Security

Replacing third party server certificate while Splunk is running: do we need to restart Splunk?

SplunkTrust
SplunkTrust

We use a third party SSL certificate on our heavy forwarders.

  1. I create my server cert by combining cert + keys + cacert > servercert.pem
  2. I start up Splunk
  3. Time goes by and my certificate is going to expire soon. I get a new cert
  4. I cat together new cert + keys + cacert > servercert.pem and put it in the same file as referenced by Splunk configs

Question: Do i need to restart Splunk?

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Hi @burwell,

Yes you need to restart splunk to take effect of new certificates.

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

Hi @burwell,

Yes you need to restart splunk to take effect of new certificates.

View solution in original post

0 Karma