All Apps and Add-ons

How do I run the Splunk Website Monitoring app with a client certificate?

sjohnnehta
Path Finder

Hi,

I need to monitor a bunch of websites that require the use of a client certificate to be able to connect. I installed the cert and can connect ok with Chrome and IE, but when I punched them all into the Website Monitoring app (1493) I'm getting 403s back against them all. I can see now that it's probably using its own python script to do the check so I could be stuck. Any way of getting the python script to use my client certificate?

Thank you.

1 Solution

LukeMurphey
Champion

The app doesn't support this yet. However, I think I can add support for it. I am planning a feature release by the end of September and my plan is to add support for it then. I'll probably get the work done way before that.

Would you mind testing the app for me before release? I don't have any sites that use client certificates for testing and if I can get this out earlier if I avoid having to set up a server for testing (setting up a test server will likely take me longer than making the changes in code).

I'll be logging the work on LukeMurphey.net ticket 1036.

Update:

I have an pre-release that now has support for client-side certificates (version 1.3). You can download it here: http://lukemurphey.net/projects/splunk-website-monitoring/wiki/Prereleases

View solution in original post

LukeMurphey
Champion

The app doesn't support this yet. However, I think I can add support for it. I am planning a feature release by the end of September and my plan is to add support for it then. I'll probably get the work done way before that.

Would you mind testing the app for me before release? I don't have any sites that use client certificates for testing and if I can get this out earlier if I avoid having to set up a server for testing (setting up a test server will likely take me longer than making the changes in code).

I'll be logging the work on LukeMurphey.net ticket 1036.

Update:

I have an pre-release that now has support for client-side certificates (version 1.3). You can download it here: http://lukemurphey.net/projects/splunk-website-monitoring/wiki/Prereleases

sjohnnehta
Path Finder

This all works perfectly thanks Luke.

0 Karma

sjohnnehta
Path Finder

Hi Luke. Thanks for getting this out to me. I installed it then added one of the sites in the 'add input' wizard. There is now a field for 'path to client cert'. It's unclear to me if this is the full path including the cert name? Also the format on a windows machine with spaces in the path, in double quotes? With the cert etc? Could you let me know exactly what's required please?

What I did (as I was unsure of the above, was I placed the cert in the root of c: just in case. In the 'path to client cert' field I just put c:\cert.p12 (I changed the name of the cert too as it had spaces, is p12 format ok?). Now it is running but I am getting 'connection failed' on it. Also, strangely, an inputs.conf has not been generated..

Look forward to your response.

0 Karma

sjohnnehta
Path Finder

I changed the format to .pem and am now getting 200s back! This is good news. I still do not see an inputs.conf under local however? Not sure where the configurations are kept? I need to add multiple sites so am hoping to edit the file itself.

0 Karma

LukeMurphey
Champion

BTW: if want to use the client certificates for all of your inputs, then you may be able to define a default stanza that would make them used by default, e.g.:

[web_ping]
client_certificate=/path/to/certificate.pem
client_certificate_key=/path/to/certificate.key

LukeMurphey
Champion

Also, I'll update the UI to make it clearer what should be entered to make this more intuitive.

0 Karma

sjohnnehta
Path Finder

If I create an inputs.conf it breaks everything in that the existing, manually added we pings stop, the ones listed in the new inputs.conf don't run at all and even the option to add new data using the application disappears from the options list. Also the url pointing to 'add a new input' from within the website monitoring app becomes broken. Only way back is remove and re-install the app at this point it looks like. This will be an issue if I make a mistake on any of the multiple website I'll need to add in manually as I can't go back and edit it as far as I know at the moment.

0 Karma

LukeMurphey
Champion

Yikes, I need to fix that if its an issue with my app. Could you be so kind to run the searches listed here: http://lukemurphey.net/projects/splunk-website-monitoring/wiki/Troubleshooting

Let me know what errors they show.

0 Karma

sjohnnehta
Path Finder

Hi Luke. I have found all of the website configs. They were in the app specific local\inputs.conf, being the search app not the website_monitoring one. D'you want me to run this still?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...