Overview

Details

Manages Splunk's cacert.pem so that custom certs can be added. Takes certs from the app's "cert" directory and appends
them to cacert.pem.

To use this add-on to fix issues with the expiring Sectigo root certificate (only needed on Splunk versions older than 8), see the "Fixing expiring Sectigo certificates on older versions of Splunk" section of README.md.

TA-certmanager

Manages Splunk's cacert.pem so that custom certs can be added. Takes certs from the app's "cert" directory and appends
them to cacert.pem.

Supported Splunk versions

9.1, 9.0, 8.2, 8.1, 8.0

Fixing expiring Sectigo certificates on older versions of Splunk

Follow the below installation instructions, and for step 2 download the latest certifi cacert.pem.

Installation

Install app on a forwarder or search head (wherever you're making HTTPS connections that require a custom SSL
certificate).
Place necessary certificates in TA-certmanager/cert.
(As of version 1.2.0 this step should be automated when possible) If Splunk is not running as root you will need to give write access to the user running Splunk. For Splunk 7:

chmod u+w $SPLUNK_HOME/lib/python2.7/site-packages/requests/cacert.pem

For Splunk 8:

chmod u+w $SPLUNK_HOME/lib/python2.7/site-packages/certifi/cacert.pem
chmod u+w $SPLUNK_HOME/lib/python3.7/site-packages/certifi/cacert.pem

Restart Splunk.
Run the following command to verify that cacert.pem was updated: Splunk 7:

diff $SPLUNK_HOME/lib/python2.7/site-packages/requests/cacert.pem $SPLUNK_HOME/lib/python2.7/site-packages/requests/cacert_orig.pem

Splunk 8:

diff $SPLUNK_HOME/lib/python3.7/site-packages/certifi/cacert.pem $SPLUNK_HOME/lib/python3.7/site-packages/certifi/cacert_orig.pem

If the diff shows no difference between those two files, or if cacert_orig.pem doesn't exist, something went wrong.
Check the log for details with this search:

index="_internal" sourcetype="splunkd" ERROR manage_cacert.py

Release Notes

Version 1.3.2

Jan. 31, 2024

Version 1.3.2 makes small changes to inputs.conf and the app manifest to appease appinspect.
Version 1.3.1 limits the app cert scanning to apps, manager-apps, and master-apps directories.
Version 1.3.0 of this app adds support for managing the CA cert bundles in apps themselves. It is becoming more and more common for apps to ship with a copy of certifi rather than using Splunk's copy. This version also adds support deploying this app via a deployment server on Splunk 9.0+ (earlier versions already supported), and moves logging to a dedicated "certmanager" sourcetype.

Version 1.3.1

Jan. 30, 2024

Version 1.3.1 limits the app cert scanning to apps, manager-apps, and master-apps directories.
Version 1.3.0 of this app adds support for managing the CA cert bundles in apps themselves. It is becoming more and more common for apps to ship with a copy of certifi rather than using Splunk's copy. This version also adds support deploying this app via a deployment server on Splunk 9.0+ (earlier versions already supported), and moves logging to a dedicated "certmanager" sourcetype.

Version 1.2.1

Dec. 12, 2023

Add an app.manifest and specify py3 in inputs.conf

Version 1.1.0

July 9, 2020

Version 1.1.0

Fixed a bug where the same cert would be appended to cacert.pem repeatedly if the cert had Windows-style newlines.
Fixed a bug where certs wouldn't always have newlines added between them.

Version 1.0.6

June 5, 2020

Version 1.0.5

June 5, 2020

Version 1.0.4

June 5, 2020

Version 1.0.3

June 5, 2020

1,384

Downloads

Share Subscribe

Version

Built by

Hurricane Labs

Support

Not Supported

Questions on Splunk Answers Flag as inappropriate