is there a way to use my own SSL certificates for communication between indexers, forwarders, deployment clients and without enabling SSL on Splunk web?
In the docs, it looks like it's required to use https on the frontend, if you want to use it in the backend:
I'd like to use my own CA for the internal stuff and secondly offload SSL to my load balancer for the web traffic.
Just ignore step 4 in the documentation. Deploy & configure your CA just for splunkd works perfectly fine.
Btw: When you deploy Splunk out of the box, enableSplunkdSSL is already set to true, means inter-splunkd communication (port 8089).
Note: To enable forwarding encrypted data, don't forget to adjust inputs.conf:
# configure SSL settings [SSL] serverCert=$SPLUNK_HOME/etc/auth/server.pem password=password rootCA=$SPLUNK_HOME/etc/auth/cacert.pem requireClientCert=false # Enable SSL splunk tcp input [splunktcp-ssl:<port>]
Hello you too,
that means Splunk Web will use the SSL certificate specified in server.conf as a client certificate when it communicates with search peers on the management port?