Security

Splunk FIPS 140-2 with SSL tls1.2 certificates

matthewssa
Path Finder

Hello!

Does Splunk support running FIPS while using SSL tls1.2 certificates? I read this article and think this might be the reason why I can not get those two working together. https://docs.splunk.com/Documentation/AddOns/released/Overview/Add-onsandFIPsmode

I have tried to enable the [SSL] and [splunktcp-ssl:9998] stanzas in Splunk while running Splunk in FIPS and the port 9998 doesn't show up in netstat. While running the same configurations on a non FIPS instance works without any issue. I can get the Splunk FIPS version to listen on a port as long as I am not using the two stanzas [SSL] and [splunktcp-ssl:9998] and instead using the default stanza [splunktcp://9997].

0 Karma
1 Solution

matthewssa
Path Finder

The splunkd.log was showing invalid password or certificate not found. The same settings were used on a Splunk instance without FIPS with the same settings and was working. To fix the issue though I created now SSL certs, but still was not able to identify the root cause. I used the following steps in the splunk documentation to create new SSL certs to get this working in FIPS mode.

Step1: http://docs.splunk.com/Documentation/Splunk/6.0/Security/Howtoself-signcertificates
Step2: http://docs.splunk.com/Documentation/Splunk/6.0/Security/HowtoprepareyoursignedcertificatesforSplunk
Step3: http://docs.splunk.com/Documentation/Splunk/6.0/Security/ConfigureSplunkforwardingtousesignedcertifi...
Step4: http://docs.splunk.com/Documentation/Splunk/6.0/Security/Validateyourconfiguration

View solution in original post

0 Karma

matthewssa
Path Finder

The splunkd.log was showing invalid password or certificate not found. The same settings were used on a Splunk instance without FIPS with the same settings and was working. To fix the issue though I created now SSL certs, but still was not able to identify the root cause. I used the following steps in the splunk documentation to create new SSL certs to get this working in FIPS mode.

Step1: http://docs.splunk.com/Documentation/Splunk/6.0/Security/Howtoself-signcertificates
Step2: http://docs.splunk.com/Documentation/Splunk/6.0/Security/HowtoprepareyoursignedcertificatesforSplunk
Step3: http://docs.splunk.com/Documentation/Splunk/6.0/Security/ConfigureSplunkforwardingtousesignedcertifi...
Step4: http://docs.splunk.com/Documentation/Splunk/6.0/Security/Validateyourconfiguration

0 Karma
Get Updates on the Splunk Community!

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...

Stay Connected: Your Guide to February Tech Talks, Office Hours, and Webinars!

💌Keep the new year’s momentum going with our February lineup of Community Office Hours, Tech Talks, ...