Security

Deployment server https - no client certificate

lux209
Explorer

Hello,

I'm looking to secure the connection to our deployment server using HTTPS following this doc:
https://docs.splunk.com/Documentation/Splunk/9.4.2/Security/Securingyourdeploymentserverandclients

I'm wondering if having client certificate is mandatory or if it would be possible to only install a certificate on the DS server itself ? I don't need the to have mTLS, my goal is only to have an encrypted connection between the server and the clients.

Thanks for you help
Lucas

Labels (1)
0 Karma
1 Solution

livehybrid
SplunkTrust
SplunkTrust

Hi @lux209 

It is not required to use mTLS if you do not want to (I dont usually have mTLS on client->DS comms as for using SSL is enough for me).  

Set in the server.conf set [sslConfig]/requireClientCert stanza to false (which I think is the default).

For me the reason you might want to use clientCert on a DS is if you wanted to ensure that no other hosts could connect to your DS and receive its configuration, which may contain sensitive credentials/configurations (e.g. certs to send to your indexers). If this is low risk for you (e.g. not publicly accessible) then it sounds like having requireClientCert to false would suffice.

🌟 Did this answer help you? If so, please consider:

  • Adding karma to show it was useful
  • Marking it as the solution if it resolved your issue
  • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

View solution in original post

livehybrid
SplunkTrust
SplunkTrust

Hi @lux209 

It is not required to use mTLS if you do not want to (I dont usually have mTLS on client->DS comms as for using SSL is enough for me).  

Set in the server.conf set [sslConfig]/requireClientCert stanza to false (which I think is the default).

For me the reason you might want to use clientCert on a DS is if you wanted to ensure that no other hosts could connect to your DS and receive its configuration, which may contain sensitive credentials/configurations (e.g. certs to send to your indexers). If this is low risk for you (e.g. not publicly accessible) then it sounds like having requireClientCert to false would suffice.

🌟 Did this answer help you? If so, please consider:

  • Adding karma to show it was useful
  • Marking it as the solution if it resolved your issue
  • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

lux209
Explorer

Great thank you for the quick answer and the information !

Lucas

0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...