Self-sign certificates for Splunk Web

On Splunk Enterprise only, you can use the version of OpenSSL that comes with the software to create and self-sign certificates for use with Splunk Web.

There are multiple ways to create signed certificates, depending on the policies of your organization and the tools that you use. If you have already generated these certificates and keys, or if you have experience in obtaining certificates, you can proceed directly to configuring them for Splunk Web. See Secure Splunk Web with your own certificate.

Since your organization signs self-signed certificates, they do not appear in browser certificate stores. Because of this, web browsers consider self-signed certificates "untrusted". This produces a warning page to users that access the Splunk Web instance, and some browsers might prevent access to the page.

Self-signed certificates are best for browser-to-Splunk Web communication that happens within an organization or between known entities where you can add your own certificate authority (CA) to all browser certificate stores that will contact Splunk Web. For any other scenario, CA-signed certificates are recommended. See Get certificates signed by a third party for Splunk Web for more information.

Prerequisites

Before you attempt to perform these commands, you must understand what the $SPLUNK_HOME directory means. In this procedure, $SPLUNK_HOME refers to the Splunk Enterprise installation directory.

• For Windows, the default installation directory is C:\Program Files\splunk.
• For most *nix platforms, the default installation directory is /opt/splunk.
• For Mac OS, the default installation directory is /Applications/splunk.

You must also have experience using either a shell prompt (on Unix) or a command prompt or PowerShell window (on Windows.)

Generate a new root certificate to be your Certificate Authority

1. Create a new directory on your Splunk Enterprise installation to host certificates and keys. For example, $SPLUNK_HOME/etc/auth/mycerts.
   

   Place your new certificates in a different directory than the default of $SPLUNK_HOME/etc/auth/splunkweb. Doing this prevents you from overwriting existing certificates. This ensures that you can use the certificates that ship with Splunk Enterprise in the $SPLUNK_HOME/etc/auth/splunkweb directory for other Splunk components as necessary.
   
   If you created a self-signed certificate, you can copy that root certificate into your directory and skip to the next step: Create a new private key for Splunk Web.

2. Using the OpenSSL binary that comes with your Splunk Enterprise installation, generate a new RSA private key. Splunk Web supports 2048-bit keys, but you can specify larger keys if your browser supports them.
   

   Unix command	Windows command
   $SPLUNK_HOME/bin/splunk cmd openssl genrsa -aes256 -out myCAPrivateKey.key 2048	$SPLUNK_HOME\bin\splunk cmd openssl genrsa -aes256 -out myCAPrivateKey.key 2048 You might need to append the location of the openssl.cnf file on Windows.

3. When the OpenSSL command prompts you, create a password. After you create the password, the private key file myCAPrivateKey.key appears in your directory. This is your root certificate private key.
4. Generate a certificate signing request using the root certificate private key myCAPrivateKey.key:
   

   Unix command	Windows command
   $SPLUNK_HOME/bin/splunk cmd openssl req -new -key myCAPrivateKey.key -out myCACertificate.csr	$SPLUNK_HOME\bin\splunk cmd openssl req -new -key myCAPrivateKey.key -out myCACertificate.csr

5. Provide the password you created to the private key myCAPrivateKey.key. A new CSR file myCACertificate.csr appears in your directory.
6. Use the CSR to generate a new root certificate and sign it with your private key:
   

   Unix command	Windows command
   $SPLUNK_HOME/bin/splunk cmd openssl x509 -req -in myCACertificate.csr -signkey myCAPrivateKey.key -out myCACertificate.pem -days 3650	$SPLUNK_HOME\bin\splunk cmd openssl x509 -req -in myCACertificate.csr -signkey myCAPrivateKey.key -out myCACertificate.pem -days 3650

7. When the OpenSSL command prompts you, provide for the password to the private key myCAPrivateKey.key. A new certificate myCACertificate.pem appears in your directory. This is your public certificate.

Create a new private key for Splunk Web

1. Using the OpenSSL binary that comes with your Splunk Enterprise instance, generate a new private key:

   Unix command	Windows command
   $SPLUNK_HOME/bin/splunk cmd openssl genrsa -aes256 -out mySplunkWebPrivateKey.key 2048	$SPLUNK_HOME\bin\splunk cmd openssl genrsa -aes256 -out mySplunkWebPrivateKey.key 2048

2. When the OpenSSL command prompts you, create a password. After you type in the password, a new key file, mySplunkWebPrivateKey.key appears in your directory.
3. Remove the password from your key. You must do this because Splunk Web does not support password-protected private keys.

   Unix command	Windows command
   $SPLUNK_HOME/bin/splunk cmd openssl rsa -in mySplunkWebPrivateKey.key -out mySplunkWebPrivateKey.key	$SPLUNK_HOME\bin\splunk cmd openssl rsa -in mySplunkWebPrivateKey.key -out mySplunkWebPrivateKey.key

   
   You can verify that your successfully removed the password with the following command. If successful, you can read the contents fo the certificate without having to provide a password:

   Unix command	Windows command
   $SPLUNK_HOME/bin/splunk cmd openssl rsa -in mySplunkWebPrivateKey.key -text	$SPLUNK_HOME\bin\splunk cmd openssl rsa -in mySplunkWebPrivateKey.key -text

Create and sign a server certificate

1. Create a new certificate signature request using your private keymySplunkWebPrivateKey.key:

   Unix command	Windows command
   $SPLUNK_HOME/bin/splunk cmd openssl req -new -key mySplunkWebPrivateKey.key -out mySplunkWebCert.csr	$SPLUNK_HOME\bin\splunk cmd openssl req -new -key mySplunkWebPrivateKey.key -out mySplunkWebCert.csr

   
   The CSR mySplunkWebCert.csr appears in your directory.
2. Self-sign the CSR with the root certificate private key myCAPrivateKey.key:

   Unix command	Windows command
   $SPLUNK_HOME/bin/splunk cmd openssl x509 -req -in mySplunkWebCert.csr -CA myCACertificate.pem -CAkey myCAPrivateKey.key -CAcreateserial -out mySplunkWebCert.pem -days 1095	$SPLUNK_HOME\bin\splunk cmd openssl x509 -req -in mySplunkWebCert.csr -CA myCACertificate.pem -CAkey myCAPrivateKey.key -CAcreateserial -out mySplunkWebCert.pem -days 1095

3. When the OpenSSL binary prompts you, provide the password to the root certificate private key myCAPrivateKey.key. The certificate mySplunkWebCert.pem appears in your directory. This is your server certificate.

Combine your server certificate and public certificates into a single privancy-enhanced mail (PEM) format file

Combine your server certificate and the public certificates, in that order, into a single file.

Unix command	Windows command
cat mySplunkWebCert.pem myCACertificate.pem > mySplunkWebCertificate.pem	type mySplunkWebCert.pem myCACertificate.pem > mySplunkWebCertificate.pem

Set up certificate chains

To use multiple certificates, append the intermediate certificate to the end of the server's certificate file in the following order:

[ server certificate]
[ intermediate certificate]
[ root certificate (if required) ]

For example, a certificate chain might look like the following:

	
-----BEGIN CERTIFICATE-----
... (certificate for your server)...
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
... (the intermediate certificate)...
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
... (the root certificate for the CA)...
-----END CERTIFICATE-----

Next steps

Now that you have your certificates, you must distribute them and configure splunkd and Splunk Web to use them. See Secure Splunk Web with your own certificate for more information.