Splunk SSL Question

chadwagonerKGI · ‎03-24-2016

So I have a Splunk environment signed by a 3rd party CA. However, the forwarders are using self-signed certificates because it's in a testing environment. WHen I try to send data from forwarder to indexer, I'm getting errors saying it can't verify certificate. I'm guessing it's because it is signed by a different root CA and the 3rd party won't accept it.

Is there any way to add the self signed root CA to a trust store or anything? Or do they have to be all signed by the same 3rd party CA?

davidpaper · ‎03-26-2016

Splunk doesn't use a trust store (java style), but you can instruct Splunk where to find a rootCA from a 3rd party.

outputs.conf:
sslRootCAPath =

Splunk SSL Question

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Mile High Learning with Splunk University, Denver, Colorado

IT Service Intelligence 5.0 Series: Your Guide to the June Launch

Agent Mode Engaged! Enchaining Agentic Operations with Splunk AI Assistant 2.0

Join the Conversation

Splunk SSL Question

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Mile High Learning with Splunk University, Denver, Colorado

IT Service Intelligence 5.0 Series: Your Guide to the June Launch

Agent Mode Engaged! Enchaining Agentic Operations with Splunk AI Assistant 2.0