After upgrading from Splunk 6.2.3 to 6.3.0, why am I getting renew-certs startup error "not a renewed Splunk certificate: aborting renewal"?

[davebo1896]

Hi,

I was doing an upgrade from Splunk 6.2.3 to 6.3.0. Installation went fine, but when I start Splunk for the first time, I'm getting the error below:

ERROR: "/opt/splunk/etc/auth/ca.pem.default": not a renewed Splunk certificate: aborting renewal
ERROR while running renew-certs migration.

Thanks!

[neelamsantosh]

I could able to resolve the issue by replacing from backup-auth folder.
Hope u too have taken backup.

remove the auth folder which is generated after installation and replace from my backup folder.
start the splunk .

commands:
sudo su splunk

rm -rf /opt/splunk/etc/auth
mv //opt/splunk/etc/auth/ /opt/splunk/etc/

sudo chown -R splunk.splunk /opt/splunk

/opt/splunk/bin/splunk start --accept-license --answer-yes

[neelshah]

HI All,
I had a similar issue in my environment.

I just deleted $SPLUNK_HOME/etc/auth/ca.pem (Old Certificate) ...and then tried to start the splunk. Things worked fine for me.
(Well do take backup before you delete)

Regards,
Neel Shah

[davebo1896 · Accepted solution]

I had replaced the entire etc/auth directory from the old install (parallel install), the upgrade did not recognize the certs.
To rectify this, copy only the following files from the old etc dir

etc/passwd
etc/auth/splunk.secret
etc/auth/distServerKeys/*
etc/auth/<your self generated keys, if any>/*

[davebo1896]

and etc/splunk-launch.conf !

Note: You will also need apps and users dirs. Get only app "local" dirs for apps that come packaged with Splunk.