Getting Data In

Qualys scan detecting various SSL certificate vulnerabilities: How to resolve these vulnerabilities?


Our Qualys report detected various SSL certificate vulnerabilities for any devices using Splunk universal forwarder via 8090. We have deployment server configured to push configuration to servers running Splunk agent. After doing some research it appears we need to create a certificate on the deployment server and distribute to any server running Splunk agent. I'm curious to know which certificates I need to distribute. I was able to create self-sign certificates on the deployment server. I would like to resolve vulnerabilities detected by Qualys. I found the following documentation that cert authentication is not recommended for deployment and clients. -

Additional information:

Qualys Vulnerabilities:
• X.509 Certificate SHA1 Signature Collision Vulnerability

• SSL Certificate - Self-Signed Certificate

• SSL Certificate - Expired

• SSL Certificate - Subject Common Name Does Not Match Server FQDN

• SSL Certificate - Signature Verification Failed Vulnerability

• HTTP Security Header Not Detected

0 Karma
Get Updates on the Splunk Community!

Security Highlights | November 2022 Newsletter

 November 2022 2022 Gartner Magic Quadrant for SIEM: Splunk Named a Leader for the 9th Year in a RowSplunk is ...

Platform Highlights | November 2022 Newsletter

 November 2022 Skill Up on Splunk with our New Builder Tech Talk SeriesCan you build it? Yes you can! *play ...

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...