Limitations of Splunk SSL Trust Store: OS Root CA Auto-Import Not Supported

Answer

No, Splunk Enterprise 8.x does not automatically import or synchronize new root Certificate Authority (CA) certificates from the operating system's trust store into its internal trust store after installation. If you update the OS-level root CAs, those changes will not be reflected in ca_certs.pem without manual intervention.

Technical Explanation

Splunk maintains a decoupled security model for its SSL/TLS configurations. While the OS may manage a global store (such as /etc/ssl/certs on Linux or the Certificate Store on Windows), Splunk references a specific PEM-formatted file for its trust chain, typically located at $SPLUNK_HOME/etc/system/local/ssl/ca_certs.pem (or $SPLUNK_HOME/etc/auth/cacert.pem depending on the specific component configuration).

Because Splunk does not poll the OS trust store for updates, any new certificates required for HTTPS forwarder ingestion or API communication must be explicitly added to the Splunk-specific trust store.

Required Configuration Steps

To synchronize a new root CA from the OS to Splunk, follow these steps:

1. Export the Root CA: Extract the required root certificate from the OS store in Base64 encoded PEM format.
2. Append to Trust Store: Append the certificate text to the end of the existing Splunk trust store file. Do not overwrite the file, as this will remove existing trusted certificates.

cat new_root_ca.pem >> $SPLUNK_HOME/etc/system/local/ssl/ca_certs.pem

3. Verify Permissions: Ensure the splunk user has read permissions for the modified ca_certs.pem file.
4. Restart Splunk: Restart the Splunk service to ensure the internal web server and ingestion processes reload the trust store.

Verification Command

To verify if the certificate is correctly presented and trusted during a handshake, use the following scoped command from the Splunk server:

openssl s_client -connect <forwarder_host>:<port> -CAfile $SPLUNK_HOME/etc/system/local/ssl/ca_certs.pem

Diagnostic Requirement

To provide a more tailored recommendation, please specify if you are using a custom SSL configuration (via server.conf) that redirects the sslRootCAFile path to a location other than the default local/ssl/ directory.