Security
Highlighted

How to search used SSL certificates in the Splunk cluster?

Builder

Hello, I'm using this ssh command on the management server but it only lists the certificates, does Splunk includes a functionality to list SSL certificates used for search heads/indexers/forwarders and their expiration date?

find etc -name '.pem' -type f -print -exec openssl x509 -in {} -noout -text \;*

Thanks.

0 Karma
Highlighted

Re: How to search used SSL certificates in the Splunk cluster?

SplunkTrust
SplunkTrust

I developed the ssl certificate checker app that lets you specify the ssl certificate paths and then it will ingest their name and expiration date as per the schedule you define.

You need to know the paths, but now maybe I could write some code that finds the Splunk certs automagically...

It doesnt support forwarders unless they are heavy forwarders because it uses Python.

https://splunkbase.splunk.com/app/3172/

0 Karma
Highlighted

Re: How to search used SSL certificates in the Splunk cluster?

Builder

Yes, that would be great because I have to open conf files then check manually.

Thanks.

0 Karma