We have scenario where we run a indexer cluster with 10+ indexers and the Universal Forwarders send data to all these indexers. Since, all these indexers do have different Common Names (CN), they do have different SSL certificates and we are left with an option to use server-specific [SSLConfig] stanza for each indexer in the outputs.conf of each forwarder.
This solution has challenges when we are managing larger indexer clusters, where we keep adding / removing indexers from Indexer Cluster
Hence, would like to pursue on the alternate options available for the same.
Does Splunk support SSL certificate Subject Alternative Name (SAN). - SSL certificate that has the ability to cover multiple host names (domains)?
Any alternate options available are also much appreciated...
