Enabling TLS in Splunk Enterprise- Do I have to have a certificate on all Forwarders?

[MichaelDB]

Hi,

I'm configuring SSL in a test environment on version 8.2.6 of Splunk Enterprise before upgrading to Splunk 9.0.0. 

I have managed to encrypt traffic between my Splunk servers, however, I am now unable forward data to my Indexers as they're are refusing connections from my Forwarders.

Do I have to have a certificate on all of my Forwarders to make use of SSL/TLS?

I'm trying to avoid the overhead of having to manage certificates on all of my  servers that I have in the Production environment.

Thanks.

Mike.

[Stefanie]

Yes you will need to have a certificate on all of your forwarders in the /opt/splunkforwarder/etc/auth/ directory. This can be the same certificate you use on your indexers. You don't need to generate multiple.

This is something that the Deployment Server can not push out natively, you may need to look at utilizing another software to push out the configurations for the forwarder's SSL settings.

[MichaelDB]

Thank you for your response.

I thought that each Indexer needed it's own certificate, that's what I have done in my test environment. Am I incorrect?

Thanks,

Mike.

[Stefanie]

Each indexer needs a certificate installed & configured, yes. But that certificate can have multiple SANs for each of your indexers. That way there is only one certificate to renew when the time comes. 

But for your indexers to accept SSL connections from another Splunk instance (Server or forwarder) it needs a certificate as well. Luckily the forwarder can utilize any certificate you obtained for your Splunk servers. It doesn't have to be the indexer's certificate but that one is readily available I assume?