Installation

Upgrading my Splunk Enterprise 6.2.x to 6.3.x did not upgrade the expiration dates on my default SSL certs, why?

weeb
Splunk Employee
Splunk Employee

I upgraded my instances as per https://answers.splunk.com/answers/395886/for-splunk-enterprise-splunk-light-and-hunk-pre-63.html#an... , however, my default SSL certs ca.pem and cacert.pem are still showing the older expiration dates. What am I doing wrong?

Labels (1)
1 Solution

weeb
Splunk Employee
Splunk Employee

For upgrades from an earlier version to 6.3.x, please remove existing copies of ca.pem and cacert.pem before upgrade.

Steps for Linux:

  1. Stop Splunk
  2. Remove $SPLUNK_HOME/etc/auth/ca.pem
  3. Remove $SPLUNK_HOME/etc/auth/cacert.pem
  4. Upgrade procedure as usual (untar tarball over Splunk home directory)
  5. Start Splunk (this will generate a new ca.pem and cacert.pem files)

Hope this helped anyone wondering why their upgrade did not work to change the expiration dates on their default certs.

Just in Case: If the customer generated certs and gave them the names used by Splunk (ca.pem, cacert.pem), this answer does not apply. This answer only applies to default certs provided out of the box by Splunk.

View solution in original post

weeb
Splunk Employee
Splunk Employee

For upgrades from an earlier version to 6.3.x, please remove existing copies of ca.pem and cacert.pem before upgrade.

Steps for Linux:

  1. Stop Splunk
  2. Remove $SPLUNK_HOME/etc/auth/ca.pem
  3. Remove $SPLUNK_HOME/etc/auth/cacert.pem
  4. Upgrade procedure as usual (untar tarball over Splunk home directory)
  5. Start Splunk (this will generate a new ca.pem and cacert.pem files)

Hope this helped anyone wondering why their upgrade did not work to change the expiration dates on their default certs.

Just in Case: If the customer generated certs and gave them the names used by Splunk (ca.pem, cacert.pem), this answer does not apply. This answer only applies to default certs provided out of the box by Splunk.

christeraustad
Explorer

But if you have already upgraded to 6.3. How do I regenerate new certificates with new dates?

0 Karma

cyndiback
Path Finder

Is this needed for upgrades to version 6.4.x?

0 Karma

jodros
Builder

Is this necessary for universal forwarders installed on WinOS?

0 Karma
Get Updates on the Splunk Community!

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Avoid Certificate Expiry Issues in Splunk Enterprise with Certificate Assist

This blog post is part 2 of 4 of a series on Splunk Assist. Click the links below to see the other ...