Security

How to fix missing SSL settings in Splunk 6.5.0?

rkilen
Explorer

We have 6.4.3 in production, and I'm just starting to test 6.5.0. When configuring SSL, I've found a few of the deprecated settings, and have fixed them. It works when I use the default Splunk certificates, but when I try to specify my own certificates, located in a different directory, I receive this error:

ERROR TcpInputConfig - SSL context cannot be created due to missing settings, Will not open Splunk to Splunk (SSL) IPv4 port 999

I swap between the certificates by changing inputs.conf/serverCert and server.conf/sslRootCAPath to point to the appropriate certificates. I've not found anything in splunkd.log to indicate what settings are missing.

In case it matters, my certificates were created using a version of genRootCA.sh that was modified to use -sha256 instead of -sha1, and I invoke it with -l 2048, as our security compliance requires the longer key and sha256.

0 Karma

jsrobard
Explorer

Double check your certificate paths in server.conf and inputs.conf. I had a typo in one of my cert paths and it generated this error.

If that isn't it, I'd try running the following to make sure your SSL configuration is coming from where you expect:

bin/splunk cmd btool inputs list --debug
bin/splunk cmd btool server list --debug
0 Karma

bowendenning
Path Finder

Hi Rkilen,

I had this error show up on an indexer I'm configuring just now. Turns out that I had forgotten to place an [SSL] config stanza in my inputs.conf file on the indexer.

Here's the config that I have that is now working - both under etc/system/local/ on the indexer:

server.conf

[sslConfig]
sslRootCAPath = /etc/pki/tls/certs/acmecorp-root-ca.pem
sslPassword = [redacted]
sslVersions = tls1.2
sslVerifyServerCert = true
serverCert = /etc/pki/tls/certs/splunk-indexer.pem
sendStrictTransportSecurityHeader = true

inputs.conf

[splunktcp-ssl://9997]
disabled = false
[SSL]
password = [redacted]
rootCA = /etc/pki/tls/certs/acmecorp-root-ca.pem
serverCert = /etc/pki/tls/certs/splunk-indexer.pem

Hope this helps.

0 Karma

rkilen
Explorer

Adding a comment, as this isn't really a solution...

I got my certificates to work by manually invoking Splunk's createssl command to create server.pem. Unfortunately, it is sha1, even though cacert.pem is sha256, and createssl doesn't appear to have an option to specify sha256.

As far as I can tell, when splunkd first starts with the default SSL certificates configured, it knows to create server.pem in the default directory, but when starting with certificates in a different directory it doesn't create server.pem for some reason. Is this the intended behavior for 6.5.0?

I tried adding the deprecated caPath to see if it would generate the server.pem, but that didn't work (not surprising, really).

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...