How do I renew a Splunk forwarder's default certificate?

[kannu]

Hello Splunkers ,

My forwarders are running on default certificates that came up with Splunk forwarders installation. But they are going to expire now and i want to use only default ones.

So guys, please help me figure out how I can renew them for another three years .

Thanks
Manish Kumar

[vishaltaneja070]

Try this bro:
Best way to fix the issue is:
1. Run the command: $SPLUNK_HOME\bin\openssl x509 -enddate -noout -in $SPLUNK_HOME/etc/auth/server.pem
2. Check the expiry date of output if expired then do the below steps:
3. Go to $SPLUNK_HOME\etc\auth\
4. Rename server.pem to server.pem_backup
5. Restart the splunk using command ./splunk restart
6. After restart you will be able to see a new server.pem file.
7. Check the expiry date of Certificate now using command: $SPLUNK_HOME\bin\openssl x509 -enddate -noout -in $SPLUNK_HOME/etc/auth/server.pem
8. The expiry date will be extended.

[mattymo · Accepted solution]

Usually they are updated when you upgrade. Is that an option for you? These must be old UFs?

If not, I would look at downloading the latest version of Splunk and use the certs that come with it, or I believe you can just use openssl to create a new one with a longer expiry ( https://answers.splunk.com/answers/596538/renewing-serverpem-certificate.html ).

The right thing to do would be to swap them out completely for your own. That would make your security team happy! 🙂

http://docs.splunk.com/Documentation/Splunk/7.2.1/Security/AboutsecuringyourSplunkconfigurationwithS...

[splunkreal]

This seems wrong now,

support answer: 

Upgrade will no renew the default certificates.

You will have to do it on your own.