Impact of certificate expiry

[rohitvjoshi]

Hi all,

We have checked the Splunk certificate on the below 2 locations:
1.$splunk_Home/etc/auth/server.pem
2.$splunk_Home/etc/auth/spunkweb/cert.pem

All the certs are showing enddate this month.

This I saw in all my Indexers,SH,CM,LS,Deployer,DM. Can you please help me to understand the impact due to this?

What is the process I have to follow to renew the cert?

[rohitvjoshi]

We went through the above scenario, there is no such impact in Splunk processing. It will generate soft waring i.e.-SSL certificates expired on XXX server.
if we check the logs (metrics.logs or mongod.logs we can see the message).

cheers

[kmarciniak]

We experienced the same results with half of our internal splunk certs expired. That is, all processes keep running, there were no TCP errors in logs, just that one log message Server certificate is now invalid. It expired on Sat xxxx. Traffic also still looks encrypted.

[nickhills]

Certificate expiry is a 'soft fail' in Splunk.

What this means is that expired or invalid certificates generally will not cause your deployment to fail.
You can form your own opinion if this is a good or a bad thing.

However, your question suggests that you are using the default Splunk certificates, and you should be aware that since these are common across many thousands of deployments, the private keys for these certs are widely shared, and should not be considered to provide any element of 'privacy' in your Splunk communications.

Good practice dictates that you should issue&manage your own certificates (internal or commercial) and keep them valid - meaning correct hostnames, valid CA issue chains, and within expiry.

See this excellent slide deck from .conf 15 for a step by step process to manage your own certs
https://conf.splunk.com/session/2015/conf2015_DWaddle_DefensePointSecurity_deploying_SplunkSSLBestPr...