Security

Custom Splunk management port 8089 certificate

splunkreal
Motivator

Hello guys,

tried to update server.conf but Splunk crashed with handshake failure accessing https://localhost:8089

[sslConfig]
#sslPassword = $7$OXZyp5GzoeMoXOIUSMqIFC+4Od7JKUacyjpUPBRobqwXbKYgAoObNg==
serverCert = $SPLUNK_HOME/etc/apps/APP_OUTPUTS/default/preproduction-server.pem
sslPassword = xxx
sslRootCAPath = $SPLUNK_HOME/etc/apps/APP_OUTPUTS/default/preproduction-cacert.pem
requireClientCert = true

Is it necessary to also update web.conf according to https://docs.splunk.com/Documentation/Splunk/7.3.4/Security/Securingyourdeploymentserverandclients?

May it break the deployment server / DS clients?

 

Also does it impact implementation of [tcp-ssl] port?

Thanks.

* If this helps, please upvote or accept solution 🙂 *
Labels (1)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

Hi @splunkreal,

Since Splunk Web is communicating with splunkd running on 8089, you should update web.conf too.

If this server is Deployment server, you should distribute the certificate to clients too.  

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

scelikok
SplunkTrust
SplunkTrust

Hi @splunkreal,

Since Splunk Web is communicating with splunkd running on 8089, you should update web.conf too.

If this server is Deployment server, you should distribute the certificate to clients too.  

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.

splunkreal
Motivator

Thanks it works 🙂

I used requireClientCert  = false as certification is not dedicated to my host otherwise do you mean we should distribute the certificates to deployment clients, this would be time-consuming and out of Splunk scope (deploy certs through Puppet/Ansible for instance)?

* If this helps, please upvote or accept solution 🙂 *
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...