topic Re: Check HTTPS certifciates in Security

Check HTTPS certifciates

zugji — Fri, 05 Dec 2014 04:33:18 GMT

Ist there a way to check SSL Webcertificate over HTTPS withing Splunk>?

Re: Check HTTPS certifciates

felipetesta — Fri, 05 Dec 2014 07:43:31 GMT

I am not sure what you want to achieve, but you probably need to write an external command that opens the SSL connection, dumps the certificate and produces a Splunk-able output. Python has client SSL support, and maybe it supports dumping cert attributes.

Re: Check HTTPS certifciates

MuS — Fri, 05 Dec 2014 07:58:46 GMT

Hi zugji,

use the approach of @felipetesta ... or read this http://answers.splunk.com/answers/134053/ciphersuite-in-various-conf-files.html and use the provided examples to check/get the SSL certs of an Indexer like this:

$SPLUNK_HOME/bin/splunk cmd openssl s_client -connect <Indexer>:8089

hope this helps ...

cheers, MuS