Where to put .PEM file after data accepted?

[Marco_Develops]

Right now I have a Syslog Server Sending me security events. The Syslog server is sending the data with TLS encryption. 

I have the PEM file, so that Splunk can do the three way handshake and accept my data.

My question is, where do I put that .PEM file.

Currently my Inputs.conf file looks like this: 

[tcp-ssl:520]
serverCert = $SPLUNK_HOME/etc/auth/mycerts/myCert.pem
sslPassword = PASSWORD

My Server.conf file looks like this: 

[sslConfig]
enableSplunkdSSL = true
sslPassword = $**************************
sslRootCAPath = $SPLUNK_HOME/etc/auth/mycerts/myCert.pem

My certificate is stored in C:\Program Files\Splunk\etc\auth\mycerts


What am I missing? Any help is appreciated

Thank you,

Marco

[PickleRick]

Either your cert is your cert or CA's cert. If you're not authenticating your peer you don't need CA cert anyway.

3-way handshake is in TCP layer. TLS negotiation is a bit more complicated.

Did you restart your splunkd process? Did you check log for errors (for example mistyped filenames or wrong file permissions)? Is splunkd listening on port 520? (Bonus hint - if your process is running with a non-root user it won't bind to low port) Did you try to connect with openssl client?

[Marco_Develops]

Hi @PickleRick, 

Thank you for the clarification on the certs. I believe what I am doing is incorrect so my question is:

If you had to send data from a server via TCP-TLS to Splunk. Where would you start? 

Thank You,

Marco

[PickleRick]

For tcp-ssl input you define a tcp-ssl stanza.

As a minimum, if you have unencrypted cryptographic material, it's enough to do, for example

[tcp-ssl:1514]
serverCert=$SPLUNK_HOME/etc/certs/whatever.pem
index=my_index
sourcetype=my_sourcetype

As I wrote before, remember that if you're running splunk as a normal user (non-root), you won't be able to bind to a low (<1024) port.

After defining such input, do a restart of your forwarder, verify that it's listening on the port and try to connect from remote with openssl s_client.