Forums: SplunkAdministration: Intermediate cert chain installation

Hi all,
I've recently purchased a cheap SSL cert from GoDaddy for our splunk installation. We've used them before on our internal servers, but they require a cert chain installation. You can view the apache setup information here.

https://certs.godaddy.com/Apache1_alt.go

I've changed my local web.conf to include the key and the cert, but how do I install the chain file? All browsers complain they can't verify ownership of my splunk installation.

Thanks,
Todd

[Revised on Sat, 22 Aug 2009 17:10:15 -0700]

Specifically, I receive the error (Error code: sec_error_unknown_issuer). I have to install the intermediate certificate for my certificate to be valid.

Bump. Anyone?

Ok, so I've given up on getting Splunk to do this and I've just proxied it via a simple Apache installation. I've configured my reverse proxy as per this page

https://apps.akeles.com/confluence/display/DOC/Using+Apache+with+mod_proxy

However I'm running into an issue where Apache is replacing actual space characters " " and escaping them with "%20" which is causing my queried to blow up. Any way around this?

So, I'm back again. Mod_proxy can't properly proxy the URLs that have a %20 in them, it escapes the "%20" and puts in %2520. I've found that there's been a patch to the web server that splunk uses. I'm assuming this is the correct server after digging through the ssl configuration directive in the py source files.

http://groups.google.com/group/cherrypy-users/msg/085a9f2edc920b24?pli=1

Would it be possible to apply this patch in the next release so we can to cert chains?

Thanks
Todd

Had the same problem - you have to make sure that if your RP uses SSL then splunk also uses SSL - if your RP uses plain http then so does splunk

to get round the %20 issue you can put in a modrewrite rule with [EN] flags at the end - I had this issue when the rp was running ssl and then forwarding to splunk on http and this fixed it. But to avoid it in the first place run both on ssl or both on http don't mix them.