkd.log entries, redacted appropriately to help troubleshooting.