Splunk Enterprise

Is anyone using the same TLS internally signed certificate for the host and web?

bill_king
Path Finder

Is anyone using the same TLS internally signed certificate for the host and web? 

If so, is there anything additive to the cert process I should know while setting something like that up?

Labels (1)
Tags (4)
0 Karma
1 Solution

PickleRick
SplunkTrust
SplunkTrust

What do you mean by "host" cert? The cert splunk uses for internal communication? Sure. If I remember correctly, if you specify certs in global SSL settings they will be used for whatever tls-related purpose you'll need them - hec, web, splunkd - unless you overwrite the setting on a per-use basis.

EDIT: Just remember that if you want to use the same cert for web server and for some connections initiated _from_ your splunk server, you need to issue a cert with both TLS Web Server and TLS Web Client usages

View solution in original post

bill_king
Path Finder

Agreed; we do not intend on using Splunk-supplied certs but rather internal signed certs.  Have you been able to successfully dual purpose host & web certs for Splunk before? 

0 Karma

PickleRick
SplunkTrust
SplunkTrust

What do you mean by "host" cert? The cert splunk uses for internal communication? Sure. If I remember correctly, if you specify certs in global SSL settings they will be used for whatever tls-related purpose you'll need them - hec, web, splunkd - unless you overwrite the setting on a per-use basis.

EDIT: Just remember that if you want to use the same cert for web server and for some connections initiated _from_ your splunk server, you need to issue a cert with both TLS Web Server and TLS Web Client usages

PickleRick
SplunkTrust
SplunkTrust

As a rule of thumb you should _not_ use the default splunk-supplied certs. TLS means you want some reasonable level of protection. There is no protection if anyone can issue any cert signed by "your" CA.

If you however want to stick with default certs you can use the same cert for splunkd, for web, for hec and god knows what else - there is no technical reason why you couldn't do that. In fact, using the same cert for splunkd as well as web interface is quite typical for external ca issued certs as well.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...