Security

Clarification of Public CA Certificate from a Certificate Chain/Intermediate

jason_hubbard
Path Finder

I am following the directions in "Community:Splunk2Splunk_SSL_3rdPartyCA" and for the most part it is fairly easy to follow.

I would like, however, to get clarification on the term "myCAPublicCertificate.pem".

Our enterprises' Certificate Authority provides 2 intermediate CA's plus a Root CA. For purposes here I will call them intermediateCA1.pem, intermediateCA2.pem and rootCA.pem; in order of hierarchy.

In the instructions it talks about copying "the" myCAPublicCertificate.pem to our certificate directory, and adding rootCA paths to "the" myCAPublicCertificate.pem in the certificate directory; to what does the "myCAPublicCertificate.pem" refer to?

  1. The rootCA.pem only
  2. intermediateCA1.pem only (since its the first one in hierarchy)
  3. A concatenated Public CA (#cat intermediateCA1.pem intermediateCA2.pem rootCA.pem > myCAPublicCertificate.pem)
1 Solution

dwaddle
SplunkTrust
SplunkTrust

I've not done this with Splunk but based on past experience with how OpenSSL (and other SSL stacks) handle this, all the clients need is the (actual) root cert. It is up to the server to provide the rest of the chain from the server's cert itself and the necessary intermediates. So your myCAPublicCertificate.pem should only have the root cert in it. But, as the doc says, make sure the server cert, intermediates, and root are all in the server's myServerCertificate.pem file.

From that doc:

IMPORTANT : If there is a certificate chain involved, the public certificates that constitute that chain should be listed in the PEM file in decreasing order of hierarchy right after the server private key. The chain should end with the certificate authority public key, sometimes referred to as the root certificate. 

View solution in original post

dwaddle
SplunkTrust
SplunkTrust

I've not done this with Splunk but based on past experience with how OpenSSL (and other SSL stacks) handle this, all the clients need is the (actual) root cert. It is up to the server to provide the rest of the chain from the server's cert itself and the necessary intermediates. So your myCAPublicCertificate.pem should only have the root cert in it. But, as the doc says, make sure the server cert, intermediates, and root are all in the server's myServerCertificate.pem file.

From that doc:

IMPORTANT : If there is a certificate chain involved, the public certificates that constitute that chain should be listed in the PEM file in decreasing order of hierarchy right after the server private key. The chain should end with the certificate authority public key, sometimes referred to as the root certificate. 

jason_hubbard
Path Finder

Awesome, thanks. Verified. I think I had read that so many times that I missed the inference ... over-thinking it.

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...