How to self-sign certificates
This topic describes one way you can use OpenSSL to self-sign certificates for securing forwarder-to-indexer and Inter-Splunk communication.
If you already possess or know how to generate the needed certificates, you can skip this topic and go directly to the configuration steps, described later in this manual:
- How to prepare your signed certificates for Splunk
- Configure Splunk forwarding to use your own certificates
- About securing inter-Splunk communication
Self-signed certificates are best for data communication that occurs within an organization or between known entities. If you communicate with unknown entities, we recommend CA-signed certificates to secure your data.
Before you begin
In this discussion,
$SPLUNK_HOME refers to the Splunk Enterprise installation directory:
- For Windows, Splunk software is installed in
C:\Program Files\splunkby default
- For most Unix platforms, the default installation directory is at
- For Mac OS, it is
See the Administration Guide to learn more about working with Windows and *nix.
Create a new directory for your certificates
Create a new directory to work from when creating your certificates. In our example, we are using
# mkdir $SPLUNK_HOME/etc/auth/mycerts # cd $SPLUNK_HOME/etc/auth/mycerts
This ensures you do not overwrite the Splunk-provided certificates that reside in
Create the root certificate
First you create a root certificate that serves as your root certificate authority. You use this root CA to sign the server certificates that you generate and distribute to your Splunk instances.
Generate a private key for your root certificate
1. Create a key to sign your certificates.
$SPLUNK_HOME/bin/splunk cmd openssl genrsa -aes256 -out myCAPrivateKey.key 2048
$SPLUNK_HOME\bin\splunk cmd openssl genrsa -aes256 -out myCAPrivateKey.key 2048
2. When prompted, create a password for the key.
When the step is completed, the private key
myCAPrivateKey.key appears in your directory.
Generate and sign the certificate
1. Generate a new Certificate Signing Request (CSR):
$SPLUNK_HOME/bin/splunk cmd openssl req -new -key myCAPrivateKey.key -out myCACertificate.csr
$SPLUNK_HOME\bin\splunk cmd openssl req -new -key myCAPrivateKey.key -out myCACertificate.csr
2. When prompted, enter the password you created for the private key in
3. Provide the requested certificate information, including the common name if you plan to use common name checking in your configuration.
A new CSR
myCACertificate.csr appears in your directory.
4. Use the CSR
myCACertificate.csr to generate the public certificate:
$SPLUNK_HOME/bin/splunk cmd openssl x509 -req -in myCACertificate.csr -sha512 -signkey myCAPrivateKey.key -CAcreateserial -out myCACertificate.pem -days 1095
$SPLUNK_HOME\bin\splunk cmd openssl x509 -req -in myCACertificate.csr -sha512 -signkey myCAPrivateKey.key -CAcreateserial -out myCACertificate.pem -days 1095
5. When prompted, enter the password for the private key
A new file
myCACertificate.pem appears in your directory. This is the public CA certificate that you will distribute to your Splunk instances.
Create the server certificate
Now that you have created a root certificate to serve as your CA, you must create and sign your server certificate.
A note about common name checking
This topic shows you how to create a new private key and server certificate.
You can distribute this server certificate to all forwarders, indexers as well your Splunk instances that communicate on the management port. If you plan to use a different common name for each instance, you simply repeat the process described here to create different certificates (each with a different common name) for your Splunk instances.
For example, if configuring multiple forwarders, you can use the following example to create the certificate
myServerCertificate.pem for your indexer, then create another certificate
myForwarderCertificate.pem using the same root CA and install that certificate on your forwarder. Note that an indexer will only accept a properly generated and configured certificate from a forwarder that is signed by the same root CA.
See Configure Splunk forwarding to use your own certificates for more information about configuring your forwarders and indexers.
Generate a key for your server certificate
1. Generate a new RSA private key for your server certificate. In this example we are again using AES encryption and a 2048 bit key length:
$SPLUNK_HOME/bin/splunk cmd openssl genrsa -aes256 -out myServerPrivateKey.key 2048
$SPLUNK_HOME\bin\splunk cmd openssl genrsa -aes256 -out myServerPrivateKey.key 2048
2. When prompted, create a new password for your key.
A new key
myServerPrivateKey.key is created. You will use this key to encrypt the outgoing data on any Splunk Software instance where you install it as part of the server certificate.
Generate and sign a new server certificate
1. Use your new server private key
myServerPrivateKey.key to generate a CSR for your server certificate.
$SPLUNK_HOME/bin/splunk cmd openssl req -new -key myServerPrivateKey.key -out myServerCertificate.csr
$SPLUNK_HOME\bin\splunk cmd openssl req -new -key myServerPrivateKey.key -out myServerCertificate.csr
2. When prompted, provide the password to the private key
3. Provide the requested information for your certificate, including a Common Name if you plan to configure Splunk Software to authenticate via common-name checking.
A new CSR
myServerCertificate.csr appears in your directory.
4. Use the CSR
myServerCertificate.csr and your CA certificate and private key to generate a server certificate.
$SPLUNK_HOME/bin/splunk cmd openssl x509 -req -in myServerCertificate.csr -SHA256 -CA myCACertificate.pem -CAkey myCAPrivateKey.key -CAcreateserial -out myServerCertificate.pem -days 1095
$SPLUNK_HOME\bin\splunk cmd openssl x509 -req -in myServerCertificate.csr -SHA256 -CA myCACertificate.pem -CAkey myCAPrivateKey.key -CAcreateserial -out myServerCertificate.pem -days 1095
5. When prompted, provide the password for the certificate authority private key
myCAPrivateKey.key. Make sure to sign this with your private key and not the server key you just created.
A new public server certificate
myServerCertificate.pem appears in your directory.
You should now have the following files in the directory you created, which is everything you need to configure indexers, forwarders, and Splunk instances that communicate over the management port:
Now that you have the certificates you need, prepare your server certificate (including appending any intermediate certificates), and then configure Splunk to find and use them:
- See How to prepare your signed certificates for Splunk to learn how to set up your certificates to work with Splunk.
- See Configure Splunk forwarding to use your own certificates to learn more about configuring certificate authentication for forwarding.
- See About securing inter-Splunk communication to learn more about configuring certificate authentication for Splunk to Splunk communications.
Avoid malicious CSV files in searches
How to get certificates signed by a third-party
This documentation applies to the following versions of Splunk® Enterprise: 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, 6.0.7, 6.0.8, 6.0.9, 6.0.10, 6.0.11, 6.0.12, 6.0.13, 6.0.14, 6.0.15, 6.1, 6.1.1, 6.1.2, 6.1.3, 6.1.4, 6.1.5, 6.1.6, 6.1.7, 6.1.8, 6.1.9, 6.1.10, 6.1.11, 6.1.12, 6.1.13, 6.1.14, 6.2.0, 6.2.1, 6.2.2, 6.2.3, 6.2.4, 6.2.5, 6.2.6, 6.2.7, 6.2.8, 6.2.9, 6.2.10, 6.2.11, 6.2.12, 6.2.13, 6.2.14, 6.2.15, 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.3.8, 6.3.9, 6.3.10, 6.3.11, 6.3.12, 6.3.13, 6.3.14, 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.4.4, 6.4.5, 6.4.6, 6.4.7, 6.4.8, 6.4.9, 6.4.10, 6.4.11, 6.5.0, 6.5.1, 6.5.1612 (Splunk Cloud only), 6.5.2, 6.5.3, 6.5.4, 6.5.5, 6.5.6, 6.5.7, 6.5.8, 6.5.9, 6.5.10, 6.6.0, 6.6.1, 6.6.2, 6.6.3, 6.6.4, 6.6.5, 6.6.6, 6.6.7, 6.6.8, 6.6.9, 6.6.10, 6.6.11, 6.6.12, 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.3.0, 7.3.1, 7.3.2, 8.0.0