Splunk Enterprise

Why is Splunk Web SSL not using given 3rd party certificates?

heikis
Engager

Hello.

I'm using splunk-6.2.5-272645-linux-2.6-x86_64.rpm on Centos7.
The problem is that Splunk is not using desired 3rd party SSL certificates for splunkweb.
Current configuration:

cat /opt/splunk/etc/system/local/web.conf
[settings]
httpport = 8443
enableSplunkWebSSL = true
privKeyPath = etc/auth/splunkweb/mySplunkWebPrivateKeyRSA.key
caCertPath = etc/auth/splunkweb/bundled_base64.cer

The desired certificate and the CA certificate are bundled as required (server certificate first, then the CA certificate):

cat /opt/splunk/etc/auth/splunkweb/bundled_base64.cer
-----BEGIN CERTIFICATE-----
MIIF6TC.......HuQ=
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIID......kA==
-----END CERTIFICATE-----

When restarting Splunk, the certificate used on the https page is some weird self-generated certificate which uses the Subject fields from my desired certificate.

Any ideas? Thanks.

1 Solution

heikis
Engager

Finally resolved the issue. The Splunk installation was at a client's site and was accessed over a VPN. The client also had a proxy inbetween me and the splunk server which messed up the SSL sessions and presented me with the weird certificate.
So, my problem had nothing to with Splunk misbehaving.

View solution in original post

0 Karma

heikis
Engager

Finally resolved the issue. The Splunk installation was at a client's site and was accessed over a VPN. The client also had a proxy inbetween me and the splunk server which messed up the SSL sessions and presented me with the weird certificate.
So, my problem had nothing to with Splunk misbehaving.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...