topic Splunk web certification configuration in Security

Splunk web certification configuration

uagraw01 — Thu, 09 May 2024 12:09:49 GMT

Hello Splunkers!!

I want to configure SSL certificate in Splunk so that my Splunk web URL communicate over https.

To obtain "privKeyPath" in web.conf I have used below two commands.

splunk cmd openssl genrsa -aes256 -out SplunkPrivateKey.key 2048

splunk cmd openssl rsa -in SplunkPrivateKey.key -out splunk_key.key

To obtain "serverCert" in web.conf I have used below two commands.

splunk cmd openssl x509 -in splunk.cer -out splunk.pem

Note : splunk.cer is with me ( Provided by organization so I am obtaining self signed certificate)

[settings] enableSplunkWebSSL = 1 privKeyPath = D:\Splunk\etc\auth\mycert\splunk_key.key serverCert = D:\Splunk\etc\auth\mycert\splunk.pem

I have used all the above commands and configure the certificate under the paths but still Splunk web is not working securely. Please suggest me any other modification or alteration I need to do ?

Thanks in advance !!

Re: Splunk web certification configuration

tscroggins — Sun, 12 May 2024 21:40:08 GMT

Hi @uagraw01,

Browsers will not trust your self-signed certificates without additional configuration. In most cases, you'll want to use a certificate signed by a mutually trusted certificate authority. This is not an endorsement of Qualys, but https://www.ssllabs.com/ provides general information on SSL/TLS that you may find beneficial.

Re: Splunk web certification configuration

VatsalJagani — Tue, 14 May 2024 06:11:53 GMT

@uagraw01 - As suggested by @tscroggins self-signed certificates needs to be added to certificate store. Here are references to be done on Mac and Windows:

I hope this helps!!! If it does kindly upvote!!!

Re: Splunk web certification configuration

uagraw01 — Tue, 14 May 2024 17:11:41 GMT

@tscroggins @VatsalJagani Thanks For sharing the refrence links. I am very close to setup the secure SSL connection by using openssl. Once completely done I will share the complete steps here also.