Accepted client certificate list for SSL authentication

[rjszuste]

I'm trying to setup SSL to encrypt and authenticate communication between forwarders and indexers.
I haven't started yet, I'm going thru the documentation and preparing the certificates, everything seems to be straight forward, but there is one thing i could not figure out yet.

Is there a way to define a "whitelist" or list of accepted client certificates to be allowed to communicate to the Indexer ??

I see there are checks on the Forwarder to validate information is being pushed to the right Indexer, but i need to ensure validation on the other direction.
Thanks

[Rob]

I am not sure exactly what you are looking to do. But no, a "whitelist" of Client certificates can not be defined. This is fine because the way that SSL works is:

1. Client request the server public cert
2. Server sends its public cert
3. Client sends its public cert and an initial public key which is created from the server public cert
4. Client sends signature from private key
5. Server verifies that the signature matches against the clients public cert
6. Master key for encryption is generated for client and server that both can decrypt
7. Connection is established

This is a very simplified explanation of what happens but it serves to show that a single key for intra-splunk communications is all that is needed for the same type of connection rather than a list of acceptable client certificates that you may want for a secure web page that can be accessed in a variety of ways by a variety of programs

As to the second part of your question, what is the validation that you need from the indexer to the forwarder? If it is for the connection then the TCP protocol that is used handles that. If it is for data that is pushed to the forwarder then these would only be in the form of apps or configurations and not index data that would be sent and can be monitored and verified via the Deployment Monitor.

[rjszuste]

Is there no way to authenticate the Forwarders pushing logs ? Does the Indexer accept pushes from anyone ?
I was hoping the Indexer could accept or reject a client certificate based on the certificate subject, for example.