Securing Splunk HEC with LetsEncrypt

[AxelPersinger]

Hi all! I'm trying to enable SSL for my HEC ingestor on a small, centralized Splunk Enterprise deployment. I used Let'sEncrypt to generate the certificates for the Splunk Web interface, as it's trusted by everyone. I'm tying to configure HEC to use the same certificates, but I'm having no luck in doing so. I tried following all the guides/questions on this board for securing HEC using certs, but I'm not sure which .pem files to use, if I have to encrypt them with an additional password, etc. 

Thanks!

[thambisetty]

fantastic, I was checking how you can sign your own CSR in let's encrypt so that you will only have private key.

[thambisetty]

fantastic. I was checking on let's encrypt to provide guide on how you can sign your own CSR.

[thambisetty]

Splunk web doesn't support CSR which is signed with secret key (secret should be removed from key before creating CSR), you might have signed CSR without secret key. 

where as HEC requires key. to create cert follow below thread: and follow steps used to create server cert:

https://community.splunk.com/t5/Security/Tcp-data-input-and-ssl/m-p/518529#M11769

you should follow below create pem file ( this is also there in the above thread)

server.pem: is combination of below

server_signed_cert.pem
server.key
internmediate.pem (if any)
root.pem

inputs.conf for hec:

[http]
enableSSL=1
disabled=0
serverCert = $path/server.pem
sslPassword= passwordwhichisusedwhilecreatingprivatekey

[AxelPersinger]

Hi @thambisetty , this looks like a great reference! My question is if I can create this with the Let'sEncrypt generated certificates, that way my HEC will be trusted by everyone? I don't want to have to also manage certificates if possible.

[AxelPersinger · Accepted solution]

I got it to work with LetsEncrypt! 

From inside the LetsEncrypt directory (probably something like /etc/letsencrypt/live/<site>/)

openssl pkcs8 -topk8 -inform PEM -outform PEM -in privkey.pem -out privkey.enc.pem # Will prompt for password

cat cert.pem >> hec.pem

cat privkey.enc.pem >> hec.pem

cat chain.pem >> hec.pem

Then copy the hec.pem to your desired location, and change the inputs.conf like you said earlier!