topic How do I renew a Splunk forwarder's default certificate? in Getting Data In

How do I renew a Splunk forwarder's default certificate?

kannu — Fri, 23 Nov 2018 14:56:42 GMT

Hello Splunkers ,

My forwarders are running on default certificates that came up with Splunk forwarders installation. But they are going to expire now and i want to use only default ones.

So guys, please help me figure out how I can renew them for another three years .

Thanks
Manish Kumar

Re: How do I renew a Splunk forwarder's default certificate?

mattymo — Fri, 23 Nov 2018 20:48:45 GMT

Usually they are updated when you upgrade. Is that an option for you? These must be old UFs?

If not, I would look at downloading the latest version of Splunk and use the certs that come with it, or I believe you can just use openssl to create a new one with a longer expiry ( https://answers.splunk.com/answers/596538/renewing-serverpem-certificate.html ).

The right thing to do would be to swap them out completely for your own. That would make your security team happy! 🙂

http://docs.splunk.com/Documentation/Splunk/7.2.1/Security/AboutsecuringyourSplunkconfigurationwithSSL

Re: How do I renew a Splunk forwarder's default certificate?

vishaltaneja070 — Tue, 29 Sep 2020 23:00:49 GMT

Try this bro:
Best way to fix the issue is:
1. Run the command: $SPLUNK_HOME\bin\openssl x509 -enddate -noout -in $SPLUNK_HOME/etc/auth/server.pem
2. Check the expiry date of output if expired then do the below steps:
3. Go to $SPLUNK_HOME\etc\auth\
4. Rename server.pem to server.pem_backup
5. Restart the splunk using command ./splunk restart
6. After restart you will be able to see a new server.pem file.
7. Check the expiry date of Certificate now using command: $SPLUNK_HOME\bin\openssl x509 -enddate -noout -in $SPLUNK_HOME/etc/auth/server.pem
8. The expiry date will be extended.

Re: How do I renew a Splunk forwarder's default certificate?

splunkreal — Thu, 22 Jul 2021 10:53:56 GMT

This seems wrong now,

support answer:

Upgrade will no renew the default certificates.

You will have to do it on your own.