Change Splunk Enterprise Default Certificate to use server Common Name

[msmouse05]

Our Splunk Enterprise installs are working properly, and the web apps show no certificate errors however Tenable Nessus scans are dinging all four servers with "SSL Certificate with Wrong Hostname (45411)" plugin, stating the common name in the certificate is SplunkServerDefaultCert which is not the same as the hostname of the server.

The web apps are configured with proper certificates from our CA with the correct common name. However, the Splunkd service that is running is using this SplunkServerDefaultCert which is where the vulnerability comes from. I verified this by stopping the Splunkd service, rescanning the server and the vulnerability goes away and then comes back when it is restarted.  I'm not very experience with certificates, so am figure a lot of this out as I go.  I believe this is coming from the server.pem and ca.pem files in the $SPLUNK_HOME/etc/auth/ directory. I'm just not sure how I go about swapping those out with a certificate from our own CA with the correct common name.

[PrewinThomas]

@msmouse05 

Splunkd (the management port on 8089) is still presenting the built‑in SplunkServerDefaultCert. To remediate, you need to replace the default server.pem in $SPLUNK_HOME/etc/auth/ with a certificate issued by your internal CA that has the correct hostname in its CN/SAN, and then update server.conf to point Splunkd at that certificate and its private key. Restart Splunkd afterward so it uses the new cert.

Follow below doc
#https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/9.2/secure-splunk-...

Regards,
Prewin
🌟If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!