Quick details: We are running Splunk 6.4.2 on Windows 2k8 as a standalone deployment. We are using third part certs with the root and intermediary certs in the cert chain. I have specified web.conf to use that particular certificate and the generated server key.
Issue: Our IAVM scanner and STIG scans report the self-signing CA and [out of the box] Splunk self-signed certs as a finding. As a troubleshooting step, I archived them and removed them from the Splunk directory and restarted Splunk. Now it will not start as it is complaining that it is unable to locate "cacert.pem" and is unable to generate the SSL certificates. I'm a bit confused as we have installed this on another host and removed the certs in the same fashion with no issue.
↧