topic Re: SSL without Web in Security

SSL without Web

gschmitz — Wed, 06 Mar 2013 07:59:00 GMT

Hi all,
is there a way to use my own SSL certificates for communication between indexers, forwarders, deployment clients and without enabling SSL on Splunk web?
In the docs, it looks like it's required to use https on the frontend, if you want to use it in the backend:
http://docs.splunk.com/Documentation/Splunk/latest/Security/TypesofSplunkconfigurationsthatcanuseSSL

I'd like to use my own CA for the internal stuff and secondly offload SSL to my load balancer for the web traffic.

Best Regards

Re: SSL without Web

bmacias84 — Fri, 08 Mar 2013 19:01:55 GMT

Yes, you can. I currently do the exact same thing. I could provide my approach in detail, if you'd like? But the document you linked to is what I followed.

Re: SSL without Web

Simon — Sat, 09 Mar 2013 11:00:55 GMT

Just ignore step 4 in the documentation. Deploy & configure your CA just for splunkd works perfectly fine.
Btw: When you deploy Splunk out of the box, enableSplunkdSSL is already set to true, means inter-splunkd communication (port 8089).
Note: To enable forwarding encrypted data, don't forget to adjust inputs.conf:

# configure SSL settings
[SSL]
serverCert=$SPLUNK_HOME/etc/auth/server.pem
password=password
rootCA=$SPLUNK_HOME/etc/auth/cacert.pem
requireClientCert=false

# Enable SSL splunk tcp input
[splunktcp-ssl:<port>]

Re: SSL without Web

gschmitz — Mon, 11 Mar 2013 01:32:28 GMT

Hello you too,
that means Splunk Web will use the SSL certificate specified in server.conf as a client certificate when it communicates with search peers on the management port?
Best Regards.