Getting Data In

Support for multiple CA for universal forwarder to heavy forwarder connections


We are working with mutiple platforms that will send log data to heavy forwarders. We want to encrypt and if possible also authenticate the connetions. For one platform we have our own CA for the server certificates, the authenticated connections work, for the second platform we want to use the splunk certificates. I didn't see how we can configure the heavy forwarder with two different CAs. Is this even possible? How would I build this?

0 Karma


You would define two different stanzas in inputs.conf on the heavyfwd boxes. Use port xxxx for CA1-signed clients and port yyyy for CA2-signed clients.

0 Karma


Bump. The problem here is that even though you can define several [splunktcp-ssl] stanzas, you can only define one [SSL] stanza, apparently. I also want to define two [SSL] stanzas, for two different server certificates. Also, one of them would require client certificate, and the other would not. Is this possible?

EDIT: Got an answer to my own question here

0 Karma
Get Updates on the Splunk Community!

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...