Getting Data In

How do I renew a Splunk forwarder's default certificate?

kannu
Communicator

Hello Splunkers ,

My forwarders are running on default certificates that came up with Splunk forwarders installation. But they are going to expire now and i want to use only default ones.

So guys, please help me figure out how I can renew them for another three years .

Thanks
Manish Kumar

0 Karma
1 Solution

mattymo
Splunk Employee
Splunk Employee

Usually they are updated when you upgrade. Is that an option for you? These must be old UFs?

If not, I would look at downloading the latest version of Splunk and use the certs that come with it, or I believe you can just use openssl to create a new one with a longer expiry ( https://answers.splunk.com/answers/596538/renewing-serverpem-certificate.html ).

The right thing to do would be to swap them out completely for your own. That would make your security team happy! 🙂

http://docs.splunk.com/Documentation/Splunk/7.2.1/Security/AboutsecuringyourSplunkconfigurationwithS...

- MattyMo

View solution in original post

vishaltaneja070
Motivator

Try this bro:
Best way to fix the issue is:
1. Run the command: $SPLUNK_HOME\bin\openssl x509 -enddate -noout -in $SPLUNK_HOME/etc/auth/server.pem
2. Check the expiry date of output if expired then do the below steps:
3. Go to $SPLUNK_HOME\etc\auth\
4. Rename server.pem to server.pem_backup
5. Restart the splunk using command ./splunk restart
6. After restart you will be able to see a new server.pem file.
7. Check the expiry date of Certificate now using command: $SPLUNK_HOME\bin\openssl x509 -enddate -noout -in $SPLUNK_HOME/etc/auth/server.pem
8. The expiry date will be extended.

mattymo
Splunk Employee
Splunk Employee

Usually they are updated when you upgrade. Is that an option for you? These must be old UFs?

If not, I would look at downloading the latest version of Splunk and use the certs that come with it, or I believe you can just use openssl to create a new one with a longer expiry ( https://answers.splunk.com/answers/596538/renewing-serverpem-certificate.html ).

The right thing to do would be to swap them out completely for your own. That would make your security team happy! 🙂

http://docs.splunk.com/Documentation/Splunk/7.2.1/Security/AboutsecuringyourSplunkconfigurationwithS...

- MattyMo

splunkreal
Motivator

This seems wrong now,

support answer: 

Upgrade will no renew the default certificates.

You will have to do it on your own.

* If this helps, please upvote or accept solution if it solved *
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...