How do I set the SSL cert for the management port (8089)?

[wohali]

Like the question says, I'd like to build some REST clients using Splunk (4.3.2, 4.3.3) that will not be running on the same host as Splunk. I'd like those clients to certify the certificate of the host.

My Splunk server has certs installed and access to the main web interface over https raises no browser warnings. However, all access to port 8089 shows the Splunk self-signed certificate is being used, and requires I disable cert checking (curl -k).

I found no settings in web.conf that address this.

How do I set the certificate for splunkd's management port?

[jrodman · Accepted solution]

Our general documentation on setting up SSL certs for splunkd activities is here:
http://docs.splunk.com/Documentation/Splunk/latest/Admin/SecureaccesstoyourSplunkserverwithSSL

Note that there are of course multiple protocols for which you can use a cert with Splunkd: the management port which is https, and forwarding which is a streaming ssl socket of data.

[edit] as of Splunk version 5.0, there is a new Securing Splunk manual, and the above link will not work:
http://docs.splunk.com/Documentation/Splunk/latest/Security/AboutsecuringyourSplunkconfigurationwith...

[jrodman]

I agree with your judgement.

[wohali]

Thanks! It's extra confusing that you set the port for splunkd in web.conf, but you set the certificate for splunkd in server.conf. These settings should be together!