In the search heads clustering and indexer clustering, the language is such that it sounds like pass4symmkey is used only for client authentication from other search heads or indexers.
I have since seen references in forwarder, cluster master and monitor configuration.
Can someone please clarify whether pass4symmkey is actually used for all client connections to the Management/API/8089 service.
And does pass4symmkey simply compliment client-certificate for connection authentication.
Hi there iamjvn. Duane Waddle gave a great overview of Splunk's various ssl options across the entire deployment. You should check it out, as I think it may help in answering your question.
The value of pass4SymmKey (the secret key) attribute in server.conf should be same across all the Cluster instances. It authenticates the traffic between license master and its slaves, members of the cluster.
The splunk's server.conf has clear details about this key. http://docs.splunk.com/Documentation/Splunk/7.0.2/admin/Serverconf
And does pass4symmkey simply compliment client-certificate for connection authentication -- The answer is No.