If I start splunk with the above, splunk starts but it loads very very slow and No one can log in. The only thing I can see in the log is:
WARN SSLCommon - Received fatal SSL3 alert. ssl_state='SSLv3 read finished A', alert_description='certificate unknown'.
But I noticed that the same warning comes even if I run the working server.conf:
If I change the server.conf so that it is using the same server cert as the inputs.conf , Splunk has no problems and works perfectly.
enableSplunkdSSL = true
sslVersions = *,-ssl2
serverCert = ServerCertificate3.pem
sslPassword = encryptedpass
sslRootCAPath = CACertificate.pem
So why I cannot use two different server.certs for splunkd and data encryption traffic?
Is there something I don't do correct and where I can find more info for splunk ssl in splunk docs?
at first, why do you used signed certificates Authentication between deployment servers and clients?
you can read at the page you indicated that's not recommended, because the configuration data pushed from the deployment server to client does not generally provide exploitable information!.
In addition, configuring certificate authentication for a deployment server and clients impacts the rest of your configuration as follows:
Splunk Web will fail to authenticate unless you also configure it to use the certificate,
The CLI will be not be able to communicate with the deployment server.
In addition Deployment Server and Deployment Clients are connected in https.
Then I think that Splunk cannot use two different certificates and there isn't a reason to do this.
Thank you for response.
1. I have noticed that it is not recommended but it is requirement
Ok, I think then it is me who didn't quite catch the docs. So they are actually saying that authentication will fail in case there is not used the same server certificate.
Can you explain me what more about the second point with the CLI? CLI of which host will not be able to communicate with DS?