Splunk Certificates renewal

Path Finder

Hi Team,

We have distributed environment with Search Heads and Indexers clustered and running on 6.5.2 version. We are using self signed SSL certificates for the communication between the servers and web.

Few of my web connection certificates are expiring. So, I thought of renewing the certificates. Now, my question is, if I renew only web certificates or server to server certificates, will there be any impact on other connections?

As I don't have any knowledge on SSL certificates (challenging it for the first time), I want to make sure, I am not breaking anything.

Thanks in advance.

0 Karma

Splunk Employee
Splunk Employee

Hey Siva,

You can run the btool command to identify the locations of the SSL certificates (for both splunkweb & encryption between forwarders & indexers) and replace them with the new ones.

$ splunk btool web list --debug
$ splunk btool server list --debug

You need to find the path of the certificates from the above command's output and replace them with the new certificates. You need to generate new Selft-signed certificates by following the below splunk doc.

For SplunkWeb:
For Data encryption:

Hope the above helps!


0 Karma

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...