Security

Is it possible to setup HEC to use multiple/unique ports and ssl certificates for multiple/unique senders?

Glasses
Builder

Hi
When I create a new input for HTTP Event Collector via the WebUI

Under /opt/splunk/etc/apps/search/local inputs.conf
I see the input stanza:

[http://test_recieve_http_post]
disabled = 0
index = main
indexes = main
sourcetype = test_http_post
token = blah-blah-blah-blah-blah

in /opt/splunk/etc/apps/splunk_httpinput/local

[http]
index = main
port = 6666
sourcetype = test_http_post
disabled = 0
enableSSL = 1
sslPassword = <some_password>
privKeyPath = /opt/splunk/etc/auth/my_certs/hec.key
serverCert = /opt/splunk/etc/auth/my_certs/hec.pem

From the WebUI it appears that you cannot give the HEC multiple ports, as there is only one inputbox for port... but I would like to have multiple ports with there own ssl certs.... like 6666 hec.key, hec.pem, and 6667 hec2.key, hec2, pem.... so that I can provide separate ports and ssl certs to each sender...

Is there a way to override this?

Thank you.

0 Karma
1 Solution

harsmarvania57
Ultra Champion

Hi,

You can't configure HEC to listen on multiple port with different SSL certificate. If you want to achieve this then you can configure Load Balancer to receive traffic on different port with different SSL certificate then offload SSL traffic on LB & on upstream send traffic to single HEC port.

View solution in original post

harsmarvania57
Ultra Champion

Hi,

You can't configure HEC to listen on multiple port with different SSL certificate. If you want to achieve this then you can configure Load Balancer to receive traffic on different port with different SSL certificate then offload SSL traffic on LB & on upstream send traffic to single HEC port.

starcher
Influencer

And why would you? The senders don't need client certs. Just to trust the root CA of the cert the HEC is using.

0 Karma

Glasses
Builder

IDK someone with a "good idea" wanted me too... thank you for the comment, I agree with you.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...