This does not answer my question. Question was answered via IRC by bosburn. The answer is that Splunk does not support this simple mode of encryption. I propose that this feature be added. Something like UseSSL = 1 instead of having to drop a client cert and configure a password on all end-points.
Yes and no. Total agreement that
useSSL=1 would be ideal. When a forwarder is set up to use SSL, providing a certificate to authenticate with is the only way to enable SSL. BUT, the indexer-side's inputs.conf decides whether a client certificate is actually needed to authenticate or not. I would like to see the forwarder side decouple "I would like to use SSL" from "Here is my client certificate"...
Also Brian rocks.