Custom SSL Cert Issues

TitanAE — Tue, 27 Feb 2018 08:55:42 GMT

Hey splunk team,

I need a bit (okay a lot of help). I'm not sure what I'm doing wrong, but I'm following these guides to create my own self-signed ssl certificate:

http://wiki.splunk.com/Community:Splunk2Splunk_SSL_SelfSignedCert_NewRootCA

http://docs.splunk.com/Documentation/Splunk/7.0.2/Security/Howtoself-signcertificates

However after looking at my logs, my forwarder shows the following:

02-27-2018 00:45:19.808 -0800 INFO  TcpOutputProc - Removing quarantine from idx=192.168.0.43:9997
02-27-2018 00:45:19.808 -0800 WARN  TcpOutputFd - Connect to 192.168.0.43:9997 failed. Connection refused
02-27-2018 00:45:19.808 -0800 ERROR TcpOutputFd - Connection to host=192.168.0.43:9997 failed
02-27-2018 00:45:19.809 -0800 WARN  TcpOutputFd - Connect to 192.168.0.43:9997 failed. Connection refused
02-27-2018 00:45:19.809 -0800 ERROR TcpOutputFd - Connection to host=192.168.0.43:9997 failed
02-27-2018 00:45:19.809 -0800 WARN  TcpOutputProc - Applying quarantine to ip=192.168.0.43 port=9997 _numberOfFailures=2

At this point I'm not sure what I'm doing wrong. If it helps, my forwarders outputs.conf looks like this:

[tcpout]
defaultGroup = splunkssl

[tcpout:splunkssl]
server = 192.168.0.43:9997
compressed = true
sslRootCAPath = /opt/splunkforwarder/etc/certs/myCACertificate.pem
sslCertPath = /opt/splunkforwarder/etc/certs/myServerCertificate.pem
sslPassword = $xxxxxxxxxxxxx=
sslVerifyServerCert = true

My indexer's input.conf looks like this:

[default]
host = splunk

[SSL]
rootCA = /opt/splunk/etc/certs/myCACertificate.pem
serverCert = /opt/splunk/etc/certs/myServerCertificate.pem
password = $xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
#password = $xxxxxxxxxxxxxx
requireClientCert = false

[splunktcp-ssl:9997]
compressed = true
disabled = 0

And i've added this line to my indexer's server.conf. This was based on the default configuration for ssl certificates on the indxer, plus the guide to using self signed certs:

sslRootCAPatch = /opt/splunk/etc/system/local/certs/myCACertificate.pem

Any help or advice is appreciated.

topic Custom SSL Cert Issues in Security

Custom SSL Cert Issues