Custom Splunk management port 8089 certificate

[splunkreal]

Hello guys,

tried to update server.conf but Splunk crashed with handshake failure accessing https://localhost:8089

[sslConfig]
#sslPassword = $7$OXZyp5GzoeMoXOIUSMqIFC+4Od7JKUacyjpUPBRobqwXbKYgAoObNg==
serverCert = $SPLUNK_HOME/etc/apps/APP_OUTPUTS/default/preproduction-server.pem
sslPassword = xxx
sslRootCAPath = $SPLUNK_HOME/etc/apps/APP_OUTPUTS/default/preproduction-cacert.pem
requireClientCert = true

Is it necessary to also update web.conf according to https://docs.splunk.com/Documentation/Splunk/7.3.4/Security/Securingyourdeploymentserverandclients?

May it break the deployment server / DS clients?

Also does it impact implementation of [tcp-ssl] port?

Thanks.

[scelikok · Accepted solution]

Hi @splunkreal,

Since Splunk Web is communicating with splunkd running on 8089, you should update web.conf too.

If this server is Deployment server, you should distribute the certificate to clients too.  

[splunkreal]

Thanks it works 🙂

I used requireClientCert  = false as certification is not dedicated to my host otherwise do you mean we should distribute the certificates to deployment clients, this would be time-consuming and out of Splunk scope (deploy certs through Puppet/Ansible for instance)?