Missing "server.pem" file

[Yogen]

Hi everyone, I faced an error while accepting the license for Splunk. I am using Linux Ubuntu OS. The details of the error are as shown below:

This appears to be your first time running this version of Splunk.
ERROR: "/home/yogen6116/download/splunk/etc/auth/server.pem": not found
ERROR while running renew-certs migration.

I found that the "server.pem" file is missing from the Splunk package that I have downloaded. Can anyone direct me on how to solve this error?

[nychawk · Accepted solution]

Did you download from Splunk, or copy from somewhere else?

I suggest you download the 32 or 64 bit tar file and start over again.

[splunk24]

i am also seeing the same in my production env .. server.pem is missing
can we generate the same again ?
we want to use server.pem for forwarders to indexers secure data trasnsfer ssl using certs
please help

[renjith_nair]

Which version of splunk you are using? Looks like you are doing an upgrade. Is it ?

[vanallp]

I'm upgrading from 6.3.2 to 6.3.3 on a rhel7.2 machine, that is NOT in TEST of PROD. I was just running through the update procedure.

tar -zxf splunkforwarder-6.3.3-f44afce176d0-Linux-x86_64.tgz  -C /opt
chown -R root:root /opt/splunkforwarder
/opt/splunkforwarder/bin/splunk start
... accept license... 
Perform migration and upgrade without previewing configuration changes? [y/n] n

-- Migration information is being logged to '/opt/splunkforwarder/var/log/splunk/migration.log.2016-02-10.13-41-10' --

Migrating to:
VERSION=6.3.3
BUILD=f44afce176d0
PRODUCT=splunk
PLATFORM=Linux-x86_64
********** BEGIN PREVIEW OF CONFIGURATION FILE MIGRATION **********

ERROR: "/opt/splunkforwarder/etc/auth/server.pem": not found
ERROR while running renew-certs migration.
[root@master ~]#

It's looking for something that does not exist. what I see is:

[root@master ~]# ll /opt/splunkforwarder/etc/auth/
total 20
-rw-r--r--. 1 root root 3908 Jan 31 14:44 appsCA.pem
-rw-------. 1 root root  912 Jan 28 12:49 cacert.pem
-rw-r--r--. 1 root root  912 Jan 31 14:44 cacert.pem.default
-rw-------. 1 root root 1828 Jan 28 12:49 ca.pem
-rw-r--r--. 1 root root 1828 Jan 31 14:44 ca.pem.default
[root@master ~]#

So I looked at my real test environment and my master/indeder/search heads have:

-rw-r--r-- 1 root root 3908 Dec  9 07:07 appsCA.pem
-rw------- 1 root root  912 Jan 12 22:38 cacert.pem
-rw-r--r-- 1 root root  912 Dec  9 07:07 cacert.pem.default
-rw------- 1 root root 1828 Jan 12 22:38 ca.pem
-rw-r--r-- 1 root root 1828 Dec  9 07:07 ca.pem.default
-rw------- 1 root root   17 Jan 12 22:38 ca.srl
-rw------- 1 root root 1041 Jan 12 22:38 privKeySecure.pem
-rw------- 1 root root  595 Jan 12 22:38 req.pem
-rw------- 1 root root 2767 Jan 12 22:38 server.pem
-r-------- 1 root root  255 Jan 12 22:38 splunk.secret
drwx------ 2 root root   39 Jan 12 22:38 splunkweb

So my general assumption is that when I update a 'real' machine, the update will continue.

cheers,
paul