Qualys reporting vulnerabilities on splunk port 8090

[wongea]

Hello,

Qualys scans in our environment reporting issues on SSL and TLSv1.0, TLSv1.1.

We are able to fix the TLS ones, not sure how to fix the below SSL ones.

Please let me know if any one has any ideas.

SSL/TLS Compression Algorithm Information Leakage Vulnerability
Birthday attacks against TLS ciphers with 64bit block size vulnerability (Sweet32)
SSL Certificate - Expired
SSL Certificate - Self-Signed Certificate
SSL Certificate - Subject Common Name Does Not Match Server FQDN
SSL Certificate - Signature Verification Failed Vulnerability

Thank you.

[splunkyj]

Go to: etc/system/local/server.conf

[sslConfig]

serverCert = $SPLUNK_HOME/etc/auth/server.pem

If you are seeing server.pem, or this entry is missing (which means you are using default) what that error means is that you are using a self signed certificate, which is a vulnerability. You will need to purchase third party SSL certificates and implement it to your system. 

There's more information here:

https://docs.splunk.com/Documentation/Splunk/8.0.5/Security/Howtogetthird-partycertificates