Splunk Search

Please help for ssl for splunkd - Splunk runs but cannot log in and is slow

Path Finder

I want to secure splunkd DS->clients with self-signed ssl cert but for some reason it doesn't work.

From splunk docs , I followed this:
but the only info there is that you need to add config in server.conf and that there must be used the same CA cert as Web splunk
so I have created a new server cert from the same CA as the Web cert is and have the following configs:

enableSplunkdSSL = true
sslVersions = *,-ssl2
serverCert = ServerCertificate2.pem
sslPassword = encryptedpass
sslRootCAPath = CACertificate.pem

enableSplunkWebSSL = true
privKeyPath = ServerPrivateKey1.key
serverCert = ServerPrivateKey1.pem

serverCert = ServerCertificate3.pem
sslPassword = encryptedpass

If I start splunk with the above, splunk starts but it loads very very slow and No one can log in. The only thing I can see in the log is:
WARN SSLCommon - Received fatal SSL3 alert. ssl_state='SSLv3 read finished A', alert_description='certificate unknown'.
But I noticed that the same warning comes even if I run the working server.conf:

If I change the server.conf so that it is using the same server cert as the inputs.conf , Splunk has no problems and works perfectly.
enableSplunkdSSL = true
sslVersions = *,-ssl2
serverCert = ServerCertificate3.pem
sslPassword = encryptedpass
sslRootCAPath = CACertificate.pem

So why I cannot use two different server.certs for splunkd and data encryption traffic?
Is there something I don't do correct and where I can find more info for splunk ssl in splunk docs?

Many thanks in advance

Tags (1)
0 Karma

Esteemed Legend

Hi net1993,
at first, why do you used signed certificates Authentication between deployment servers and clients?
you can read at the page you indicated that's not recommended, because the configuration data pushed from the deployment server to client does not generally provide exploitable information!.
In addition, configuring certificate authentication for a deployment server and clients impacts the rest of your configuration as follows:

  • Splunk Web will fail to authenticate unless you also configure it to use the certificate,
  • The CLI will be not be able to communicate with the deployment server.

In addition Deployment Server and Deployment Clients are connected in https.

Then I think that Splunk cannot use two different certificates and there isn't a reason to do this.


0 Karma

Path Finder

Hello @gcusello

Thank you for response.
1. I have noticed that it is not recommended but it is requirement
Ok, I think then it is me who didn't quite catch the docs. So they are actually saying that authentication will fail in case there is not used the same server certificate.
Can you explain me what more about the second point with the CLI? CLI of which host will not be able to communicate with DS?

0 Karma
Get Updates on the Splunk Community!

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...