Security

'Configure Splunk forwarding to use your own certificates' possible documentation error

jorcabro
Explorer

Hi,

I'm trying to configure Splunk forwarders and indexers to use our own certificates and while checking the documentation (https://docs.splunk.com/Documentation/Splunk/7.2.6/Security/ConfigureSplunkforwardingtousesignedcert...) I've seen the following:

**Configure your forwarders to use your certificates**
...
[tcpout:group1]

server=10.1.1.197:9997

disabled = 0

clientCert = <path> The full path to the client SSL certificate in PEM format. If this value is provided, the connection will use SSL.

useClientSSLCompression = <true> Disabling tls compression can cause bandwidth issues.

**sslPassword = The password for the CAcert**

I don't understand how can the CAcert password needed as this is a private password.
Is this correct? Is the documentation okay? Could someone explain the reason for this?

Thanks.

1 Solution

jorcabro
Explorer

The documentation has been updated and the error has been fixed.

[tcpout:group1]

server=10.1.1.197:9997

disabled = 0

clientCert = <The full path to the client SSL certificate, in PEM format. If this value is provided, the connection will use SSL.>

useClientSSLCompression = true (Disabling TLS compression can cause bandwidth issues.)

sslPassword = <password for the client certificate>

View solution in original post

0 Karma

jorcabro
Explorer

The documentation has been updated and the error has been fixed.

[tcpout:group1]

server=10.1.1.197:9997

disabled = 0

clientCert = <The full path to the client SSL certificate, in PEM format. If this value is provided, the connection will use SSL.>

useClientSSLCompression = true (Disabling TLS compression can cause bandwidth issues.)

sslPassword = <password for the client certificate>
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Passwords keep private certificates private.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...