Security

Wildcard certificate and PDF 1.3 failed to generate PDF: 400 Bad Request

Ellen
Splunk Employee
Splunk Employee

PDF 1.3 under Splunk 4.3.3 was working fine until I replaced the current cert with a new wildcard certificate.

I get the email alert but instead of the expected results, the contents have the error message:

An error occurred while generating a PDF of this report: Failed to generate PDF: Appserver failed to dispatch report request to /services/pdfserver/renderpdf: 400 Bad Request

The python.log also reports the following:

XMLSyntaxError: PCDATA invalid Char value 26, line 164, column 1
2012-09-04 17:00:41,204 ERROR PCDATA invalid Char value 26, line 164, column 1
Traceback (most recent call last):
  File "/opt/splunk/bin/rest_handler.py", line 84, in <module>
    print splunk.rest.dispatch(**params)
  File "/opt/splunk/lib/python2.7/site-packages/splunk/rest/__init__.py", line 52, in dispatch
    requestXml = et.fromstring(requestInfo)
  File "lxml.etree.pyx", line 2532, in lxml.etree.fromstring (src/lxml/lxml.etree.c:48634)
  File "parser.pxi", line 1545, in lxml.etree._parseMemoryDocument (src/lxml/lxml.etree.c:72245)
  File "parser.pxi", line 1424, in lxml.etree._parseDoc (src/lxml/lxml.etree.c:71106)
  File "parser.pxi", line 938, in lxml.etree._BaseParser._parseDoc (src/lxml/lxml.etree.c:67875)
  File "parser.pxi", line 539, in lxml.etree._ParserContext._handleParseResultDoc (src/lxml/lxml.etree.c:64257)
  File "parser.pxi", line 625, in lxml.etree._handleParseResult (src/lxml/lxml.etree.c:65178)
  File "parser.pxi", line 565, in lxml.etree._raiseParseError (src/lxml/lxml.etree.c:64521)
XMLSyntaxError: PCDATA invalid Char value 26, line 164, column 1
2012-09-04 17:00:41,258 ERROR An error occurred while generating a PDF of this report: Failed to generate PDF: Appserver failed to dispatch report request to /services/pdfserver/renderpdf: 400 Bad Request
2012-09-04 17:00:41,259 DEBUG simpleRequest > GET https://127.0.0.1:8089/services/search/jobs/scheduler__admin__search_ZGF2ZWgtcGRmdGVzd_at_1346778000... [] sessionSource=direct
2012-09-04 17:00:41,274 DEBUG simpleRequest < server responded status=200 responseTime=0.0149s
2012-09-04 17:00:41,274 DEBUG getStatus - elapsed=0.0153450965881 nextRetry=0.0500000289067
2012-09-04 17:00:58,024 INFO Sending email. subject="Splunk Alert: booboos-pdftest", results_link="https://mycompany.com:443/app/search/@go?sid=scheduler__admin__search_ZGF2ZWgtcGRmdGVzd_at_1346778000_662428414fef0f15", recepients="['yogibear@mycompany.com']"
Tags (2)
1 Solution

Ellen
Splunk Employee
Splunk Employee

By temporarily enabling debug mode for python eg. creating $SPLUNK_HOME/etc/log-local.cfg to include

[python]
splunk = DEBUG

Review of python.log showed control character, ^Z at the end of the certificate specification.

Found ^Z in both the .crt and .pem files. Once removed, PDF generation was working again.

View solution in original post

Ellen
Splunk Employee
Splunk Employee

By temporarily enabling debug mode for python eg. creating $SPLUNK_HOME/etc/log-local.cfg to include

[python]
splunk = DEBUG

Review of python.log showed control character, ^Z at the end of the certificate specification.

Found ^Z in both the .crt and .pem files. Once removed, PDF generation was working again.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...