topic Re: SSL/TLS Configuration on Splunk Forwarder (Windows) in Getting Data In

SSL/TLS Configuration on Splunk Forwarder (Windows)

BRFZ — Mon, 24 Mar 2025 11:23:30 GMT

Hello,

I’ve been reviewing the documentation for configuring SSL/TLS on a Splunk forwarder, but I couldn’t find the specific steps for setting it up on a Windows machine. Would anyone be able to provide the procedure or a link to the relevant documentation?

Best regards,

Re: SSL/TLS Configuration on Splunk Forwarder (Windows)

livehybrid — Mon, 24 Mar 2025 11:30:09 GMT

Hi @BRFZ

I think the best place to start for setting up SSL/TLS is at https://docs.splunk.com/Documentation/Splunk/9.4.1/Security/ConfigureSplunkforwardingtousesignedcertificates

Please let me know how you get on and consider adding karma to this or any other answer if it has helped.
Regards

Will

Re: SSL/TLS Configuration on Splunk Forwarder (Windows)

kiran_panchavat — Mon, 24 Mar 2025 11:34:40 GMT

@BRFZ

Your forwarder would need SSL certs and configurations as well to enable SSL communication with your SSL enabled indexer. This documentation will give you all the

https://docs.splunk.com/Documentation/Splunk/9.4.1/Security/ConfigureSplunkforwardingtousesignedcertificates

Re: SSL/TLS Configuration on Splunk Forwarder (Windows)

kiran_panchavat — Mon, 24 Mar 2025 11:39:44 GMT

@BRFZ

A client certificate (e.g., client.pem) for the forwarder, including the private key.
The Certificate Authority (CA) certificate (e.g., cacert.pem) that signed the indexer’s server certificate.
Place these files in a secure directory on the Windows machine, such as C:\Program Files\SplunkUniversalForwarder\etc\auth\mycerts\. Create the mycerts folder if it doesn’t exist.
Open or create the outputs.conf file in C:\Program Files\SplunkUniversalForwarder\etc\system\local\. If it doesn’t exist, create it.
Add the following configuration to specify the indexer(s) and enable TLS:

[tcpout]
defaultGroup = my_indexers

[tcpout:my_indexers]
server = <indexer_hostname>:9997
clientCert = C:\Program Files\SplunkUniversalForwarder\etc\auth\mycerts\client.pem
sslPassword = <password_for_client_certificate>
sslRootCAPath = C:\Program Files\SplunkUniversalForwarder\etc\auth\mycerts\cacert.pem
sslVerifyServerCert = true
sslCommonNameToCheck = <indexer_common_name>
useClientSSLCompression = true

Open or create the server.conf file in C:\Program Files\SplunkUniversalForwarder\etc\system\local\.
Add the following to specify the CA certificate for verifying the indexer:

[sslConfig]
sslRootCAPath = C:\Program Files\SplunkUniversalForwarder\etc\auth\mycerts\cacert.pem

This ensures the forwarder trusts the CA that signed the indexer’s certificate.
Restart the Splunk Forwarder:
cd C:\Program Files\SplunkUniversalForwarder\bin and splunk restart
Check the forwarder’s logs for errors in C:\Program Files\SplunkUniversalForwarder\var\log\splunk\splunkd.log. Look for messages related to TcpOutputProc or SSL/TLS issues (e.g., X509Verify or SSLCommon errors).

https://community.splunk.com/t5/Getting-Data-In/Why-is-my-Windows-Forwarder-SSL-Configuration-not-forwarding/m-p/591237

Your forwarder would need SSL certs and configurations as well to enable SSL communication with your SSL enabled indexer. This documentation will give you all the

https://docs.splunk.com/Documentation/Splunk/9.4.1/Security/ConfigureSplunkforwardingtousesignedcertificates

Re: SSL/TLS Configuration on Splunk Forwarder (Windows)

BRFZ — Mon, 24 Mar 2025 12:47:01 GMT

@kiran_panchavat,

Thank you for your response. I reviewed the documentation, and I found the following phrase for configuring SSL on both indexers and forwarders (non-Windows):

"On forwarders that do not run on Windows, open the server.conf configuration file for editing.
Add the following stanza and settings to the file:
[sslConfig]
sslRootCAPath = <absolute path to the certificate authority certificate>"

Based on this, it seems that the CA configuration is required only on non-Windows systems (Linux). Could you please confirm if this configuration is needed for Windows forwarders as well?

Thank you for your help!

Re: SSL/TLS Configuration on Splunk Forwarder (Windows)

kiran_panchavat — Mon, 24 Mar 2025 12:53:50 GMT

@BRFZ

Yes, It's correct.

Re: SSL/TLS Configuration on Splunk Forwarder (Windows)

kiran_panchavat — Mon, 24 Mar 2025 13:32:50 GMT

@BRFZ

Check this community link

https://www.reddit.com/r/Splunk/comments/sgeuhl/whats_the_deal_with_uf_hf_ssl_certs/

https://community.splunk.com/t5/Getting-Data-In/Why-is-my-Windows-Forwarder-SSL-Configuration-not-forwarding/m-p/591594

Re: SSL/TLS Configuration on Splunk Forwarder (Windows)

PickleRick — Mon, 24 Mar 2025 13:37:08 GMT

The documentation is about the same regardless of wheteher it's windows or linux. (the only minute difference is CA trust store definition if you use the OS store).

The question is what do you need.

There are two layers here.

1. Configuration of connection encryption (which should be enabled by default) and server's identity verification.

2. Configuration of forwarder authentication to your receiver with TLS.

You should first make sure that the first point is properly configured. Then you can go to configuring the second one. People often try to do both things at the same time and get confused with different settings and different results.

Re: SSL/TLS Configuration on Splunk Forwarder (Windows)

BRFZ — Fri, 28 Mar 2025 08:46:25 GMT

Hello,

@kiran_panchavat, @PickleRick , @livehybrid

Thank you for your responses; they were very helpful for me. However, I would like to know if you happen to know why I am getting ack set to false?

Re: SSL/TLS Configuration on Splunk Forwarder (Windows)

livehybrid — Fri, 28 Mar 2025 10:09:08 GMT

Hi @BRFZ

useAck=false is the default value in outputs.conf for whether or not to use indexer acknowledgment.

Essentially, with this set to true it means that the forwarder saves the event until the indexer has acknowledged that it has fully processed the event (typically that it is written to disk).

For more info check out https://docs.splunk.com/Documentation/Splunk/9.4.1/Admin/Outputsconf#:~:text=Distributed%20Deployment%20manual.-,useACK%20%3D%20%3Cboolean%3E,-*%20Whether%20or%20not

Please let me know how you get on and consider adding karma to this or any other answer if it has helped.
Regards

Will