Why am I receiving errors setting up forwarding encryption?

Path Finder

I am attempting to set up encryption between a Splunk Universal Forwarder (verion 9.0.3) and a Splunk Heavy Forwarder (version 9.0.3).  I followed the instructions found on this Splunk community site exactly (with the exception of changing the IPs of course to reflect my environment, but am getting the errors below in the splunkd.log file on the Universal Forwarder (the Heavy Forwarder is listening for connections on 9997).

Splunk Coimmunity Site URL


Please advise.

Labels (2)
0 Karma

Path Finder

To be specific, this is the error I am getting now ----

02-17-2023 11:46:17.588 -0800 WARN  X509Verify [7248 HTTPDispatch] - X509 certificate (O=SplunkUser,CN=SplunkServerDefaultCert) should not be used, as it is issued by Splunk's own default Certificate Authority (CA). This puts your Splunk instance at very high-risk of the MITM attack. Either commercial-CA-signed or self-CA-signed certificates must be used.
0 Karma

Path Finder

So, I think I may have figured out how to resolve this issue......

Since the certificates are self-signed, I needed to edit the line (from the outputs.conf on the UF --- AND  ---- from the inputs.conf on the HF): 

current >>>> sslVerifyServerCert = true
new >>>> sslVerifyServerCert = false

What I need to figure out now is how to get these signed with a legitimate CA.  I am assuming there are certs installed on the Splunk HF/UF instances that I can use to sign with --- any help/links would be appreciated.


0 Karma
Get Updates on the Splunk Community!

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...