Security

Why is the SSL connection between forwarder and indexer fails when password less certificates are used?

strive
Influencer

Hi,

In the SSL/TLS world, it is not mandatory to have passwords for the private key. However, in case of Splunk, the SSL connection between forwarder and indexer fails when password less certificates are used.

After a bit of debugging, I found that Splunk adds password attribute to the [SSL] stanza of inputs.conf. I have a inputs.conf in /opt/splunk/etc/system/local/ directory. I haven't specified password (since the certificates that I am using are password less). Upon Splunk restart, it adds the password attribute with some hashed value. Due to this I am getting error as: ERROR TcpInputConfig - SSL server certificate not found, or password is wrong - SSL ports will not be opened

Splunk adding password attribute to inputs.conf is a bug or is it intended behavior? If it is intended behavior, then how to stop Splunk from editing files in /opt/splunk/etc/system/local/ directory?

Regards,
Strive

0 Karma
1 Solution

strive
Influencer

I dug deeper and found a way of making it work. I just concentrated on this portion of error - " error:0906D06C:PEM routines:PEM_read_bio:no start line".

Combining the cert and key into one file solved the issue.

The link that helped me with this is: https://snippets.aktagon.com/snippets/543-how-to-fix-pem-read-bio-no-start-line-error-nginx-error

View solution in original post

0 Karma

strive
Influencer

I dug deeper and found a way of making it work. I just concentrated on this portion of error - " error:0906D06C:PEM routines:PEM_read_bio:no start line".

Combining the cert and key into one file solved the issue.

The link that helped me with this is: https://snippets.aktagon.com/snippets/543-how-to-fix-pem-read-bio-no-start-line-error-nginx-error

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...