SSL Certificate questions (wildcard, Web, Search Head)

[tawollen]

Before I go and purchase certificates I wanted to ask a quick question about SSL certificates, in particular wildcard certificates.

We have a couple search heads, a few more indexers and lots of forwarders and want to start encrypting data for both forwarders to indexers, from the search heads to indexers and for users (splunk web).

We don't want to use the splunk certificates since these have a known password.

I tried using self signed certificates, but when I installed a self signed certificate for the lab forwarder to talk to the lab indexer/search head the lab indexer/search head couldn't connect to any of the other production indexers.

In order to not have the browser SSL error we are planning on going to a real SSL cert, at least for the search heads. The questions are:

1. Can we use a purchased cert for the search heads (splunk web), but self signed for the communication between indexers, forwarders, and search heads.
2. Can we use a single wildcard certificate on all the servers for all SSL communication (I am thinking the answer to this is no, but wanted to check anyway)

[gkanapathy · Accepted solution]

1. Yes you can. If using a self-signed certificate, it is insufficient to just install and configure the server certificate on the server. You must also install and configure the public key of CA who signed the server certificate on each client that is to connect to that server.
2. I am not certain, but I believe that you can. The communications between forwarders and indexers can be configured not to check hostnames anyway, so whether the certificate is wildcarded or not may not matter. Simple possession of a certificate signed by the configured CA may be sufficient.