Replacing third party server certificate while Splunk is running: do we need to restart Splunk?

[burwell]

We use a third party SSL certificate on our heavy forwarders.

1. I create my server cert by combining cert + keys + cacert > servercert.pem
2. I start up Splunk
3. Time goes by and my certificate is going to expire soon. I get a new cert
4. I cat together new cert + keys + cacert > servercert.pem and put it in the same file as referenced by Splunk configs

Question: Do i need to restart Splunk?

[harsmarvania57 · Accepted solution]

Hi @burwell,

Yes you need to restart splunk to take effect of new certificates.