Hello!
What are the passphrases for the client.pem
and server.pem
files in the Universal Forwarder Credentials file, splunkclouduf.spl
?
I've tried the following passphrases without success:
changeme
splunkclouduf.spl
and trying new password for the passphrase with this command: openssl rsa -in client.pem -out no_client.pem
.Thank you in advance!
P.S. For a little background, I'm trialing Splunk Cloud. I'm trying to send logs from my kubernetes cluster to Splunk Cloud using https://github.com/splunk/splunk-connect-for-kubernetes.
I've opened a Splunk account, created the indexes and downloaded the Universal Forwarder Credentials file, splunkclouduf.spl
and untarred it which produced the 5 files: cacert.pem
, client.pem
, limits.conf
, outputs.conf
and server.pem
.
The problem is that the .pem files have passphrases. So setting just setting them in the global.splunk.hec.clientCert
, global.splunk.hec.clientKey
and global.splunk.hec.caFile
settings is producing TLS errors.
@woodcock Thank you for the reply. Those weren't accepted as the passphrase, but the outputs.conf
file has a line entry of sslPassword = xxxxx
, where xxxxx
seems to be the passphrase.
@woodcock Thank you for the reply. Those weren't accepted as the passphrase, but the outputs.conf
file has a line entry of sslPassword = xxxxx
, where xxxxx
seems to be the passphrase.
OK, you should click Accept
to close the question.
I don't know why it matters or why you would care but Splunk typically uses the name as the value for defaults (like the default password
is password
), so try passphrase
or null/nothing.