Security

cacert.pem - Why does Splunk need it to start?

ebdavis
New Member

Quick details: We are running Splunk 6.4.2 on Windows 2k8 as a standalone deployment. We are using third part certs with the root and intermediary certs in the cert chain. I have specified web.conf to use that particular certificate and the generated server key.

Issue: Our IAVM scanner and STIG scans report the self-signing CA and [out of the box] Splunk self-signed certs as a finding. As a troubleshooting step, I archived them and removed them from the Splunk directory and restarted Splunk. Now it will not start as it is complaining that it is unable to locate "cacert.pem" and is unable to generate the SSL certificates. I'm a bit confused as we have installed this on another host and removed the certs in the same fashion with no issue.

0 Karma

splunkreal
Motivator

Hello, what about ca.pem, what is its role? Thanks.

* If this helps, please upvote or accept solution 🙂 *
0 Karma

hardikJsheth
Motivator

The cacert.pem is used by Splunk's management port. In case you don't want to use it, you need to update the certificate used by management port.

To do this you need to perform two steps:
1) Create one .pem file with both private key and public key of your certificate. Copy this file into $SPLUNK_HOME/etc/auth/. (This is required because Splunk provides only single parameter for defining certificate for management port.

2) Use this certificate for your management port by adding following configuration in $SPLUNK_HOME/etc/system/local/server.conf

[sslConfig]
sslKeysfile = splunkweb/mysplunk.pem
sslKeysfilePassword = 
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...