Additional SSL Verification

v_trilo — Sun, 07 Jun 2020 18:01:02 GMT

Hey everyone.
First time SSL setup (IDX & UF both v8.x) and cert creation (never done before). Had a question about verifying if things worked. I walked through splunk docs and got to the point of verifying connection.

https://docs.splunk.com/Documentation/Splunk/8.0.2/Security/Validateyourconfiguration

On my IDX i can run:

index=_internal source=*metrics.log* group=tcpin_connections | 
dedup hostname | table _time hostname version sourceIp destPort ssl

I do get expected result returned port (9998) and SSL = true.
BUT this was the only part of the instructions that i could follow to verify SSL items. I can't find anything else within Splunkd or index=_* referencing what is being mentioned in the validating procedures for the UF portion. I can see that the UF has the following output in splunkd "Connected to idx=10.202.20.229:9998". This UF is only setup to forward to the one server over port 9998.

The next steps i followed where on this page https://docs.splunk.com/Documentation/Splunk/8.0.2/Security/Troubleshootyouforwardertoindexerauthentication

openssl s_client -connect <server>:<port>

and the expected output mentioned Verify return code: 0 (ok) was instead returning code: 18 (self signed certificate).
Then on the UF i attempted to monitor a random log file that i update. On the main Splunk server i can see the data come in.
I'm just second guessing if i did things correctly given i wasn't able to validate internal Splunk logs.

server.conf 
 [sslConfig]
 sslRootCAPath = /opt/splunkforwarder/etc/auth/myCerts/myCACertificate.pem
 sslPassword = <with pass here>
outputs.conf 
 [SSL]
 [tcpout]
defaultGroup = group1
 [tcpout:group1]
 server = 10.202.20.229:9998
 disabled = 0
 clientCert = /opt/splunkforwarder/etc/auth/myCerts/myNewSplunkForwarderCert.pem
useClientSSLCompression = true
sslPassword = <with pass here>

IDX

inputs.conf
 [splunktcp-ssl:9998]
disabled = 0
[SSL]
serverCert = /opt/splunk/etc/auth/myCerts/myNewSplunkIndexerCert.pem
sslPassword = <with pass here>
requireClientCert = "true"
server.conf
 [sslConfig]
 sslRootCAPath = /opt/splunk/etc/auth/myCerts/myCACertificate.pem
 sslPassword = <with pass here>

topic Additional SSL Verification in Security

Additional SSL Verification