It's not very easy process. I should explain starting from generating CSR. #Switch user to user which is running splunkd service, for example: splunkd is running with splunk user.
sudo su - splunk
# Change directory to $SPLUNK_HOME, for example splunk is under /opt
cd /opt/splunk/
#1 Generate Key this will prompt for passphrase, key in and remember the passphrase
openssl genrsa -des3 -out splunk_2_splunk_server.key 3072
#2 Add All your Indexers or Heavy forwarders ( this is basically receiver/server) to issue single certifcate) with Cert Details for the above key
#3 Make sure to fill replace all values inside <>
# for example /C=India
# DNS:splunkidx02.domain.com
openssl req -new -sha256 -key splunk_2_splunk_server.key -out splunk_2_splunk_server.csr -subj "/C=<country>/ST=<state>/L=<location>/O=<organization>/OU=<organizational_unit>/CN=<certficate_name>" -reqexts SAN -config <(cat /opt/splunk/openssl/openssl.cnf <(printf "req_extensions = v3_req\n[SAN]\nsubjectAltName=DNS:<receiver1_fqdn>,DNS:<receiver2_fqdn>")) -out splunk_2_splunk_server.csr
#4 View CSR in plain text for validation
openssl req -in splunk_2_splunk_server.csr -noout -text
repeat steps #1-#4 to create a CSR for client, don't use same passphrase for both client and server.
for example you have created client csr "splunk_2_splunk_client.csr"
and server csr "splunk_2_splunk_server.csr"
sign both of them using your CA.
# if your company provides p7b cert, you can convert p7b to pem because pem is required in splunk
openssl pkcs7 -print_certs -in <yourcert>.p7b -out splunk_2_splunk.pem
Now, you have client key with passphrase, client pem certificate and server key with passphrase, server pem certificate.
#this should go to server ( HF or Indexer)
create an app appforhforindexer
create a directory cert inside it
create server.pem inside cert directory
server.pem: is combination of below
server_signed_cert.pem
server.key
internmediate.pem (if any)
root.pem
#I have deployed app to HF/Indexer using Deployment server.
/opt/splunk/etc/deployment-apps/<appforhforindexer>/local/inputs.conf
[splunktcp-ssl:9997]
disabled = 0
[SSL]
serverCert = $SPLUNK_HOME/etc/apps/<appforhforindexer>/cert/server.pem
requireClientCert = false
sslPassword = <server_key_passphraseinplaintext>
Client Configuration (this should go to universal forwarders)
create an app appforclient
create a directory cert inside it
create client.pem inside cert directory
client.pem: is combination of below
client_signed_cert.pem
client.key
internmediate.pem (if any)
root.pem
/opt/splunk/etc/deployment-apps/<appforclient>/local/outputs.conf
[tcpout]
defaultGroup = <yourtcpoutgroup>
[tcpout:<yourtcpoutgroup>]
server = server1:9997,server2:9997
clientCert = $SPLUNK_HOME/etc/apps/<appforclient>/cert/client.pem
sslPassword = <client_key_passphraseinplaintext>
useClientSSLCompression = true
sslVerifyServerCert = false
... View more
