Security

Encryption from Forwarder to Indexer

Stefanie
Builder

We have two sites with two indexers per site. A total of four indexers.

I have to set up certificate-based encryption from all forwarders to Indexers.

What is the easiest way to go about setting up certificates? Can I generate one certificate for ALL forwarders and another certificate for ALL indexers ?

 

Any assistance is appreciated!

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

That is correct.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

PickleRick
SplunkTrust
SplunkTrust

Depends on what you want to achieve. Technically, you could even use the same crypto material for all servers. But that's against any reasonable good security practices.

As a rule of thumb every subject should use its own certificate. This way you have control over authentication and authorization. Especially if we're talking about uf's which might be installed in various environments. If you installed them all with the same cert, compromise of the key from one forwarder would result in necessity to replace certs on all forwarders.

And yes, I know that management of several dozens or hundreds of forwarders with certificates is a huge PITA.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

It's common practice to have a common certificate for all forwarders and individual certificates for each indexer.

---
If this reply helps you, Karma would be appreciated.
0 Karma

Stefanie
Builder

Thank you. How would I generate the common certificate to be used by all forwarders?

I've read this article: https://docs.splunk.com/Documentation/Splunk/8.2.3/Security/Howtogetthird-partycertificates

I assume for the Fowarders I would not enter a common name, correct?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

That is correct.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...