Security

How do I renew an expired Splunk Certificate?

khusain_splunk
Splunk Employee
Splunk Employee

We have a distributed Splunk environment and the certificate for Splunk API in port tcp/8089 on the search head has expired.

How do I renew the Splunk Certificates?

0 Karma
1 Solution

khusain_splunk
Splunk Employee
Splunk Employee

First check if really Certs expired:

Windows:

C:\Program Files\splunk\bin> openssl x509 -enddate -noout -in "C:\Program Files\splunk\etc\auth\server.pem

Linux:
openssl x509 -enddate -noout -in /opt/splunk/etc/auth/server.pem

If it has been expired then rename /opt/splunk/etc/auth/server.pem to server.pem.back and restart splunkd.

./splunk restart

This will regenerate the server.pem file and renewed the certs.

View solution in original post

swellerrific
Explorer

Howdy! Quick follow-up on this. My apologies, still learning here. This is the first expiration since we stood up our environment.

In a distributed environment, do I do this on all my Splunk instances individually or can I do this on the deployment server and it pushes it out? 

Thank you in advance! 🙂 

0 Karma

harsmarvania57
Ultra Champion
0 Karma

khusain_splunk
Splunk Employee
Splunk Employee

First check if really Certs expired:

Windows:

C:\Program Files\splunk\bin> openssl x509 -enddate -noout -in "C:\Program Files\splunk\etc\auth\server.pem

Linux:
openssl x509 -enddate -noout -in /opt/splunk/etc/auth/server.pem

If it has been expired then rename /opt/splunk/etc/auth/server.pem to server.pem.back and restart splunkd.

./splunk restart

This will regenerate the server.pem file and renewed the certs.

yannK
Splunk Employee
Splunk Employee

If your splunk server.pem expired, then your mongo/kvstore cert copy probably expired too.

 

Check in $SPLUNK_HOME/var/lib/splunk/kvstore/mongo/splunk.key
if needed, you can move it aside, and restart splunk. A new one will be created based on the splunkd one.

 

see https://answers.splunk.com/answers/699766/can-you-help-me-with-the-following-mongod-kvstore.html

0 Karma

splunkreal
Motivator

This should be documented 🙂

* If this helps, please upvote or accept solution if it solved *
0 Karma

Faarooq
Loves-to-Learn

Does anyone know if there are any options to obtain certs for more than one year? 

0 Karma

splunkreal
Motivator

This generates for 3 years normally.

* If this helps, please upvote or accept solution if it solved *
0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...