myServerCertificate.pem

[ephemeric]

Greetz,

http://wiki.splunk.com/Community:Splunk2Splunk_SSL_3rdPartyCA

I have followed the above article and have noticed that one copies the private server key to all the forwarders in said example (myServerCertificate.pem). If one of the forwarders is compromised then one can impersonate the same Splunk server with said server certificate.

This surely must be wrong?

[kristian_kolb]

Perhaps things have changed a little bit since the article was written, but we deploy (to forwarders) a forwarder.pem (containing a forwarder certificate and its key in one file), and the cacert.pem, which is the CA certificate ONLY (not the key), which is used to verify the indexers.

The indexer has a similar setup; indexer.pem (cert + key) cacert.pem (cert)

This works well, and for log forwarding this can be deployed in an app. Setting up certificates for handling the deployment traffic cannot (obviously) be done through a deployed app.

Hope this helps,

Kristian

[kristian_kolb]

Aah. Sorry for my misunderstanding. I just wanted to clarify that you do not HAVE to do it that way. Perhaps you did once - though it sounds rather weak from a security standpoint.

/k

[ephemeric]

No. What I'm saying is there is a gaping security hole in the article.