topic Re: Can we configure HF to receive encrypted traffic using SSL with port 9996 and port 9997 at a same time, using different cert for each, in Getting Data In

Can we configure HF to receive encrypted traffic using SSL with port 9996 and port 9997 at a same time, using different cert for each,

ashishamalviya1 — Tue, 23 May 2017 05:15:51 GMT

HF config eg:-

inputs.conf

[splunktcp-ssl://9997]
disabled = 0

[SSL]
password = abc
requireClientCert = true
rootCA = /opt/splunk/splunk/etc/system/certs/xyz.pem
serverCert = /opt/splunk/splunk/etc/system/certs/abc.pem
sslVersions = tls

[splunktcp-ssl://9996]
disabled = 0

[SSL]
password = abc
requireClientCert = true
rootCA = /opt/splunk/splunk/etc/system/certs/xyz.cer
serverCert = /opt/splunk/splunk/etc/system/certs/def.pem
sslVersions = tls

using two different cert as one create with sha1 and other with sha256

Thanking

Re: Can we configure HF to receive encrypted traffic using SSL with port 9996 and port 9997 at a same time, using different cert for each,

jkat54 — Tue, 23 May 2017 11:36:51 GMT

Yes but you put all the SSL KvPs you have under the splunktcp-ssl stanzas instead.

[splunktcp-ssl]
serverCert =
sslPassword =
requireClientCert =
sslVersions =
cipherSuite =
ecdhCurves =
dhFile =
allowSslRenegotiation = true|false
sslQuietShutdown = [true|false]
sslCommonNameToCheck = , , ...
sslAltNameToCheck = , , ...

Re: Can we configure HF to receive encrypted traffic using SSL with port 9996 and port 9997 at a same time, using different cert for each,

ashishamalviya1 — Tue, 23 May 2017 17:56:12 GMT

above inputs.conf is working config if run with only single stanza, (i.e. either port 9996 or 9997), but this wont work when we combine config as shown above,
please try to provide config eg,

Re: Can we configure HF to receive encrypted traffic using SSL with port 9996 and port 9997 at a same time, using different cert for each,

jkat54 — Sat, 15 Jul 2017 14:58:21 GMT

You can't have two [SSL] stanzas in the same inputs.conf. They are conflicting with one another.

You need to configure each cert under their respective [splunktcp-ssl://PORT] stanzas