Security

Replacing third party server certificate while Splunk is running: do we need to restart Splunk?

burwell
SplunkTrust
SplunkTrust

We use a third party SSL certificate on our heavy forwarders.

  1. I create my server cert by combining cert + keys + cacert > servercert.pem
  2. I start up Splunk
  3. Time goes by and my certificate is going to expire soon. I get a new cert
  4. I cat together new cert + keys + cacert > servercert.pem and put it in the same file as referenced by Splunk configs

Question: Do i need to restart Splunk?

0 Karma
1 Solution

harsmarvania57
SplunkTrust
SplunkTrust

Hi @burwell,

Yes you need to restart splunk to take effect of new certificates.

View solution in original post

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

Hi @burwell,

Yes you need to restart splunk to take effect of new certificates.

View solution in original post

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!