topic Universal Forwarder hosts - How do I replace self-signed SSL cert with one from LetsEncrypt on Debian &amp; Ubuntu? in Installation https://community.splunk.com/t5/Installation/Universal-Forwarder-hosts-How-do-I-replace-self-signed-SSL-cert/m-p/622738#M12136 <P>Tenable.io is alerting on all my splunk universal forwarder client hosts (Debian &amp; Ubuntu)</P><P>It is seeing port 8089 on these hosts (probably the management port??) and throwing this error:</P><P class="lia-indent-padding-left-30px">The following certificate was found at the top of the certificate<BR />chain sent by the remote host, but is self-signed and was not<BR />found in the list of known certificate authorities :</P><P class="lia-indent-padding-left-30px">|-Subject : C=US/ST=CA/L=San Francisco/O=Splunk/CN=SplunkCommonCA/E=support@splunk.com</P><P>I dont need to encypt splunk commuications from universal forwarder to splunk server, I just want Tenable to see a signed cert on this port so it doesnt complain. Where is this file and can I replace it with my fullchain.pem from Letsencrypt that is already elsewhere on this host?</P><P>thanks,</P><P>Matt</P><P class="lia-indent-padding-left-30px"></P> Wed, 30 Nov 2022 20:40:43 GMT mbw 2022-11-30T20:40:43Z Universal Forwarder hosts - How do I replace self-signed SSL cert with one from LetsEncrypt on Debian & Ubuntu? https://community.splunk.com/t5/Installation/Universal-Forwarder-hosts-How-do-I-replace-self-signed-SSL-cert/m-p/622738#M12136 <P>Tenable.io is alerting on all my splunk universal forwarder client hosts (Debian &amp; Ubuntu)</P><P>It is seeing port 8089 on these hosts (probably the management port??) and throwing this error:</P><P class="lia-indent-padding-left-30px">The following certificate was found at the top of the certificate<BR />chain sent by the remote host, but is self-signed and was not<BR />found in the list of known certificate authorities :</P><P class="lia-indent-padding-left-30px">|-Subject : C=US/ST=CA/L=San Francisco/O=Splunk/CN=SplunkCommonCA/E=support@splunk.com</P><P>I dont need to encypt splunk commuications from universal forwarder to splunk server, I just want Tenable to see a signed cert on this port so it doesnt complain. Where is this file and can I replace it with my fullchain.pem from Letsencrypt that is already elsewhere on this host?</P><P>thanks,</P><P>Matt</P><P class="lia-indent-padding-left-30px"></P> Wed, 30 Nov 2022 20:40:43 GMT https://community.splunk.com/t5/Installation/Universal-Forwarder-hosts-How-do-I-replace-self-signed-SSL-cert/m-p/622738#M12136 mbw 2022-11-30T20:40:43Z