Why am I receiving errors setting up forwarding encryption?

Path Finder

I am attempting to set up encryption between a Splunk Universal Forwarder (verion 9.0.3) and a Splunk Heavy Forwarder (version 9.0.3).  I followed the instructions found on this Splunk community site exactly (with the exception of changing the IPs of course to reflect my environment, but am getting the errors below in the splunkd.log file on the Universal Forwarder (the Heavy Forwarder is listening for connections on 9997).

Splunk Coimmunity Site URL


Please advise.

Labels (2)
0 Karma

Path Finder

To be specific, this is the error I am getting now ----

02-17-2023 11:46:17.588 -0800 WARN  X509Verify [7248 HTTPDispatch] - X509 certificate (O=SplunkUser,CN=SplunkServerDefaultCert) should not be used, as it is issued by Splunk's own default Certificate Authority (CA). This puts your Splunk instance at very high-risk of the MITM attack. Either commercial-CA-signed or self-CA-signed certificates must be used.
0 Karma

Path Finder

So, I think I may have figured out how to resolve this issue......

Since the certificates are self-signed, I needed to edit the line (from the outputs.conf on the UF --- AND  ---- from the inputs.conf on the HF): 

current >>>> sslVerifyServerCert = true
new >>>> sslVerifyServerCert = false

What I need to figure out now is how to get these signed with a legitimate CA.  I am assuming there are certs installed on the Splunk HF/UF instances that I can use to sign with --- any help/links would be appreciated.


0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...