Securing Splunk servers with SSL (CA-Signed)

spl_unker — Tue, 03 Nov 2020 06:49:06 GMT

Hi All

Im stuck with couple of questions while i working on securing communication between Splunk nodes.

I have 4 forwarders sending data to 3 indexers which is in cluster . I have a 1 deployment server to manage forwarders . and have 1 cluster master:

Question 1 (securing forwarder->indexers): From the Splunk documentation we need to have certificates for both forwarders and indexers. But don't understand why it is required on forwarders as well? Having certificates only in indexers does the job right? . Is it because of Splunk configuration or code demands to have it in forwarders as well?

Question 2 (Cluster Master->indexers) : Since we have already in production , is there any impact or precautions that needs to be taken while making communication secured between CM and indexers. please share any link to document or list high level steps on the configuration .

Thanks in Advance

topic Securing Splunk servers with SSL (CA-Signed) in Splunk Enterprise

Securing Splunk servers with SSL (CA-Signed)