Hello.
I'm using splunk-6.2.5-272645-linux-2.6-x86_64.rpm on Centos7.
The problem is that Splunk is not using desired 3rd party SSL certificates for splunkweb.
Current configuration:
cat /opt/splunk/etc/system/local/web.conf
[settings]
httpport = 8443
enableSplunkWebSSL = true
privKeyPath = etc/auth/splunkweb/mySplunkWebPrivateKeyRSA.key
caCertPath = etc/auth/splunkweb/bundled_base64.cer
The desired certificate and the CA certificate are bundled as required (server certificate first, then the CA certificate):
cat /opt/splunk/etc/auth/splunkweb/bundled_base64.cer
-----BEGIN CERTIFICATE-----
MIIF6TC.......HuQ=
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIID......kA==
-----END CERTIFICATE-----
When restarting Splunk, the certificate used on the https page is some weird self-generated certificate which uses the Subject fields from my desired certificate.
Any ideas? Thanks.
... View more