topic Re: How do I convert HEC to SSL? (HTTP to HTTPS) in Getting Data In

How do I convert HEC to SSL? (HTTP to HTTPS)

danielbb — Sun, 26 Jan 2025 21:11:03 GMT

What do I need to change in order to convert HEC on HTTP to HEC on HTTPS?

Re: How do I convert HEC to SSL? (HTTP to HTTPS)

isoutamo — Sun, 26 Jan 2025 21:59:22 GMT

You must turn on TLS/SSL on hec configuration. I think that in cloud there is only https available, but in onprem you could use both but not at the same time in one node!
I this doc look enterprise part and enable ssl.
https://docs.splunk.com/Documentation/Splunk/9.4.0/Data/UsetheHTTPEventCollector
When you are using it then just use https instead of http as a protocol.
Earlier there was some requirements that TLS certificates must be official at least with some senders? I don’t know if this is still valid requirement or can you use private certificates also?

Re: How do I convert HEC to SSL? (HTTP to HTTPS)

danielbb — Tue, 28 Jan 2025 16:55:28 GMT

Thank you @isoutamo, I changed the global setting to HTTPS and it works perfectly fine. I just don't understand how it works, doesn't the sender need the public key? how does it work?

Re: How do I convert HEC to SSL? (HTTP to HTTPS)

isoutamo — Tue, 28 Jan 2025 18:37:53 GMT

There haven’t been any requirements for specific client cert as HEC has planned to be “open” at this point of view. The real “authentication” has done with given token. In that way there is no need to share any TLS client certificates for source side.

Re: How do I convert HEC to SSL? (HTTP to HTTPS)

PickleRick — Wed, 29 Jan 2025 10:33:50 GMT

Actually, this is not entirely true.

1. With HEC the "basic" form of... well, it's not even authentication as such since the token is not very secret and is often used by many different sources, is a HEC token.

2. Additionally, you can limit source IPs from which the HTTP input accepts connections (the acceptFrom setting)

3. If you have TLS enabled you can use requireClientCert option to require the client to present a valid cert. By default this option is disabled so HEC can accept TLS connection from anyone (possibly with exception for clients not meeting the defined sslVersions or cipher suites).

4. Additionally to 3. you can limit accepted clients to only those presenting clients containing either sslCommonNameToCheck values or sslAltNameToCheck.

It's a relatively rarely used option since as @isoutamo said - typically HEC is a rather "open" input but the options are there.

I don't remember for certain but I think the 3. and 4. parameters can only be defined on a HEC input as a whole, not on a per-token basis.