SSL without Web

[gschmitz]

Hi all,
is there a way to use my own SSL certificates for communication between indexers, forwarders, deployment clients and without enabling SSL on Splunk web?
In the docs, it looks like it's required to use https on the frontend, if you want to use it in the backend:
http://docs.splunk.com/Documentation/Splunk/latest/Security/TypesofSplunkconfigurationsthatcanuseSSL

I'd like to use my own CA for the internal stuff and secondly offload SSL to my load balancer for the web traffic.

Best Regards

[gschmitz]

Hello you too,
that means Splunk Web will use the SSL certificate specified in server.conf as a client certificate when it communicates with search peers on the management port?
Best Regards.

[Simon]

Just ignore step 4 in the documentation. Deploy & configure your CA just for splunkd works perfectly fine.
Btw: When you deploy Splunk out of the box, enableSplunkdSSL is already set to true, means inter-splunkd communication (port 8089).
Note: To enable forwarding encrypted data, don't forget to adjust inputs.conf:

# configure SSL settings
[SSL]
serverCert=$SPLUNK_HOME/etc/auth/server.pem
password=password
rootCA=$SPLUNK_HOME/etc/auth/cacert.pem
requireClientCert=false

# Enable SSL splunk tcp input
[splunktcp-ssl:<port>]

[bmacias84]

Yes, you can. I currently do the exact same thing. I could provide my approach in detail, if you'd like? But the document you linked to is what I followed.