Getting Data In

Qualys scan detecting various SSL certificate vulnerabilities: How to resolve these vulnerabilities?

afamuyiwa
Engager

Our Qualys report detected various SSL certificate vulnerabilities for any devices using Splunk universal forwarder via 8090. We have deployment server configured to push configuration to servers running Splunk agent. After doing some research it appears we need to create a certificate on the deployment server and distribute to any server running Splunk agent. I'm curious to know which certificates I need to distribute. I was able to create self-sign certificates on the deployment server. I would like to resolve vulnerabilities detected by Qualys. I found the following documentation that cert authentication is not recommended for deployment and clients. - https://docs.splunk.com/Documentation/Splunk/7.1.0/Security/Securingyourdeploymentserverandclients

Additional information:
http://docs.splunk.com/Documentation/Splunk/7.1.0/Security/Howtoself-signcertificates
http://docs.splunk.com/Documentation/Splunk/7.1.0/Security/HowtoprepareyoursignedcertificatesforSplu...

Qualys Vulnerabilities:
• X.509 Certificate SHA1 Signature Collision Vulnerability

• SSL Certificate - Self-Signed Certificate

• SSL Certificate - Expired

• SSL Certificate - Subject Common Name Does Not Match Server FQDN

• SSL Certificate - Signature Verification Failed Vulnerability

• HTTP Security Header Not Detected

0 Karma
Get Updates on the Splunk Community!

Full-Stack Security in Financial Services: AppDynamics, Cisco Secure Application, and ...

Full-Stack Security in Financial Services: AppDynamics, Cisco Secure Application, and Splunk ES Protecting a ...

It's Customer Success Time at .conf25

Hello Splunkers,   Ready for .conf25? The customer success and experience team is and can’t wait to see you ...

Pro Tips for First-Time .conf Attendees: Advice from SplunkTrust

Heading to your first .Conf? You’re in for an unforgettable ride — learning, networking, swag collecting, ...