SSL ERROR: SSL peer certificate validation failed: unsupported certificate purpose

Applicability

Splunk enterprise openssl

Description

Splunk SSL operations are failing with the following error: 

Error receiving request from client: SSLHandshakeFailed: SSL peer certificate validation failed: unsupported certificate purpose. Ending connection from x.x.x.x:xxxx (connection id: xx)

The certificate is not multi-purpose in this scenario, and this article will cover how to identify and resolve issues with

Investigation

Look in splunkd.log and mongod.log for errors containing the words "unsupported certificate purpose".
 

Error receiving request from client: SSLHandshakeFailed: SSL peer certificate validation failed: unsupported certificate purpose. Ending connection from x.x.x.x:xxxx (connection id: xx)

If errors are seen in splunkd.log, check the certificate in the sslConfig stanza. If it is in mongod.log, check the certificate in the kvstore stanza. 
openssl x509 -noout -in server.pem -purpose

# openssl x509 -noout -in server.pem -purpose
Certificate purposes:
SSL client : No
SSL client CA : No
SSL server : Yes
SSL server CA : No

The above results indicate the Client purpose is not enabled. This means the certificate needs to be replaced. This cannot be corrected with the current certificate.
 

Resolution

The certificate needs to be replaced with a certificate that supports both client and server purposes. Once the certificate is replaced, restart Splunk. Be sure to use the openssl command to ensure both client and server purposes are enabled:

# openssl x509 -noout -in server.pem -purpose
Certificate purposes:
SSL client : Yes
SSL client CA : No
SSL server : Yes
SSL server CA : No

Revision History

Revision	Publish Date	Comments
1.0	29-Sep-2026	Initial Release