https://community.splunk.com/t5/Getting-Data-In/SSL-encryption-and-authentication-between-Heavy-Forwarder-and/m-p/208915#M41139 <P>Hello,</P> <P>I have a doubt with respect to the below stanzas in Heavy forwarder and indexers. Will the below stanzas ensures SSL authentication only OR it will encrypt the communication as well? If it ensures encryption as well can you please put some light?</P> <P>outputs.conf in Heavy Forwarder</P> <P>[tcpout]<BR /> defaultGroup = splunkssl</P> <P>[tcpout:splunkssl]<BR /> server = 1.1.1.1:9997<BR /> sslRootCAPath = $SPLUNK_HOME/etc/auth/mycerts/myCACertificate.pem<BR /> sslCertPath = $SPLUNK_HOME/etc/auth/mycerts/myForwarderCertificate.pem<BR /> sslPassword = $%^!@#%<BR /> sslVerifyServerCert = true</P> <H2>sslCommonNameToCheck = xyz.abc</H2> <P>inputs.conf in Indexer</P> <P>[SSL]<BR /> rootCA = $SPLUNK_HOME/etc/auth/mycerts/myCACertificate.pem<BR /> serverCert = $SPLUNK_HOME/etc/auth/mycerts/myIndexerCertificate.pem<BR /> password = &amp;#^#$%<BR /> requireClientCert = true</P> <P>[splunktcp-ssl:9997]<BR /> compressed = true</P> Tue, 29 Sep 2020 10:29:59 GMT splunk_kk 2020-09-29T10:29:59Z https://community.splunk.com/t5/Getting-Data-In/SSL-encryption-and-authentication-between-Heavy-Forwarder-and/m-p/208915#M41139 <P>Hello,</P> <P>I have a doubt with respect to the below stanzas in Heavy forwarder and indexers. Will the below stanzas ensures SSL authentication only OR it will encrypt the communication as well? If it ensures encryption as well can you please put some light?</P> <P>outputs.conf in Heavy Forwarder</P> <P>[tcpout]<BR /> defaultGroup = splunkssl</P> <P>[tcpout:splunkssl]<BR /> server = 1.1.1.1:9997<BR /> sslRootCAPath = $SPLUNK_HOME/etc/auth/mycerts/myCACertificate.pem<BR /> sslCertPath = $SPLUNK_HOME/etc/auth/mycerts/myForwarderCertificate.pem<BR /> sslPassword = $%^!@#%<BR /> sslVerifyServerCert = true</P> <H2>sslCommonNameToCheck = xyz.abc</H2> <P>inputs.conf in Indexer</P> <P>[SSL]<BR /> rootCA = $SPLUNK_HOME/etc/auth/mycerts/myCACertificate.pem<BR /> serverCert = $SPLUNK_HOME/etc/auth/mycerts/myIndexerCertificate.pem<BR /> password = &amp;#^#$%<BR /> requireClientCert = true</P> <P>[splunktcp-ssl:9997]<BR /> compressed = true</P> Tue, 29 Sep 2020 10:29:59 GMT https://community.splunk.com/t5/Getting-Data-In/SSL-encryption-and-authentication-between-Heavy-Forwarder-and/m-p/208915#M41139 splunk_kk 2020-09-29T10:29:59Z https://community.splunk.com/t5/Getting-Data-In/SSL-encryption-and-authentication-between-Heavy-Forwarder-and/m-p/208916#M41140 <P>Yes, data will be encrypted. If you check data packets by tcpdump or wireshark, you won't be able to see the data content. </P> <P>Splunk s2s(splunk to splunk, forwarder to indexer) SSL setting always enable SSL encryption.<BR /> SSL Certificate Authentication is to validate CA authority and the Server's Common Name in the indexer's certificate by adding "sslVerifyServerCert" and "sslCommonNameToCheck"</P> <P>A few links related to this topic<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/Latest/Security/AboutsecuringyourSplunkconfigurationwithSSL">http://docs.splunk.com/Documentation/Splunk/Latest/Security/AboutsecuringyourSplunkconfigurationwithSSL</A><BR /> <A href="http://docs.splunk.com/Documentation/Splunk/6.4.2/Security/Aboutsecuringdatafromforwarders">http://docs.splunk.com/Documentation/Splunk/6.4.2/Security/Aboutsecuringdatafromforwarders</A><BR /> <A href="http://docs.splunk.com/Documentation/Splunk/Latest/Admin/Outputsconf">http://docs.splunk.com/Documentation/Splunk/Latest/Admin/Outputsconf</A></P> Thu, 04 Aug 2016 22:10:41 GMT https://community.splunk.com/t5/Getting-Data-In/SSL-encryption-and-authentication-between-Heavy-Forwarder-and/m-p/208916#M41140 Masa 2016-08-04T22:10:41Z