Splunk Self Signed Certificates

[alanzchan]

I've followed the steps to create self signed certificates for my Splunk instances as detailed here:

https://docs.splunk.com/Documentation/Splunk/7.2.6/Security/Howtoself-signcertificates

We reran the security scan and it detected this error:

The X.509 certificate chain for this service is not signed by a
recognized certificate authority.  If the remote host is a public host
in production, this nullifies the use of SSL as anyone could establish
a man-in-the-middle attack against the remote host. 

Note that this plugin does not check for certificate chains that end
in a certificate that is not self-signed, but is signed by an
unrecognized certificate authority. =

Can someone elaborate on this error? Does this mean the self signed certificate is negligible and similar to not having a certificate at all (using default Splunk certificates)? Or did I not generate the certificates correctly?

[jnudell_2]

Hi @alanzchan ,
That error is to be expected when using self-signed certificates. It's just saying that the certificate cannot be verified by any recognized certificate authority (CA) like godaddy.com, digicert.com, verisign.com, etc. It doesn't mean that the certificate won't provide secure communications, only that the CA is not on the list of recognized CAs.
Your communications will still be encrypted properly.

[amitm05 · Accepted solution]

@alanzchan
The decision is based on your requirements. Following is how this should be evaluated.

Normally self signed certificates are used in test/dev environment and external certificates are used in PROD. However, again depends on your data/environment security requirements and also the network zone you have set up your splunk infra. If it's exposed to "outside" world, it's always advised to use a proper certificate.

See -
https://conf.splunk.com/session/2015/conf2015_DWaddle_DefensePointSecurity_deploying_SplunkSSLBestPr...

Default certificate like you are following are not considered highly secure. If you want to get rid of your error, you'd want to go by this - https://docs.splunk.com/Documentation/Splunk/7.1.2/Security/Howtogetthird-partycertificates

Hope this helps. Let me know !

[jnudell_2]

This does not elaborate on the error, and therefore does not answer the question asked. This answer speaks to whether you should use self-signed certificates or certificates that are signed by a known CA.

If you're running a PROD instance, it's better to use a certificate signed by an internal CA, which is more secure than a self-signed certificate, but will still generate the message above. You don't have to use a third party CA to get the highest security, and internal CA will suffice.