Security

Securing Splunk HEC with LetsEncrypt

AxelPersinger
Explorer

Hi all! I'm trying to enable SSL for my HEC ingestor on a small, centralized Splunk Enterprise deployment. I used Let'sEncrypt to generate the certificates for the Splunk Web interface, as it's trusted by everyone. I'm tying to configure HEC to use the same certificates, but I'm having no luck in doing so. I tried following all the guides/questions on this board for securing HEC using certs, but I'm not sure which .pem files to use, if I have to encrypt them with an additional password, etc. 

 

Thanks!

Labels (1)
0 Karma
1 Solution

AxelPersinger
Explorer

I got it to work with LetsEncrypt! 

From inside the LetsEncrypt directory (probably something like /etc/letsencrypt/live/<site>/)

openssl pkcs8 -topk8 -inform PEM -outform PEM -in privkey.pem -out privkey.enc.pem # Will prompt for password

cat cert.pem >> hec.pem

cat privkey.enc.pem >> hec.pem

cat chain.pem >> hec.pem

 

Then copy the hec.pem to your desired location, and change the inputs.conf like you said earlier!

View solution in original post

thambisetty
SplunkTrust
SplunkTrust

fantastic, I was checking how you can sign your own CSR in let's encrypt so that you will only have private key.

————————————
If this helps, give a like below.
0 Karma

thambisetty
SplunkTrust
SplunkTrust

fantastic. I was checking on let's encrypt to provide guide on how you can sign your own CSR.

————————————
If this helps, give a like below.
0 Karma

thambisetty
SplunkTrust
SplunkTrust

Splunk web doesn't support CSR which is signed with secret key (secret should be removed from key before creating CSR), you might have signed CSR without secret key. 

where as HEC requires key. to create cert follow below thread: and follow steps used to create server cert:

https://community.splunk.com/t5/Security/Tcp-data-input-and-ssl/m-p/518529#M11769

you should follow below create pem file ( this is also there in the above thread)

server.pem: is combination of below

server_signed_cert.pem
server.key
internmediate.pem (if any)
root.pem

 

inputs.conf for hec:

[http]
enableSSL=1
disabled=0
serverCert = $path/server.pem
sslPassword= passwordwhichisusedwhilecreatingprivatekey
————————————
If this helps, give a like below.

AxelPersinger
Explorer

Hi @thambisetty , this looks like a great reference! My question is if I can create this with the Let'sEncrypt generated certificates, that way my HEC will be trusted by everyone? I don't want to have to also manage certificates if possible.

0 Karma

AxelPersinger
Explorer

I got it to work with LetsEncrypt! 

From inside the LetsEncrypt directory (probably something like /etc/letsencrypt/live/<site>/)

openssl pkcs8 -topk8 -inform PEM -outform PEM -in privkey.pem -out privkey.enc.pem # Will prompt for password

cat cert.pem >> hec.pem

cat privkey.enc.pem >> hec.pem

cat chain.pem >> hec.pem

 

Then copy the hec.pem to your desired location, and change the inputs.conf like you said earlier!

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...