Security

'Configure Splunk forwarding to use your own certificates' possible documentation error

jorcabro
Explorer

Hi,

I'm trying to configure Splunk forwarders and indexers to use our own certificates and while checking the documentation (https://docs.splunk.com/Documentation/Splunk/7.2.6/Security/ConfigureSplunkforwardingtousesignedcert...) I've seen the following:

**Configure your forwarders to use your certificates**
...
[tcpout:group1]

server=10.1.1.197:9997

disabled = 0

clientCert = <path> The full path to the client SSL certificate in PEM format. If this value is provided, the connection will use SSL.

useClientSSLCompression = <true> Disabling tls compression can cause bandwidth issues.

**sslPassword = The password for the CAcert**

I don't understand how can the CAcert password needed as this is a private password.
Is this correct? Is the documentation okay? Could someone explain the reason for this?

Thanks.

1 Solution

jorcabro
Explorer

The documentation has been updated and the error has been fixed.

[tcpout:group1]

server=10.1.1.197:9997

disabled = 0

clientCert = <The full path to the client SSL certificate, in PEM format. If this value is provided, the connection will use SSL.>

useClientSSLCompression = true (Disabling TLS compression can cause bandwidth issues.)

sslPassword = <password for the client certificate>

View solution in original post

0 Karma

jorcabro
Explorer

The documentation has been updated and the error has been fixed.

[tcpout:group1]

server=10.1.1.197:9997

disabled = 0

clientCert = <The full path to the client SSL certificate, in PEM format. If this value is provided, the connection will use SSL.>

useClientSSLCompression = true (Disabling TLS compression can cause bandwidth issues.)

sslPassword = <password for the client certificate>
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Passwords keep private certificates private.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...