How to establish TLS secure connection between Forwarders and Indexers in a distributed environment?

[Pranitkolhe]

We have distributed Splunk Enterprise setup, we are trying to establish secure TLS communication between UF-> HF-> Indexer.
We do have certificates configured for Search heads, Indexers and Heavy Forwarders. We have also opened required receiving ports on both Indexer and HF.
On the other hand, we have around 200 UF's, can someone please tell me, if we need to generate 200 client certificates or we can use general certificate which we can deploy on all 200 UF's for establishing communication between UF and Indexers

[inventsekar]

Hi @Pranitkolhe ...

The Splunk Documentation got this nice document:

https://docs.splunk.com/Documentation/Splunk/9.1.1/Security/ConfigureSplunkforwardingtousesignedcert...

[isoutamo]

Hi

there was presentation about this on last conf. You could found it from https://conf.splunk.com/watch/conf-online.html?search.event=conf23&search=SEC1936B#/

r. Ismo

[IceWeasel]

Creating a generic signed cert for all UFs is what I did.  Our techsec policy doesn't require mutual TLS, so creating a single, valid cert for all UFs works a treat.  You'll want to stop your UF's from listening on external interfaces if your security team is going to port-scan, though, as the cert will come back as not matching the hostname and therefore a security emergency. (Not really, but with TechSec, what isn't an emergency?)  I droped the cert into a common app to all UFs and updated the cert path as well.