Security

Custom Splunk management port 8089 certificate

splunkreal
Motivator

Hello guys,

tried to update server.conf but Splunk crashed with handshake failure accessing https://localhost:8089

[sslConfig]
#sslPassword = $7$OXZyp5GzoeMoXOIUSMqIFC+4Od7JKUacyjpUPBRobqwXbKYgAoObNg==
serverCert = $SPLUNK_HOME/etc/apps/APP_OUTPUTS/default/preproduction-server.pem
sslPassword = xxx
sslRootCAPath = $SPLUNK_HOME/etc/apps/APP_OUTPUTS/default/preproduction-cacert.pem
requireClientCert = true

Is it necessary to also update web.conf according to https://docs.splunk.com/Documentation/Splunk/7.3.4/Security/Securingyourdeploymentserverandclients?

May it break the deployment server / DS clients?

 

Also does it impact implementation of [tcp-ssl] port?

Thanks.

* If this helps, please upvote or accept solution 🙂 *
Labels (1)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

Hi @splunkreal,

Since Splunk Web is communicating with splunkd running on 8089, you should update web.conf too.

If this server is Deployment server, you should distribute the certificate to clients too.  

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

scelikok
SplunkTrust
SplunkTrust

Hi @splunkreal,

Since Splunk Web is communicating with splunkd running on 8089, you should update web.conf too.

If this server is Deployment server, you should distribute the certificate to clients too.  

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.

splunkreal
Motivator

Thanks it works 🙂

I used requireClientCert  = false as certification is not dedicated to my host otherwise do you mean we should distribute the certificates to deployment clients, this would be time-consuming and out of Splunk scope (deploy certs through Puppet/Ansible for instance)?

* If this helps, please upvote or accept solution 🙂 *
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...