topic Re: Custom Splunk management port 8089 certificate in Security

Custom Splunk management port 8089 certificate

splunkreal — Mon, 01 Feb 2021 18:23:09 GMT

Hello guys,

tried to update server.conf but Splunk crashed with handshake failure accessing https://localhost:8089

[sslConfig]
#sslPassword = $7$OXZyp5GzoeMoXOIUSMqIFC+4Od7JKUacyjpUPBRobqwXbKYgAoObNg==
serverCert = $SPLUNK_HOME/etc/apps/APP_OUTPUTS/default/preproduction-server.pem
sslPassword = xxx
sslRootCAPath = $SPLUNK_HOME/etc/apps/APP_OUTPUTS/default/preproduction-cacert.pem
requireClientCert = true

Is it necessary to also update web.conf according to https://docs.splunk.com/Documentation/Splunk/7.3.4/Security/Securingyourdeploymentserverandclients?

May it break the deployment server / DS clients?

Also does it impact implementation of [tcp-ssl] port?

Thanks.

Re: Custom Splunk management port 8089 certificate

scelikok — Mon, 01 Feb 2021 18:32:55 GMT

Hi @splunkreal,

Since Splunk Web is communicating with splunkd running on 8089, you should update web.conf too.

If this server is Deployment server, you should distribute the certificate to clients too.

Re: Custom Splunk management port 8089 certificate

splunkreal — Tue, 02 Feb 2021 09:30:27 GMT

Thanks it works 🙂

I used requireClientCert = false as certification is not dedicated to my host otherwise do you mean we should distribute the certificates to deployment clients, this would be time-consuming and out of Splunk scope (deploy certs through Puppet/Ansible for instance)?