Splunk Enterprise

Universal Forwarder Certificate - What are the Key Usage Requirements?

shocko
Contributor

I wish to start using TLS and mutual authentication for my forwarders. I'm running Splunk Enterprise  8.2.4 on Windows 2019 with a mix of windows and Linux forwarders all on 8.2.5 I have my indexers using our PKI signed certificates and the forwarders are currently using the default UF certificate which is obviously not good. As such, I can get certificates issues from our PKI for the UFs but reading this guide it does not indicate what the key usage or enhanced key usage for the cert should be? I would have assumed client authentication ? Looking at the default certificates these attributes are not specified. 

Labels (1)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

Yes, if you want to authenticate your client with a cert, you need a Web Client Authentication usage in the cert. Otherwise the server will not allowmthe client to connect due to improper usage of certificate.

shocko
Contributor

I will test this. Thanks for the reply. 

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...