SSL Certificate on AWS Application Load Balancer - still have SSL port 8089 Self Signed Cert Vulnerability

[jaracan]

Hi Team,

We are using Splunk in AWS EC2 Instance. The SSL Certificate is uploaded on the AWS Application Load Balancer. With that, how can we resolve the SSL Self Signed Cert Vulnerability for port 8089? Any insights?

I already had added the confs below, but still the vulnerability was still there.

web.conf
[settings]
sslVersions = *,-ssl3
enableSplunkWebSSL = true
cipherSuite = TLSv1.2:!aNULL

server.conf
[sslConfig]
sslVersions = *,-ssl3

[nickhills]

Hi @jaracan
Although you have set a cert on the ALB, you will by default still be using the default certs on the running Splunk instances.

See this excellent presentation from .conf15 about how to issue your own certs for your entire Splunk deployment.
https://conf.splunk.com/session/2015/conf2015_DWaddle_DefensePointSecurity_deploying_SplunkSSLBestPr...