Enable HTTPS

Enable HTTPS

You can enable HTTPS via Splunk Web or web.conf.

Note: Your Splunk server can listen on either HTTP or HTTPS. It cannot listen on both.

You can also enable SSL through separate configurations.

Important: If you are using Firefox 3, enabling SSL for a Splunk deployment may result in an "invalid security exception" being displayed in the browser. Refer to this workaround documentation for more information.

Configuration

In Splunk Web

To enable HTTPS in Splunk Web, click the Admin link in the upper right hand corner. This directs you to the Server -> Settings page. Under Web interface, change the radio button to Yes for Enable SSL (HTTPS) in SplunkWeb?

You must restart Splunk to enable the new settings. Also, you must append "https://" to your URI.

In web.conf

In order to enable HTTPS you will need to modify your $SPLUNK_HOME/etc/bundles/local/web.conf to

[settings]
httpport = <port number>
enableSplunkWebSSL = true

• httpport
  • Set the port number to your HTTPS port.
• enableSplunkWebSSL
  • Set this key to true to enable SSL for SplunkSearch.

Once you have made the changes to web.conf restart your Splunk server to read the new changes in.

Certs

The certificate used for SSL between SplunkWeb and the client browser is located in $SPLUNK_HOME/share/splunk/certs/. You can replace the self-signed default certificate with your own. The SSL cert needs to be in PEM format. Restart Splunk Web from the CLI for your changes to take effect. To use Splunk's CLI, navigate to the $SPLUNK_HOME/bin/ directory and use the ./splunk command. You can also add Splunk to your path and use the splunk command.

./splunk restart splunkweb

If your self-signed cert for Splunk Web expires, you can generate a new one by deleting cert.pem and privkey.pem in $SPLUNK_HOME/share/splunk/certs/.

• Was this topic useful?
• Post a comment