Wildcard certificate and PDF 1.3 failed to generate PDF: 400 Bad Request

[Ellen]

PDF 1.3 under Splunk 4.3.3 was working fine until I replaced the current cert with a new wildcard certificate.

I get the email alert but instead of the expected results, the contents have the error message:

An error occurred while generating a PDF of this report: Failed to generate PDF: Appserver failed to dispatch report request to /services/pdfserver/renderpdf: 400 Bad Request

The python.log also reports the following:

XMLSyntaxError: PCDATA invalid Char value 26, line 164, column 1
2012-09-04 17:00:41,204 ERROR PCDATA invalid Char value 26, line 164, column 1
Traceback (most recent call last):
  File "/opt/splunk/bin/rest_handler.py", line 84, in <module>
    print splunk.rest.dispatch(**params)
  File "/opt/splunk/lib/python2.7/site-packages/splunk/rest/__init__.py", line 52, in dispatch
    requestXml = et.fromstring(requestInfo)
  File "lxml.etree.pyx", line 2532, in lxml.etree.fromstring (src/lxml/lxml.etree.c:48634)
  File "parser.pxi", line 1545, in lxml.etree._parseMemoryDocument (src/lxml/lxml.etree.c:72245)
  File "parser.pxi", line 1424, in lxml.etree._parseDoc (src/lxml/lxml.etree.c:71106)
  File "parser.pxi", line 938, in lxml.etree._BaseParser._parseDoc (src/lxml/lxml.etree.c:67875)
  File "parser.pxi", line 539, in lxml.etree._ParserContext._handleParseResultDoc (src/lxml/lxml.etree.c:64257)
  File "parser.pxi", line 625, in lxml.etree._handleParseResult (src/lxml/lxml.etree.c:65178)
  File "parser.pxi", line 565, in lxml.etree._raiseParseError (src/lxml/lxml.etree.c:64521)
XMLSyntaxError: PCDATA invalid Char value 26, line 164, column 1
2012-09-04 17:00:41,258 ERROR An error occurred while generating a PDF of this report: Failed to generate PDF: Appserver failed to dispatch report request to /services/pdfserver/renderpdf: 400 Bad Request
2012-09-04 17:00:41,259 DEBUG simpleRequest > GET https://127.0.0.1:8089/services/search/jobs/scheduler__admin__search_ZGF2ZWgtcGRmdGVzd_at_1346778000... [] sessionSource=direct
2012-09-04 17:00:41,274 DEBUG simpleRequest < server responded status=200 responseTime=0.0149s
2012-09-04 17:00:41,274 DEBUG getStatus - elapsed=0.0153450965881 nextRetry=0.0500000289067
2012-09-04 17:00:58,024 INFO Sending email. subject="Splunk Alert: booboos-pdftest", results_link="https://mycompany.com:443/app/search/@go?sid=scheduler__admin__search_ZGF2ZWgtcGRmdGVzd_at_1346778000_662428414fef0f15", recepients="['yogibear@mycompany.com']"

[Ellen · Accepted solution]

By temporarily enabling debug mode for python eg. creating $SPLUNK_HOME/etc/log-local.cfg to include

[python]
splunk = DEBUG

Review of python.log showed control character, ^Z at the end of the certificate specification.

Found ^Z in both the .crt and .pem files. Once removed, PDF generation was working again.