topic Re: Splunk Certificates renewal in Security

Splunk Certificates renewal

siva_cg — Tue, 06 Mar 2018 08:15:41 GMT

Hi Team,

We have distributed environment with Search Heads and Indexers clustered and running on 6.5.2 version. We are using self signed SSL certificates for the communication between the servers and web.

Few of my web connection certificates are expiring. So, I thought of renewing the certificates. Now, my question is, if I renew only web certificates or server to server certificates, will there be any impact on other connections?

As I don't have any knowledge on SSL certificates (challenging it for the first time), I want to make sure, I am not breaking anything.

Thanks in advance.

Re: Splunk Certificates renewal

p_gurav — Tue, 06 Mar 2018 09:14:43 GMT

This link might help you:
http://wiki.splunk.com/Community:SplunkWeb_SSL_3rdPartyCA

Re: Splunk Certificates renewal

mbadhusha_splun — Tue, 22 Jan 2019 05:46:10 GMT

Hey Siva,

You can run the btool command to identify the locations of the SSL certificates (for both splunkweb & encryption between forwarders & indexers) and replace them with the new ones.

$ splunk btool web list --debug
$ splunk btool server list --debug

You need to find the path of the certificates from the above command's output and replace them with the new certificates. You need to generate new Selft-signed certificates by following the below splunk doc.

For SplunkWeb: https://docs.splunk.com/Documentation/Splunk/6.5.2/Security/Self-signcertificatesforSplunkWeb
For Data encryption: https://docs.splunk.com/Documentation/Splunk/6.5.2/Security/ConfigureSplunkforwardingtousesignedcertificates

Hope the above helps!

Cheers.