SSL expired, now what?

[ben_leung]

I have an indexer and forwarder. They have been configured with self sign cert ssl. Lets say the server cert has expired, okay now you just create another cert.

What do you do when the root cert has expired, what will happen? Do you have to configure a new set of certs?

The default certs expire 3 years, so does the rootCA and server certs also expire in 3 years?

Is the root cert suppose to expire at a different time than the server cert?

[gkanapathy · Accepted solution]

Yes, when the root cert has expired, you will need a new cert chain. I believe that root CAs can't issue certificates beyond their own validity. The root cert can last longer than the child certs.

[gkanapathy]

You can generate new certs using the scripts in the $SPLUNK_HOME/bin/ directory.