topic Re: Encrypting traffic between universal forwarder and indexer in Security

Encrypting traffic between universal forwarder and indexer

snix — Fri, 02 Feb 2024 20:52:18 GMT

I would like to start encrypting traffic between the universal forwarder on my Windows devices and my single Splunk 9.x indexer that is on a Windows server. For the moment I am only concerned with getting SSL going on the indexer. I see you can also setup a certificate on the clients for authentication to the server but I want to take it one step at a time.

I have a GoDaddy cert I would like to use with the indexer and I have looked over much of the documentation on Splunk's site on all the ways you can make this configuration work but it left me confused. I can't find any mention to what to do about the public key. I see where the documentation references the server certificate and even the sslPassword in the input.conf file but no reference where to to put the key location.

Is it just assumed you combine the server cert + the private key into a single pem file and if so is the order just server cert first then private key?

Example:

-----BEGIN CERTIFICATE----- ... -----END CERTIFICATE----- -----BEGIN PRIVATE KEY----- ... -----END PRIVATE KEY-----

Re: Encrypting traffic between universal forwarder and indexer

gcusello — Sat, 03 Feb 2024 06:41:42 GMT

Hi @snix,

have you read this: https://docs.splunk.com/Documentation/Splunk/latest/Security/AboutsecuringyourSplunkconfigurationwithSSL ?

Ciao.

Giuseppe

Re: Encrypting traffic between universal forwarder and indexer

PickleRick — Sun, 04 Feb 2024 13:12:39 GMT

The proper order for the pem file is

Subject's certificate
Subject's private key
Issuing CA certificate chain (unless you explicitly trust the issuer of the subject's certificate).

The location of the file is tricky because the settings can be either inherited from the default server-wide settings which you set up in server.conf - https://docs.splunk.com/Documentation/Splunk/latest/admin/serverconf#SSL.2FTLS_Configuration_details or can be overriden at the specific input level.

As a side note - certificates for web interface are configured differently.