Deployment Architecture

How would you use an internal signed certificate with a Search Head (SH) cluster?

pfabrizi
Path Finder

I have a SH cluster and I would like to import an internal signed certificate to it. Looking for procedures on doing this, I am guessing that I need to import it onto each SH?

I also have a separate ES device that needs a certificate imported to it as well.

Thanks!

1 Solution

harsmarvania57
SplunkTrust
SplunkTrust

If you want to implement Internal signed certificate on Splunk Web on SH Cluster in that case I believe you have load-balancer in front of all 3 SH which are in cluster and you need to implement SSL certificate on Load balancer and CA certificate must be added into your browser's "Trusted Root".

For standalone ES you need to implement configuration on Splunk search head as per below link.

To secure Splunk Web with SSL certificate, here is the documentation http://docs.splunk.com/Documentation/Splunk/7.1.3/Security/SecureSplunkWebusingasignedcertificate

View solution in original post

harsmarvania57
SplunkTrust
SplunkTrust

If you want to implement Internal signed certificate on Splunk Web on SH Cluster in that case I believe you have load-balancer in front of all 3 SH which are in cluster and you need to implement SSL certificate on Load balancer and CA certificate must be added into your browser's "Trusted Root".

For standalone ES you need to implement configuration on Splunk search head as per below link.

To secure Splunk Web with SSL certificate, here is the documentation http://docs.splunk.com/Documentation/Splunk/7.1.3/Security/SecureSplunkWebusingasignedcertificate

View solution in original post

pfabrizi
Path Finder

Thank You!
How do I close this post?

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

Hi @pfabrizi,

I have converted my comment to answer, if it really helps then you can accept/upvote it.

0 Karma

pfabrizi
Path Finder

Hi Harsmarvania57,
Thanks for the response. I am looking to have the cert on SPLUNK WEB. I have 3 search heads clustered and 1 standalone ES server.

          We would like to use https: when logging in and our own cert. 

I will look over the document you included.

Thanks!

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

Hi @pfabrizi,

It will be good if you go through this documentation http://docs.splunk.com/Documentation/Splunk/7.1.3/Security/AboutsecuringyourSplunkconfigurationwithS... and provide more information about your implementation plan. Like where you want to implement Internal Signed Certificate (On Splunk Web, on splunkd ) in SH Cluster?

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!