How to install an SSL key from a trusted certificate authority?

[timmy13]

The docs clearly show how to install a self-generated ssl key, but we have a cert from a TCA. I can't seem to find docs on how to install this.

Thanks in advance

[jworthington_sp]

Dwaddle's talk is amazing, I recommend it highly.

We also have a topic here that talks about using signed certificates in your indexer to forwarder configuration:

http://docs.splunk.com/Documentation/Splunk/6.4.3/Security/ConfigureSplunkforwardingtousesignedcerti...

Hope that helps!
jen

[dwaddle · Accepted solution]

Have you seen our talk on the subject of SSL?

http://conf.splunk.com/session/2015/recordings/2015-splunk-115.mp4
http://conf.splunk.com/session/2015/conf2015_DWaddle_DefensePointSecurity_deploying_SplunkSSLBestPra...

It might help point you in the right direction?

[esalesap]

Links to the talk return:

<Error>

<Code>AccessDenied</Code>

<Message>Access Denied</Message>

<RequestId>7BEZWWY1K8WA511V</RequestId>

<HostId>bsDp/rRmE1/64CmaduU6ebmvWdDJNvkw/bnJUnDSNYE26AE+HFQUYMcng/bVXyfeD/dL5kmgkZ8=</HostId>

</Error>

How about a paragraph describing what to do?

[timmy13]

Hi and thanks for the replies. DWaddle, I've followed your directions from the slide deck, and all went well, but when trying to start splunk, it sets at "Waiting for web server at https://127.0.0.1:8000 to be available.." and never goes anywhere. Don't see anything in the logs but not sure I'm looking in the right place.

[dwaddle]

There's a number of places where a misconfiguration could cause that kind of hang. Usually I would start with encrypted passwords in etc/system/local/*.conf that are wrong. The logs can be fairly hard to pull this kind of thing out of just because of the verbosity of everything during startup.

This will get painful if we try to comment back and forth here to debug - any chance you are on the Splunk IRC channel and/or slack chat? We might be able to work through this more interactively there.

[gregbo]

When updating the web.conf file, what port did you specify for SSL?

[timmy13]

Tried 8443 and 8000