Why am I receiving errors setting up forwarding encryption?

Path Finder

I am attempting to set up encryption between a Splunk Universal Forwarder (verion 9.0.3) and a Splunk Heavy Forwarder (version 9.0.3).  I followed the instructions found on this Splunk community site exactly (with the exception of changing the IPs of course to reflect my environment, but am getting the errors below in the splunkd.log file on the Universal Forwarder (the Heavy Forwarder is listening for connections on 9997).

Splunk Coimmunity Site URL


Please advise.

Labels (2)
0 Karma

Path Finder

To be specific, this is the error I am getting now ----

02-17-2023 11:46:17.588 -0800 WARN  X509Verify [7248 HTTPDispatch] - X509 certificate (O=SplunkUser,CN=SplunkServerDefaultCert) should not be used, as it is issued by Splunk's own default Certificate Authority (CA). This puts your Splunk instance at very high-risk of the MITM attack. Either commercial-CA-signed or self-CA-signed certificates must be used.
0 Karma

Path Finder

So, I think I may have figured out how to resolve this issue......

Since the certificates are self-signed, I needed to edit the line (from the outputs.conf on the UF --- AND  ---- from the inputs.conf on the HF): 

current >>>> sslVerifyServerCert = true
new >>>> sslVerifyServerCert = false

What I need to figure out now is how to get these signed with a legitimate CA.  I am assuming there are certs installed on the Splunk HF/UF instances that I can use to sign with --- any help/links would be appreciated.


0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...