I wish to start using TLS and mutual authentication for my forwarders. I'm running Splunk Enterprise 8.2.4 on Windows 2019 with a mix of windows and Linux forwarders all on 8.2.5 I have my indexers using our PKI signed certificates and the forwarders are currently using the default UF certificate which is obviously not good. As such, I can get certificates issues from our PKI for the UFs but reading this guide it does not indicate what the key usage or enhanced key usage for the cert should be? I would have assumed client authentication ? Looking at the default certificates these attributes are not specified.
Yes, if you want to authenticate your client with a cert, you need a Web Client Authentication usage in the cert. Otherwise the server will not allowmthe client to connect due to improper usage of certificate.
