Is anyone using the same TLS internally signed certificate for the host and web?

[bill_king]

Is anyone using the same TLS internally signed certificate for the host and web? 

If so, is there anything additive to the cert process I should know while setting something like that up?

[bill_king]

Agreed; we do not intend on using Splunk-supplied certs but rather internal signed certs.  Have you been able to successfully dual purpose host & web certs for Splunk before? 

[PickleRick · Accepted solution]

What do you mean by "host" cert? The cert splunk uses for internal communication? Sure. If I remember correctly, if you specify certs in global SSL settings they will be used for whatever tls-related purpose you'll need them - hec, web, splunkd - unless you overwrite the setting on a per-use basis.

EDIT: Just remember that if you want to use the same cert for web server and for some connections initiated _from_ your splunk server, you need to issue a cert with both TLS Web Server and TLS Web Client usages

[PickleRick]

As a rule of thumb you should _not_ use the default splunk-supplied certs. TLS means you want some reasonable level of protection. There is no protection if anyone can issue any cert signed by "your" CA.

If you however want to stick with default certs you can use the same cert for splunkd, for web, for hec and god knows what else - there is no technical reason why you couldn't do that. In fact, using the same cert for splunkd as well as web interface is quite typical for external ca issued certs as well.