How would you use an internal signed certificate with a Search Head (SH) cluster?

[pfabrizi]

I have a SH cluster and I would like to import an internal signed certificate to it. Looking for procedures on doing this, I am guessing that I need to import it onto each SH?

I also have a separate ES device that needs a certificate imported to it as well.

Thanks!

[harsmarvania57 · Accepted solution]

If you want to implement Internal signed certificate on Splunk Web on SH Cluster in that case I believe you have load-balancer in front of all 3 SH which are in cluster and you need to implement SSL certificate on Load balancer and CA certificate must be added into your browser's "Trusted Root".

For standalone ES you need to implement configuration on Splunk search head as per below link.

To secure Splunk Web with SSL certificate, here is the documentation http://docs.splunk.com/Documentation/Splunk/7.1.3/Security/SecureSplunkWebusingasignedcertificate

[pfabrizi]

Thank You!
How do I close this post?

[harsmarvania57]

Hi @pfabrizi,

I have converted my comment to answer, if it really helps then you can accept/upvote it.

[pfabrizi]

Hi Harsmarvania57,
Thanks for the response. I am looking to have the cert on SPLUNK WEB. I have 3 search heads clustered and 1 standalone ES server.

          We would like to use https: when logging in and our own cert. 

I will look over the document you included.

Thanks!

[harsmarvania57]

Hi @pfabrizi,

It will be good if you go through this documentation http://docs.splunk.com/Documentation/Splunk/7.1.3/Security/AboutsecuringyourSplunkconfigurationwithS... and provide more information about your implementation plan. Like where you want to implement Internal Signed Certificate (On Splunk Web, on splunkd ) in SH Cluster?