Enable HTTPS

Enable HTTPS

You can enable HTTPS via Splunk Web or web.conf.

Note: Your Splunk server can listen on either HTTP or HTTPS. It cannot listen on both.

You can also enable SSL through separate configurations.

Important: If you are using Firefox 3, enabling SSL for a Splunk deployment may result in an "invalid security exception" being displayed in the browser. Refer to this workaround documentation for more information.

Configuration

In Splunk Web

To enable HTTPS in Splunk Web, click the Admin link in the upper right hand corner. Then, click Server and choose View Settings. Under Web interface, change the radio button to Yes for Enable SSL (HTTPS) in Splunk Web?

Note: You must restart Splunk to enable the new settings. Also, you must now append "https://" to the URI you use to access Splunk Web.

In web.conf

In order to enable HTTPS, modify web.conf. Edit this file in $SPLUNK_HOME/etc/system/local/, or your own custom application directory in $SPLUNK_HOME/etc/apps/. For more information on configuration files in general, see how configuration files work.

[settings]
httpport = <port number>
enableSplunkWebSSL = true

• httpport
  • Set the port number to your HTTPS port.
• enableSplunkWebSSL
  • Set this key to true to enable SSL for Splunk Web.

Once you have made the changes to web.conf restart your Splunk server to read the new changes in.

Certificates

The certificates used for SSL between Splunk Web and the client browser is located in $SPLUNK_HOME/share/splunk/certs/. You can replace the self-signed default certificate with your own.

The certificates for SSL are specified in web.conf. You can change the defaults to your own certificate names.

privKeyPath = /certs/privkey.pem
caCertPath = /certs/cert.pem

Restart Splunk Web from the CLI for your changes to take effect. To use Splunk's CLI, navigate to the $SPLUNK_HOME/bin/ directory and use the ./splunk command. You can also add Splunk to your path and use the splunk command.

./splunk restart splunkweb

If your self-signed certificate for Splunk Web expires, you can generate a new one by deleting cert.pem and privkey.pem in $SPLUNK_HOME/share/splunk/certs/.

• Was this topic useful?
• Post a comment