Security
Highlighted

SSL without Web

Path Finder

Hi all,
is there a way to use my own SSL certificates for communication between indexers, forwarders, deployment clients and without enabling SSL on Splunk web?
In the docs, it looks like it's required to use https on the frontend, if you want to use it in the backend:
http://docs.splunk.com/Documentation/Splunk/latest/Security/TypesofSplunkconfigurationsthatcanuseSSL

I'd like to use my own CA for the internal stuff and secondly offload SSL to my load balancer for the web traffic.

Best Regards

0 Karma
Highlighted

Re: SSL without Web

Champion

Yes, you can. I currently do the exact same thing. I could provide my approach in detail, if you'd like? But the document you linked to is what I followed.

0 Karma
Highlighted

Re: SSL without Web

Contributor

Just ignore step 4 in the documentation. Deploy & configure your CA just for splunkd works perfectly fine.
Btw: When you deploy Splunk out of the box, enableSplunkdSSL is already set to true, means inter-splunkd communication (port 8089).
Note: To enable forwarding encrypted data, don't forget to adjust inputs.conf:

# configure SSL settings
[SSL]
serverCert=$SPLUNK_HOME/etc/auth/server.pem
password=password
rootCA=$SPLUNK_HOME/etc/auth/cacert.pem
requireClientCert=false

# Enable SSL splunk tcp input
[splunktcp-ssl:<port>]
0 Karma
Highlighted

Re: SSL without Web

Path Finder

Hello you too,
that means Splunk Web will use the SSL certificate specified in server.conf as a client certificate when it communicates with search peers on the management port?
Best Regards.

0 Karma