Indexers and HF to License Master SSL Enablement


Hi Team,
At present, SSL encryption is enabled between the Universal Forwarder (UF) and the Heavy Forwarder (HF), while communication from HF to Indexers occurs without SSL encryption. However, there are plans to establish an SSL channel between the HF and Indexers in the future.

Additionally, communication between Indexers and the License Master, as well as between HF and the License Master, currently operates through non-SSL channels. There is a requirement to transition these communications to SSL-enabled connections.

Could you provide guidance or documentation outlining the necessary implementation steps for securing the communication from Indexers & HF to License Master to facilitate these changes?

Labels (1)
0 Karma


How old is your deployment? Because the "internal" Splunk communication on 8089 and KVstore on 8191 has been TLS-enabled for a long time now by default. It's just that if you've not configured it with your own certs, it's using the default Splunk certs (which is not the best idea). But the TLS as such is enabled.

With inputs/outputs it's a different story - you have to explicitly enable splunktcp-ssl inputs and outputs.

And keep in mind that you can't have both TLS and non-TLS inputs if you're using indexer discovery.

0 Karma


Hi @VK18 .. for HF to indexer (for LM also the method is similar i think).. pls check this:


0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...