Indexers and HF to License Master SSL Enablement

[VK18]

Hi Team,
At present, SSL encryption is enabled between the Universal Forwarder (UF) and the Heavy Forwarder (HF), while communication from HF to Indexers occurs without SSL encryption. However, there are plans to establish an SSL channel between the HF and Indexers in the future.

Additionally, communication between Indexers and the License Master, as well as between HF and the License Master, currently operates through non-SSL channels. There is a requirement to transition these communications to SSL-enabled connections.

Could you provide guidance or documentation outlining the necessary implementation steps for securing the communication from Indexers & HF to License Master to facilitate these changes?

[PickleRick]

How old is your deployment? Because the "internal" Splunk communication on 8089 and KVstore on 8191 has been TLS-enabled for a long time now by default. It's just that if you've not configured it with your own certs, it's using the default Splunk certs (which is not the best idea). But the TLS as such is enabled.

With inputs/outputs it's a different story - you have to explicitly enable splunktcp-ssl inputs and outputs.

And keep in mind that you can't have both TLS and non-TLS inputs if you're using indexer discovery.

[inventsekar]

Hi @VK18 .. for HF to indexer (for LM also the method is similar i think).. pls check this:

https://docs.splunk.com/Documentation/Splunk/9.1.1/Security/ConfigureSplunkforwardingtousesignedcert...