Why am I receiving errors setting up forwarding encryption?

Path Finder

I am attempting to set up encryption between a Splunk Universal Forwarder (verion 9.0.3) and a Splunk Heavy Forwarder (version 9.0.3).  I followed the instructions found on this Splunk community site exactly (with the exception of changing the IPs of course to reflect my environment, but am getting the errors below in the splunkd.log file on the Universal Forwarder (the Heavy Forwarder is listening for connections on 9997).

Splunk Coimmunity Site URL


Please advise.

Labels (2)
0 Karma

Path Finder

To be specific, this is the error I am getting now ----

02-17-2023 11:46:17.588 -0800 WARN  X509Verify [7248 HTTPDispatch] - X509 certificate (O=SplunkUser,CN=SplunkServerDefaultCert) should not be used, as it is issued by Splunk's own default Certificate Authority (CA). This puts your Splunk instance at very high-risk of the MITM attack. Either commercial-CA-signed or self-CA-signed certificates must be used.
0 Karma

Path Finder

So, I think I may have figured out how to resolve this issue......

Since the certificates are self-signed, I needed to edit the line (from the outputs.conf on the UF --- AND  ---- from the inputs.conf on the HF): 

current >>>> sslVerifyServerCert = true
new >>>> sslVerifyServerCert = false

What I need to figure out now is how to get these signed with a legitimate CA.  I am assuming there are certs installed on the Splunk HF/UF instances that I can use to sign with --- any help/links would be appreciated.


0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...