Limitations of Splunk SSL Trust Store: OS Root CA Auto-Import Not Supported

Goal

Determine whether Splunk Enterprise 8.x automatically imports operating‑system root Certificate Authority (CA) certificates into its dedicated trust store during HTTPS forwarder ingestion.

Constraints & Uncertainty

Splunk stores trusted CAs in $SPLUNK_HOME/etc/system/local/ssl/ca_certs.pem and does not reference the OS trust store by default. When the OS trust store is updated after Splunk installation, it is unclear if the new root CAs are reflected in ca_certs.pem without manual intervention.

Specific Questions

1. Does Splunk automatically add new OS‑level root CAs to ca_certs.pem after installation?
2. If not, what configuration steps are required to keep Splunk’s trust store in sync with the OS trust store?