Can I enable SSL for a universal forwarder (public IP), but not for a local universal forwarder (private IP)?

[arbabnazar]

Hi,

Can I enable the SSL for the universal forwarder that will access it through the public ip, but not the forwarder that accesses Splunk from its private ip? Is it possible?

Thanks,

[lguinn2]

Yes - but you need to think about the indexers as well. On the indexer, you can have a receiving port that uses SSL. You can also have a receiving port that does not - but you can't have a single port that does both. So set up 2 ports: let's say 9995 for SSL and 9996 for non-SSL. Of course, you have to do the SSL setup for port 9995.

Then on the forwarder, you can have more than one stanza in outputs.conf - when you are sending to port 9995, you have to specify the SSL options. When you forward to port 9996, you don't need those options.

There is more information here:
Configure Splunkforwarding to use signed certificates
Splunk wiki article on using default certs