Splunk Certificates renewal

Path Finder

Hi Team,

We have distributed environment with Search Heads and Indexers clustered and running on 6.5.2 version. We are using self signed SSL certificates for the communication between the servers and web.

Few of my web connection certificates are expiring. So, I thought of renewing the certificates. Now, my question is, if I renew only web certificates or server to server certificates, will there be any impact on other connections?

As I don't have any knowledge on SSL certificates (challenging it for the first time), I want to make sure, I am not breaking anything.

Thanks in advance.

0 Karma

Splunk Employee
Splunk Employee

Hey Siva,

You can run the btool command to identify the locations of the SSL certificates (for both splunkweb & encryption between forwarders & indexers) and replace them with the new ones.

$ splunk btool web list --debug
$ splunk btool server list --debug

You need to find the path of the certificates from the above command's output and replace them with the new certificates. You need to generate new Selft-signed certificates by following the below splunk doc.

For SplunkWeb:
For Data encryption:

Hope the above helps!


0 Karma

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!


Or Learn More in Our Blog >>