Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Admin Other
- :
- Security
- :
- Splunk FIPS 140-2 with SSL tls1.2 certificates
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello!
Does Splunk support running FIPS while using SSL tls1.2 certificates? I read this article and think this might be the reason why I can not get those two working together. https://docs.splunk.com/Documentation/AddOns/released/Overview/Add-onsandFIPsmode
I have tried to enable the [SSL] and [splunktcp-ssl:9998] stanzas in Splunk while running Splunk in FIPS and the port 9998 doesn't show up in netstat. While running the same configurations on a non FIPS instance works without any issue. I can get the Splunk FIPS version to listen on a port as long as I am not using the two stanzas [SSL] and [splunktcp-ssl:9998] and instead using the default stanza [splunktcp://9997].
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The splunkd.log was showing invalid password or certificate not found. The same settings were used on a Splunk instance without FIPS with the same settings and was working. To fix the issue though I created now SSL certs, but still was not able to identify the root cause. I used the following steps in the splunk documentation to create new SSL certs to get this working in FIPS mode.
Step1: http://docs.splunk.com/Documentation/Splunk/6.0/Security/Howtoself-signcertificates
Step2: http://docs.splunk.com/Documentation/Splunk/6.0/Security/HowtoprepareyoursignedcertificatesforSplunk
Step3: http://docs.splunk.com/Documentation/Splunk/6.0/Security/ConfigureSplunkforwardingtousesignedcertifi...
Step4: http://docs.splunk.com/Documentation/Splunk/6.0/Security/Validateyourconfiguration
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The splunkd.log was showing invalid password or certificate not found. The same settings were used on a Splunk instance without FIPS with the same settings and was working. To fix the issue though I created now SSL certs, but still was not able to identify the root cause. I used the following steps in the splunk documentation to create new SSL certs to get this working in FIPS mode.
Step1: http://docs.splunk.com/Documentation/Splunk/6.0/Security/Howtoself-signcertificates
Step2: http://docs.splunk.com/Documentation/Splunk/6.0/Security/HowtoprepareyoursignedcertificatesforSplunk
Step3: http://docs.splunk.com/Documentation/Splunk/6.0/Security/ConfigureSplunkforwardingtousesignedcertifi...
Step4: http://docs.splunk.com/Documentation/Splunk/6.0/Security/Validateyourconfiguration
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Design, Compete, Win: Submit Your Best Splunk Dashboards for a .conf26 Pass
May 2026 Splunk Expert Sessions: Security & Observability
Network to App: Observability Unlocked [May & June Series]
