Splunk Enterprise

Is anyone using the same TLS internally signed certificate for the host and web?

bill_king
Path Finder

Is anyone using the same TLS internally signed certificate for the host and web? 

If so, is there anything additive to the cert process I should know while setting something like that up?

Labels (1)
Tags (4)
0 Karma
1 Solution

PickleRick
SplunkTrust
SplunkTrust

What do you mean by "host" cert? The cert splunk uses for internal communication? Sure. If I remember correctly, if you specify certs in global SSL settings they will be used for whatever tls-related purpose you'll need them - hec, web, splunkd - unless you overwrite the setting on a per-use basis.

EDIT: Just remember that if you want to use the same cert for web server and for some connections initiated _from_ your splunk server, you need to issue a cert with both TLS Web Server and TLS Web Client usages

View solution in original post

bill_king
Path Finder

Agreed; we do not intend on using Splunk-supplied certs but rather internal signed certs.  Have you been able to successfully dual purpose host & web certs for Splunk before? 

0 Karma

PickleRick
SplunkTrust
SplunkTrust

What do you mean by "host" cert? The cert splunk uses for internal communication? Sure. If I remember correctly, if you specify certs in global SSL settings they will be used for whatever tls-related purpose you'll need them - hec, web, splunkd - unless you overwrite the setting on a per-use basis.

EDIT: Just remember that if you want to use the same cert for web server and for some connections initiated _from_ your splunk server, you need to issue a cert with both TLS Web Server and TLS Web Client usages

PickleRick
SplunkTrust
SplunkTrust

As a rule of thumb you should _not_ use the default splunk-supplied certs. TLS means you want some reasonable level of protection. There is no protection if anyone can issue any cert signed by "your" CA.

If you however want to stick with default certs you can use the same cert for splunkd, for web, for hec and god knows what else - there is no technical reason why you couldn't do that. In fact, using the same cert for splunkd as well as web interface is quite typical for external ca issued certs as well.

0 Karma
Get Updates on the Splunk Community!

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...

Splunk and Fraud

Watch Now!Watch an insightful webinar where we delve into the innovative approaches to solving fraud using the ...