Splunk® Enterprise

Securing Splunk Enterprise

Download manual as PDF

Splunk Enterprise version 6.x is no longer supported as of October 23, 2019. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF

Secure your deployment server and clients using certificate authentication

Authentication using signed certificates between deployment servers and clients is not recommended or considered necessary. The configuration data pushed from the deployment server to client does not generally provide exploitable information. In addition, there are risks in configuring certificate authentication for a deployment server and clients:

  • Splunk Web will fail to authenticate unless you also configure it to use the certificate.
  • The CLI will be not be able to communicate with the deployment server.

You may find certificate authentication necessary in certain distributed configurations, perhaps where extremely sensitive server configuration data is sent to a variety of locations outside your firewall. You can manually configure each indexer to communicate with your Deployment Server:

1. Create one or more certificates using the same root CA.

2. Distribute the certificates to your deployment server and clients.

3. Edit server.conf to provide the location of your certificates:

enableSplunkdSSL = true
sslKeysfile = server.pem
sslKeysfilePassword = password
caCertFile = cacert.pem
caPath = $SPLUNK_HOME/etc/auth

4. Edit server.conf to authenticate against your certificates by adding the following attribute to the [sslConfig] stanza in previous step:

requireClientCert = true

Important: This requireClientCert is set to "false" by default. If you change it to true to force Splunk software to check your client's certificates, Splunk Web and the CLI will also be checked for certificates. Your CLI connection will no longer work because your CLI is unable to present a certificate as a client.

5. Edit web.conf to present a certificate signed by the same root CA so that Splunk Web can connect to the server.

The following is an example of an edited settings stanza:

enableSplunkWebSSL = true
privKeyPath = etc/auth/splunkweb/mySplunkWebPrivateKey.key
serverCert = etc/auth/splunkweb/mySplunkWebCertificate.pem
cipherSuite = <your chosen cipher suite (optional)>

Note: Splunk Web does not support passwords, so you must remove the password from the private key. For more information, see "Get certificates signed by a third party for Splunk Web."

Securing distributed search heads and peers
Use Splunk Enterprise to audit your system activity

This documentation applies to the following versions of Splunk® Enterprise: 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, 6.0.7, 6.0.8, 6.0.9, 6.0.10, 6.0.11, 6.0.12, 6.0.13, 6.0.14, 6.0.15, 6.1, 6.1.1, 6.1.2, 6.1.3, 6.1.4, 6.1.5, 6.1.6, 6.1.7, 6.1.8, 6.1.9, 6.1.10, 6.1.11, 6.1.12, 6.1.13, 6.1.14, 6.2.0, 6.2.1, 6.2.2, 6.2.3, 6.2.4, 6.2.5, 6.2.6, 6.2.7, 6.2.8, 6.2.9, 6.2.10, 6.2.11, 6.2.12, 6.2.13, 6.2.14, 6.2.15, 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.3.8, 6.3.9, 6.3.10, 6.3.11, 6.3.12, 6.3.13, 6.3.14


per doc Secure your deployment server and clients using certificate authentication:
can we use the same certs for splunkd as for splunk web or does the splunkd cert have to contain the password in the private key?

July 21, 2016

Can we clarify this statement? I don't believe SSL is enabled out of the box for Deployment server:

"SSL encryption using the default certificates, which is enabled out-of-the-box, is strongly recommended as the minimum for any data communicated over the management port."

May 30, 2016

caCertPath is very confusing attribute name for web server's certificate.

Myana, Splunker
March 30, 2016

Additional comments: We recommend the default as a minimum, and I've tweaked the language to make that a bit more clear.

Configuring this can be complicated, so for certain configurations that are all behind firewalls and don't have a security expert, the default is better than no ssl. Obviously the preferred option is to use unique certificates.

As to your second question, I can't really speak to any future development, but I am certainly a big advocate for such improvements and will continue to be so :)

Jworthington splunk, Splunker
August 18, 2015

From this snippet of instruction: "SSL encryption using the default certificates, which is enabled out-of-the-box, is strongly recommended for any data communicated over the management port."

Is this statement saying that Splunk is strongly recommending users use the default 1024-bit CA and certificate for command and control of all the SplunkForwarders within an enterprise? As every Splunk installation has the CA's public and private keypair this seems like a less than ideal idea as anyone else who can download Splunk could impersonate the distributed manager?

Or is the recommendation from Splunk that certificates be used (whether Splunk's or ideally a stronger set of certificates) to assist in preventing arbitrary access to the listeners?

Is Splunk at some point going to upgrade the default certs to more that 1024-bits and/or provide a mechanism to manage certificates within a Splunk installation without having the private key of the CA shared with the world?

August 18, 2015

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters