Security

Splunk Self Signed Certificates

alanzchan
Path Finder

I've followed the steps to create self signed certificates for my Splunk instances as detailed here:

https://docs.splunk.com/Documentation/Splunk/7.2.6/Security/Howtoself-signcertificates

We reran the security scan and it detected this error:

The X.509 certificate chain for this service is not signed by a
recognized certificate authority.  If the remote host is a public host
in production, this nullifies the use of SSL as anyone could establish
a man-in-the-middle attack against the remote host. 

Note that this plugin does not check for certificate chains that end
in a certificate that is not self-signed, but is signed by an
unrecognized certificate authority. =

Can someone elaborate on this error? Does this mean the self signed certificate is negligible and similar to not having a certificate at all (using default Splunk certificates)? Or did I not generate the certificates correctly?

0 Karma
1 Solution

amitm05
Builder

@alanzchan
The decision is based on your requirements. Following is how this should be evaluated.

Normally self signed certificates are used in test/dev environment and external certificates are used in PROD. However, again depends on your data/environment security requirements and also the network zone you have set up your splunk infra. If it's exposed to "outside" world, it's always advised to use a proper certificate.

See -
https://conf.splunk.com/session/2015/conf2015_DWaddle_DefensePointSecurity_deploying_SplunkSSLBestPr...

Default certificate like you are following are not considered highly secure. If you want to get rid of your error, you'd want to go by this - https://docs.splunk.com/Documentation/Splunk/7.1.2/Security/Howtogetthird-partycertificates

Hope this helps. Let me know !

View solution in original post

jnudell_2
Builder

Hi @alanzchan ,
That error is to be expected when using self-signed certificates. It's just saying that the certificate cannot be verified by any recognized certificate authority (CA) like godaddy.com, digicert.com, verisign.com, etc. It doesn't mean that the certificate won't provide secure communications, only that the CA is not on the list of recognized CAs.
Your communications will still be encrypted properly.

amitm05
Builder

@alanzchan
The decision is based on your requirements. Following is how this should be evaluated.

Normally self signed certificates are used in test/dev environment and external certificates are used in PROD. However, again depends on your data/environment security requirements and also the network zone you have set up your splunk infra. If it's exposed to "outside" world, it's always advised to use a proper certificate.

See -
https://conf.splunk.com/session/2015/conf2015_DWaddle_DefensePointSecurity_deploying_SplunkSSLBestPr...

Default certificate like you are following are not considered highly secure. If you want to get rid of your error, you'd want to go by this - https://docs.splunk.com/Documentation/Splunk/7.1.2/Security/Howtogetthird-partycertificates

Hope this helps. Let me know !

jnudell_2
Builder

This does not elaborate on the error, and therefore does not answer the question asked. This answer speaks to whether you should use self-signed certificates or certificates that are signed by a known CA.

If you're running a PROD instance, it's better to use a certificate signed by an internal CA, which is more secure than a self-signed certificate, but will still generate the message above. You don't have to use a third party CA to get the highest security, and internal CA will suffice.

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...