Splunk Enterprise

Is anyone using the same TLS internally signed certificate for the host and web?

bill_king
Path Finder

Is anyone using the same TLS internally signed certificate for the host and web? 

If so, is there anything additive to the cert process I should know while setting something like that up?

Labels (1)
Tags (4)
0 Karma
1 Solution

PickleRick
Ultra Champion

What do you mean by "host" cert? The cert splunk uses for internal communication? Sure. If I remember correctly, if you specify certs in global SSL settings they will be used for whatever tls-related purpose you'll need them - hec, web, splunkd - unless you overwrite the setting on a per-use basis.

EDIT: Just remember that if you want to use the same cert for web server and for some connections initiated _from_ your splunk server, you need to issue a cert with both TLS Web Server and TLS Web Client usages

View solution in original post

bill_king
Path Finder

Agreed; we do not intend on using Splunk-supplied certs but rather internal signed certs.  Have you been able to successfully dual purpose host & web certs for Splunk before? 

0 Karma

PickleRick
Ultra Champion

What do you mean by "host" cert? The cert splunk uses for internal communication? Sure. If I remember correctly, if you specify certs in global SSL settings they will be used for whatever tls-related purpose you'll need them - hec, web, splunkd - unless you overwrite the setting on a per-use basis.

EDIT: Just remember that if you want to use the same cert for web server and for some connections initiated _from_ your splunk server, you need to issue a cert with both TLS Web Server and TLS Web Client usages

PickleRick
Ultra Champion

As a rule of thumb you should _not_ use the default splunk-supplied certs. TLS means you want some reasonable level of protection. There is no protection if anyone can issue any cert signed by "your" CA.

If you however want to stick with default certs you can use the same cert for splunkd, for web, for hec and god knows what else - there is no technical reason why you couldn't do that. In fact, using the same cert for splunkd as well as web interface is quite typical for external ca issued certs as well.

0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...