Security

Encryption from Forwarder to Indexer

Stefanie
Builder

We have two sites with two indexers per site. A total of four indexers.

I have to set up certificate-based encryption from all forwarders to Indexers.

What is the easiest way to go about setting up certificates? Can I generate one certificate for ALL forwarders and another certificate for ALL indexers ?

 

Any assistance is appreciated!

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

That is correct.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

PickleRick
SplunkTrust
SplunkTrust

Depends on what you want to achieve. Technically, you could even use the same crypto material for all servers. But that's against any reasonable good security practices.

As a rule of thumb every subject should use its own certificate. This way you have control over authentication and authorization. Especially if we're talking about uf's which might be installed in various environments. If you installed them all with the same cert, compromise of the key from one forwarder would result in necessity to replace certs on all forwarders.

And yes, I know that management of several dozens or hundreds of forwarders with certificates is a huge PITA.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

It's common practice to have a common certificate for all forwarders and individual certificates for each indexer.

---
If this reply helps you, Karma would be appreciated.
0 Karma

Stefanie
Builder

Thank you. How would I generate the common certificate to be used by all forwarders?

I've read this article: https://docs.splunk.com/Documentation/Splunk/8.2.3/Security/Howtogetthird-partycertificates

I assume for the Fowarders I would not enter a common name, correct?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

That is correct.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...