Splunk SSO: server side certificate rotation process

jpillai — Sat, 30 Mar 2024 12:09:21 GMT

Hi all,

Im trying to understand how rotation certificates used for SSO works in a search head cluster. We have a searchhead cluster where we have SSO working already. As for initial setup, I understand we can download SPmetadata.xml file from splunk SAML settings page. However, during rotation, how do we create this as we are using a cert thats already existing and we want to rotate the server side certificate?

If we just download SPmetadata.xml for creating request for IDP, this will have same cert as we are using. If we rotate the cert first at our side so we can download SPmetadata.xml to create request for IDP, then this will end up in error as IDP wont detect server side certificate during this, obviously.

Re: Splunk SSO: server side certificate rotation process

PaulPanther — Wed, 03 Apr 2024 11:58:49 GMT

Hi @jpillai

you have only the option to switch the certificate at the same time on both ends (Splunk & IDP provider).

Just for a certificate replacement you don't need the SPmetadata.xml if the other parameter won't be change.

Create the certificate, hand over the certificate chain to the IDP colleagues, agree a time window for the renewal and then do it.

topic Splunk SSO: server side certificate rotation process in Splunk Enterprise

Splunk SSO: server side certificate rotation process

Re: Splunk SSO: server side certificate rotation process