Security

Impact of certificate expiry

Path Finder

Hi all,

We have checked the Splunk certificate on the below 2 locations:
1.$splunkHome/etc/auth/server.pem
2.$splunk
Home/etc/auth/spunkweb/cert.pem

All the certs are showing enddate this month.

This I saw in all my Indexers,SH,CM,LS,Deployer,DM. Can you please help me to understand the impact due to this?

What is the process I have to follow to renew the cert?

0 Karma

Path Finder

We went through the above scenario, there is no such impact in Splunk processing. It will generate soft waring i.e.-SSL certificates expired on XXX server.
if we check the logs (metrics.logs or mongod.logs we can see the message).

cheers

0 Karma

Path Finder

We experienced the same results with half of our internal splunk certs expired. That is, all processes keep running, there were no TCP errors in logs, just that one log message Server certificate is now invalid. It expired on Sat xxxx. Traffic also still looks encrypted.

0 Karma

Ultra Champion

Certificate expiry is a 'soft fail' in Splunk.

What this means is that expired or invalid certificates generally will not cause your deployment to fail.
You can form your own opinion if this is a good or a bad thing.

However, your question suggests that you are using the default Splunk certificates, and you should be aware that since these are common across many thousands of deployments, the private keys for these certs are widely shared, and should not be considered to provide any element of 'privacy' in your Splunk communications.

Good practice dictates that you should issue&manage your own certificates (internal or commercial) and keep them valid - meaning correct hostnames, valid CA issue chains, and within expiry.

See this excellent slide deck from .conf 15 for a step by step process to manage your own certs
https://conf.splunk.com/session/2015/conf2015_DWaddle_DefensePointSecurity_deploying_SplunkSSLBestPr...