SSL enabled between deployment server and deployment client (UF)

[krusovice]

In my environment, I've setup the SSL communication and authentication between Deployment Server and its deployment client. It is working fine.

The trouble came when nearly 1 year - the renewal of the SSL is needed, meaning the server.pem and cacert.pem in UF require to be updated with renewed SSL. 

For the first year, we have used DS to push the SSL cert over to UF. Question is - is there any way to push the second year's SSL cert (server.pem and cacert.pem) over to UF using Deployment servers while the first year SSL still valid?

Or is there any best practice how to renew the cert in UF (deployment client) in yearly basis?

Thanks.

[SinghK]

Ow, are you saying that you pushed a common ssl cert to all UF's?

[krusovice]

Yes, in our environment, there is cacert.pem and server.pem sit in the UF that require to annually renewed.

[isoutamo · Accepted solution]

Hi

the best way to renew those is dependent on your way to use those. If you have use individual certificate in every node then you definitely need some tool which will manage that. But as the normal way to do this with splunk is to use one (or only few) cert for all UFs then it's much easier. Depending on place where you have put your cert files on UF you need a separate deployment tool (e.g. ansible, any MS based for windows) to renew those or use DS to add that on separate TA/SA on clients and then restart those.

r. Ismo

• https://hurricanelabs.com/splunk-tutorials/splunk-certificates-master-guide/
• https://www.duanewaddle.com/splunk-conf-2014/ and https://wiki.splunk.com/images/f/fb/SplunkTrustApril-SSLipperySlopeRevisited.pdf
• https://www.aplura.com/assets/pdf/securing-splunk-cheatsheet.pdf

[tinatan]

Thank you for the reply, we are using one cert applied to all UFs.

[SinghK]

my understanding was ssl cert was very unique with priv key and everything unless csr  and key is not generated on server it will not work.

i am very interested in the topic lets ask isoutamo or anyone else who can help.

@isoutamo