ssl_certificate_validation set to false getting unable to find valid certification path to requested target

[amulyas]

I am using this plugin to send data to Splunk HTTP Event Collector

http {
url => "https://input-prd-p-wqweqwed2bssk.cloud.splunk.com:8088/services/collector/event"
http_method => "post"
format => "message"
ssl_certificate_validation => false
message => '{ "event", "%{message}" }'
headers => [ "Authorization", "Splunk 878IUY-3715-42ED-8F41-4399FC4CC2B6" ]
}

but Its giving me error

{:timestamp=>"2016-10-12T15:10:42.739000-0700", :message=>"PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target", :url=>"https://input-prd-p-273zfxd2bssk.cloud.splunk.com:8088/services/collector/event", :method=>:post, :body=>"{ "event", "tasdaskdj" }", :headers=>{"Authorization"=>"Splunk 6876YUYA31-3715-42ED-8F41-4399FC4CC2B6", "Content-Type"=>"text/plain"}, :class=>"Man

Is ssl_certificate_validation => false not getting set

[jordansissel]

@amulyas you probably should be changing your splunk authentication token (or whatever that Authorization header is. It's likely you didn't mean to share that?

[jordansissel]

Based on your report, it seems like maybe ssl_certificate_validation => false isn't being obeyed.

(by the way, I strongly recommend never running SSL with certificate verification disabled, so what you are trying to do is very bad for security)

[amulyas]

@jordansissel Token is not valid bits are diff from actual.. so do the url, I understand the risk this is just a test as it will take me a while to get splunk to change their certs

[alkuzad]

@amulyas obsolete ... https://github.com/logstash-plugins/logstash-mixin-http_client/blob/master/lib/logstash/plugin_mixins/http_client.rb#L55

I have my own patched version of http-output plugin and mixin-http_client because I've got sick how so simple feature can be so complicated to use/setup, it's working on quite old stack now so I don't know if you will benefit from it....

guys maybe update docs ?

[rhussmann]

For others that may find themselves in this place, the next step may be to add the certificate to your Java trust store. Where your keystore lives will vary from distribution / installation. While attempting to work through this issues, I found this Stackoverflow post helpful in fetching the certificate from the remote machine and adding it to the trust store.