Splunk Certificates renewal

[siva_cg]

Hi Team,

We have distributed environment with Search Heads and Indexers clustered and running on 6.5.2 version. We are using self signed SSL certificates for the communication between the servers and web.

Few of my web connection certificates are expiring. So, I thought of renewing the certificates. Now, my question is, if I renew only web certificates or server to server certificates, will there be any impact on other connections?

As I don't have any knowledge on SSL certificates (challenging it for the first time), I want to make sure, I am not breaking anything.

Thanks in advance.

[mbadhusha_splun]

Hey Siva,

You can run the btool command to identify the locations of the SSL certificates (for both splunkweb & encryption between forwarders & indexers) and replace them with the new ones.

$ splunk btool web list --debug
$ splunk btool server list --debug

You need to find the path of the certificates from the above command's output and replace them with the new certificates. You need to generate new Selft-signed certificates by following the below splunk doc.

For SplunkWeb: https://docs.splunk.com/Documentation/Splunk/6.5.2/Security/Self-signcertificatesforSplunkWeb
For Data encryption: https://docs.splunk.com/Documentation/Splunk/6.5.2/Security/ConfigureSplunkforwardingtousesignedcert...

Hope the above helps!

Cheers.

[p_gurav]

This link might help you:
http://wiki.splunk.com/Community:SplunkWeb_SSL_3rdPartyCA