I have an 8.0.5 Splunk environment. It is not a cluster, there is one indexer. I am quickly headed towards a distributed environment and have an search head setup but not integrated yet. I have 1 heavy forwarder/deployment server/license manager. The new Heavy forwarder I'm setting up I need some help with setting up certs. Here is the scenario.
New heavy forwarder will received data from 2 universal forwarders managed by another team (we don't have access to them). Part of their requirement for receiving this data is that the connection is encrypted. We have purchased a server cert for the heavy forwarder (servername.splunkidy.splunk.com), and it is in PEM format.
The question is how do we install it when trying to secure a universal forwarder to a heavy forwarder? I haven't been able to find an example of universal to heavy forwarder ssl cert setup. I admit Certs are my kryptonite, but the Linux admin that is helping is having trouble figuring out how we need to do this. Do we send the other team the public key so they can access the heavy forwarder? I feel like we're missing a piece and can't figure out what that is.
