Security

Disable SSL Communication

cuppma
Explorer

I was wondering the best way to disable SSL communications between my forwarder and Splunk instance. My certificates have expired and I want my logs to get to Splunk. I know can reissue certificates, but I determined that this is no longer necessary. So what do I need to do to just disable this?

Do I need to change a setting in outputs.conf on the forwarder?

Thanks in advance!

1 Solution

MuS
Legend

Hi cuppma,

basically you do the reverse version of the docs about Configure Splunk forwarding to use the default certificate. First make sure your indexer is receiving on a non-SSL Port, next you remove the SSL settings from your UF outputs.conf to something like this:

[tcpout:group1]
server=some IP:some Port

Hope this helps to get you started ...

cheers, MuS

View solution in original post

0 Karma

MuS
Legend

Hi cuppma,

basically you do the reverse version of the docs about Configure Splunk forwarding to use the default certificate. First make sure your indexer is receiving on a non-SSL Port, next you remove the SSL settings from your UF outputs.conf to something like this:

[tcpout:group1]
server=some IP:some Port

Hope this helps to get you started ...

cheers, MuS

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...