Installation

Missing "server.pem" file

Yogen
New Member

Hi everyone, I faced an error while accepting the license for Splunk. I am using Linux Ubuntu OS. The details of the error are as shown below:

This appears to be your first time running this version of Splunk.
ERROR: "/home/yogen6116/download/splunk/etc/auth/server.pem": not found
ERROR while running renew-certs migration.

I found that the "server.pem" file is missing from the Splunk package that I have downloaded. Can anyone direct me on how to solve this error?

Tags (1)
0 Karma
1 Solution

nychawk
Communicator

Did you download from Splunk, or copy from somewhere else?

I suggest you download the 32 or 64 bit tar file and start over again.

View solution in original post

0 Karma

nychawk
Communicator

Did you download from Splunk, or copy from somewhere else?

I suggest you download the 32 or 64 bit tar file and start over again.

0 Karma

splunk24
Path Finder

i am also seeing the same in my production env .. server.pem is missing
can we generate the same again ?
we want to use server.pem for forwarders to indexers secure data trasnsfer ssl using certs
please help

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

Which version of splunk you are using? Looks like you are doing an upgrade. Is it ?

Happy Splunking!
0 Karma

vanallp
Explorer

I'm upgrading from 6.3.2 to 6.3.3 on a rhel7.2 machine, that is NOT in TEST of PROD. I was just running through the update procedure.

tar -zxf splunkforwarder-6.3.3-f44afce176d0-Linux-x86_64.tgz  -C /opt
chown -R root:root /opt/splunkforwarder
/opt/splunkforwarder/bin/splunk start
... accept license... 
Perform migration and upgrade without previewing configuration changes? [y/n] n

-- Migration information is being logged to '/opt/splunkforwarder/var/log/splunk/migration.log.2016-02-10.13-41-10' --

Migrating to:
VERSION=6.3.3
BUILD=f44afce176d0
PRODUCT=splunk
PLATFORM=Linux-x86_64
********** BEGIN PREVIEW OF CONFIGURATION FILE MIGRATION **********

ERROR: "/opt/splunkforwarder/etc/auth/server.pem": not found
ERROR while running renew-certs migration.
[root@master ~]#

It's looking for something that does not exist. what I see is:

[root@master ~]# ll /opt/splunkforwarder/etc/auth/
total 20
-rw-r--r--. 1 root root 3908 Jan 31 14:44 appsCA.pem
-rw-------. 1 root root  912 Jan 28 12:49 cacert.pem
-rw-r--r--. 1 root root  912 Jan 31 14:44 cacert.pem.default
-rw-------. 1 root root 1828 Jan 28 12:49 ca.pem
-rw-r--r--. 1 root root 1828 Jan 31 14:44 ca.pem.default
[root@master ~]#

So I looked at my real test environment and my master/indeder/search heads have:

-rw-r--r-- 1 root root 3908 Dec  9 07:07 appsCA.pem
-rw------- 1 root root  912 Jan 12 22:38 cacert.pem
-rw-r--r-- 1 root root  912 Dec  9 07:07 cacert.pem.default
-rw------- 1 root root 1828 Jan 12 22:38 ca.pem
-rw-r--r-- 1 root root 1828 Dec  9 07:07 ca.pem.default
-rw------- 1 root root   17 Jan 12 22:38 ca.srl
-rw------- 1 root root 1041 Jan 12 22:38 privKeySecure.pem
-rw------- 1 root root  595 Jan 12 22:38 req.pem
-rw------- 1 root root 2767 Jan 12 22:38 server.pem
-r-------- 1 root root  255 Jan 12 22:38 splunk.secret
drwx------ 2 root root   39 Jan 12 22:38 splunkweb

So my general assumption is that when I update a 'real' machine, the update will continue.

cheers,
paul

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...