SSL Forwader to Indexer

[moesaidi]

Windows Server 2012
Splunk 7.0
Self Signed certificates
Followed document: https://docs.splunk.com/Documentation/Splunk/7.1.1/Security/Howtoself-signcertificates

We're not requiring client cert, we set 'verifyServerCert' to false

The document isn't clear about the files that are generated, which have to be defined in what configuration..

for example:
The files that were created, where exactly should they be used and how ? (In inputs.conf VS outputs.conf VS server.conf...)
When we read on, we reach: http://docs.splunk.com/Documentation/Splunk/7.1.1/Security/ConfigureSplunkforwardingtousesignedcerti...
It states we should create client.pem - but I thought we already created this in the earlier steps using the above document.

Has anyone successfully been able to follow the documentation and get SSL encryption using self-signed certificates to work between the forwarder/indexer ?
If so what steps did you take and / or any advice?

Thanks

[renjith_nair · Accepted solution]

Let's try to summarize it:
By following the instructions https://docs.splunk.com/Documentation/Splunk/7.1.1/Security/Howtoself-signcertificates, you created the following certificates and key :

1. Root Certificate : myCACertificate.pem :- This is your Certificate Authority which could now act as a CA for generating other certificates
2. Server certificate : myServerCertificate.pem : - This is the certificate for the indexer(s).
3. myServerPrivateKey.key :- Key used to sign the server certificate. 2 & 3 could be included in a file as mentioned in the next step

These certificates have to be configured in indexer : inputs.conf (myServerCertificate.pem which includes both cert and key as mentioned in Create Single PEM and in server.conf configure the CA certificate(sslRootCAPath -> the RootCA certificate)

Now on forwarder, you need to create a client cert as mentioned in configure forwarder certificate and configure it in outputs.conf of the forwarder as explained in the document. Also configure the CA certificate in the server.conf of the forwarder .

[moesaidi]

Based on what you described:
INDEXER:
- INPUTS.CONF
serverCert = myNewServerCertificate.pem #As Described in "Create single PEM", the created file is used here
- SERVER.CONF
sslRootCAPath = myCACertificate.pem # As described iny our #1... which is odd because documentation says ignore this for windows. So where do we use this in Windows since we're running Windows Server 2012.

FORWARDER
- OUTPUTS.CONF

How exactly do we create a client.pem (Client cert) and do we do it using the CA from earlier steps?

SERVER.CONF

The document says: skip this for Windows configurations - so nothing gets defined in server.conf ?

Thanks for all your help! Still trying to sort this out - if I define the entries in server.conf I get a warning in the logs saying it is being ignored.

[moesaidi]

finally got it working!

TUrns out mutual authentication is required - so we DID need to have a client.pem created on the forwarder (no need for the root ca though if it's windows).
If we properly defined it on the forwarder, it attempted to use SSL when communicating with the indexer.
TUrns out the "Wrong Version" error we kept getting was ambiguous and meant the forwarder was not communicating with SSL while the indexer was trying to communicate with SSL.

[damode]

So does that mean, we need to create client.pem on each universal forwarder ?

[moesaidi]

Correct!
well.. sort of.
You can use the default client.pem that comes with Splunk if you disable SSLVerification - or create your own.
I'd say recommended is to create your own to avoid "man in the middle" attacks but depending on your environment you may not need to.