topic Re: Securing Splunk HEC with LetsEncrypt in Security

Securing Splunk HEC with LetsEncrypt

AxelPersinger — Wed, 09 Sep 2020 01:15:43 GMT

Hi all! I'm trying to enable SSL for my HEC ingestor on a small, centralized Splunk Enterprise deployment. I used Let'sEncrypt to generate the certificates for the Splunk Web interface, as it's trusted by everyone. I'm tying to configure HEC to use the same certificates, but I'm having no luck in doing so. I tried following all the guides/questions on this board for securing HEC using certs, but I'm not sure which .pem files to use, if I have to encrypt them with an additional password, etc.

Thanks!

Re: Securing Splunk HEC with LetsEncrypt

thambisetty — Wed, 09 Sep 2020 06:10:07 GMT

Splunk web doesn't support CSR which is signed with secret key (secret should be removed from key before creating CSR), you might have signed CSR without secret key.

where as HEC requires key. to create cert follow below thread: and follow steps used to create server cert:

https://community.splunk.com/t5/Security/Tcp-data-input-and-ssl/m-p/518529#M11769

you should follow below create pem file ( this is also there in the above thread)

server.pem: is combination of below server_signed_cert.pem server.key internmediate.pem (if any) root.pem

inputs.conf for hec:

[http] enableSSL=1 disabled=0 serverCert = $path/server.pem sslPassword= passwordwhichisusedwhilecreatingprivatekey

Re: Securing Splunk HEC with LetsEncrypt

AxelPersinger — Wed, 09 Sep 2020 11:20:43 GMT

Hi @thambisetty , this looks like a great reference! My question is if I can create this with the Let'sEncrypt generated certificates, that way my HEC will be trusted by everyone? I don't want to have to also manage certificates if possible.

Re: Securing Splunk HEC with LetsEncrypt

AxelPersinger — Wed, 09 Sep 2020 11:44:49 GMT

I got it to work with LetsEncrypt!

From inside the LetsEncrypt directory (probably something like /etc/letsencrypt/live/<site>/)

openssl pkcs8 -topk8 -inform PEM -outform PEM -in privkey.pem -out privkey.enc.pem # Will prompt for password cat cert.pem >> hec.pem cat privkey.enc.pem >> hec.pem cat chain.pem >> hec.pem

Then copy the hec.pem to your desired location, and change the inputs.conf like you said earlier!

Re: Securing Splunk HEC with LetsEncrypt

thambisetty — Wed, 09 Sep 2020 12:00:38 GMT

fantastic. I was checking on let's encrypt to provide guide on how you can sign your own CSR.

Re: Securing Splunk HEC with LetsEncrypt

thambisetty — Wed, 09 Sep 2020 12:02:43 GMT

fantastic, I was checking how you can sign your own CSR in let's encrypt so that you will only have private key.