Getting Data In

How do I set the SSL cert for the management port (8089)?

wohali
Engager

Like the question says, I'd like to build some REST clients using Splunk (4.3.2, 4.3.3) that will not be running on the same host as Splunk. I'd like those clients to certify the certificate of the host.

My Splunk server has certs installed and access to the main web interface over https raises no browser warnings. However, all access to port 8089 shows the Splunk self-signed certificate is being used, and requires I disable cert checking (curl -k).

I found no settings in web.conf that address this.

How do I set the certificate for splunkd's management port?

1 Solution

jrodman
Splunk Employee
Splunk Employee

Our general documentation on setting up SSL certs for splunkd activities is here:
http://docs.splunk.com/Documentation/Splunk/latest/Admin/SecureaccesstoyourSplunkserverwithSSL

Note that there are of course multiple protocols for which you can use a cert with Splunkd: the management port which is https, and forwarding which is a streaming ssl socket of data.

[edit] as of Splunk version 5.0, there is a new Securing Splunk manual, and the above link will not work:
http://docs.splunk.com/Documentation/Splunk/latest/Security/AboutsecuringyourSplunkconfigurationwith...

View solution in original post

jrodman
Splunk Employee
Splunk Employee

Our general documentation on setting up SSL certs for splunkd activities is here:
http://docs.splunk.com/Documentation/Splunk/latest/Admin/SecureaccesstoyourSplunkserverwithSSL

Note that there are of course multiple protocols for which you can use a cert with Splunkd: the management port which is https, and forwarding which is a streaming ssl socket of data.

[edit] as of Splunk version 5.0, there is a new Securing Splunk manual, and the above link will not work:
http://docs.splunk.com/Documentation/Splunk/latest/Security/AboutsecuringyourSplunkconfigurationwith...

jrodman
Splunk Employee
Splunk Employee

I agree with your judgement.

wohali
Engager

Thanks! It's extra confusing that you set the port for splunkd in web.conf, but you set the certificate for splunkd in server.conf. These settings should be together!

Get Updates on the Splunk Community!

Set Up More Secure Configurations in Splunk Enterprise With Config Assist

This blog post is part 3 of 4 of a series on Splunk Assist. Click the links below to see the other ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Enterprise Security Content Update (ESCU) v3.54.0

The Splunk Threat Research Team (STRT) recently released Enterprise Security Content Update (ESCU) v3.54.0 and ...