Getting Data In

sslRootCAPath at server.conf

inventsekar
Ultra Champion

SSL is already complex one, this poor documentation adds the fuel to the fire

https://docs.splunk.com/Documentation/Splunk/6.4.4/Security/ConfigureSplunkforwardingtousesignedcert...
this says, we should update server.conf with sslRootCAPath info, but when splunkd restarts, it says the other way around.

[root@UF /app/JE0/splunkforwarder/etc/twoCerts]#/app/splunkforwarder/bin/splunk restart
Stopping splunkd...
Shutting down. Please wait, as this may take a few minutes.
............ [ OK ]
Stopping splunk helpers...
[ OK ]
Done.

Splunk> All batbelt. No tights.

Checking prerequisites...
Checking mgmt port [8089]: open
Checking conf files for problems...
*Invalid key in stanza [sslConfig] in /app/splunkforwarder/etc/system/local/server.conf, line 19: sslRootCAPath (value: /app/splunkforwarder/etc/twoCerts/cacert.pem). *
Your indexes and inputs configurations are not internally consistent. For more information, run 'splunk btool check --debug'
Done
Checking default conf files for edits...
Validating installed files against hashes from '/app/splunkforwarder/splunkforwarder-6.3.4-cae2458f4aef-linux-2.6-x86_64-manifest'
All installed files intact.
Done
All preliminary checks passed.

Starting splunk server daemon (splunkd)...
Done
[ OK ]
[root@UF /app/splunkforwarder/etc/twoCerts]#

splunkreal
Motivator

Agreed, this is misleading.

* If this helps, please upvote or accept solution 🙂 *
0 Karma

satyenshah
Path Finder

Two pitfalls to watch out for:

2) The 'deprecated' settings don't appear to be really deprecated. Using v7.0.0, I still have to set caCertFile. If I try to set sslRootCAPath I get error "setting ignored under Windows". The Splunk docs for v7.0.0 say caCertFile is deprecated, but in practice it's not.

2) Splunk's SSL handling is intolerant of extra lines in PEM files. For example, if you start with a certificate in PFX and export to PEM, you end up with a lot of 'bag attributes' in the output PEM file. They look like comments in between the actual certificates. You have to manually strip out those lines so that the PEM file only contains lines that are either BEGIN, END, or Base64 encoded.

edit: Splunk appears to have fixed the sslRootCAPath problem in v7.1.2:
2018-06-15
SPL-149190, SPL-141808
(Windows Only) Support sslRootCAPath on Windows

horsefez
SplunkTrust
SplunkTrust

Hi inventsekar,

there is a parameter named caCertPath which is depreciated in recent splunk versions, but served as the sslRootCAPath parameter in past splunk versions.

You seem to use a splunkforwarder with the version 6.3.4. In this version caCertPath should work.

inventsekar
Ultra Champion

Thanks Pyro_wood,
sslRootCAPath works fine, but on inputs.conf file(not server.conf).

the document should be updated properly. if "SSL" is not updated properly, how a simple user can read this document and deploy SSL ?!?!?! hope splunk guys will check this and update soon.
the wiki.splunk on SSL also got multiple issues.

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...