Security

Custom Splunk management port 8089 certificate

realsplunk
Motivator

Hello guys,

tried to update server.conf but Splunk crashed with handshake failure accessing https://localhost:8089

[sslConfig]
#sslPassword = $7$OXZyp5GzoeMoXOIUSMqIFC+4Od7JKUacyjpUPBRobqwXbKYgAoObNg==
serverCert = $SPLUNK_HOME/etc/apps/APP_OUTPUTS/default/preproduction-server.pem
sslPassword = xxx
sslRootCAPath = $SPLUNK_HOME/etc/apps/APP_OUTPUTS/default/preproduction-cacert.pem
requireClientCert = true

Is it necessary to also update web.conf according to https://docs.splunk.com/Documentation/Splunk/7.3.4/Security/Securingyourdeploymentserverandclients?

May it break the deployment server / DS clients?

 

Also does it impact implementation of [tcp-ssl] port?

Thanks.

Labels (1)
0 Karma
1 Solution

scelikok
Champion

Hi @realsplunk,

Since Splunk Web is communicating with splunkd running on 8089, you should update web.conf too.

If this server is Deployment server, you should distribute the certificate to clients too.  

 

If this reply helps you an upvote is appreciated.

View solution in original post

scelikok
Champion

Hi @realsplunk,

Since Splunk Web is communicating with splunkd running on 8089, you should update web.conf too.

If this server is Deployment server, you should distribute the certificate to clients too.  

 

If this reply helps you an upvote is appreciated.

View solution in original post

realsplunk
Motivator

Thanks it works 🙂

I used requireClientCert  = false as certification is not dedicated to my host otherwise do you mean we should distribute the certificates to deployment clients, this would be time-consuming and out of Splunk scope (deploy certs through Puppet/Ansible for instance)?

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!