Things to know about your certificates

Make sure you are using a compatible version of OpenSSL

Make sure that you are using the version of OpenSSL provided with Splunk by setting your environment to the version in $SPLUNK_HOME/lib in *nix or $SPLUNK_HOME/bin in Windows.

Decide between self-signed or third-party certificates

Self-signed certificates are best used for browser to Splunk Web communication that happens within an organization or between known entities where you can add your own CA to all browser stores that will contact Splunk Web. For any other scenario, CA-signed certificates are recommended. See "Get certificates signed by a third party for Splunk Web" for more information.

Remove your password from browser certificates

When you create a new private key for Splunk Web, you must generate a new private key and remove the password. We recommend that you generate a new private key espcially for browser to Splunk Web encryption so that you do not remove the password from the keys you use elsewhere.

1. Generate a new private key:

2. When prompted, create a password.

3. Remove the password from your key. (Splunk Web does not currently support password-protected private keys.)

In *nix:

$SPLUNK_HOME/bin/splunk cmd openssl rsa -in mySplunkWebPrivateKey.key -out mySplunkWebPrivateKey.key

In Windows:

$SPLUNK_HOME\bin\splunk cmd openssl rsa -in mySplunkWebPrivateKey.key -out mySplunkWebPrivateKey.key

You can make sure your password is gone by issuing the following command:

In *nix:

$SPLUNK_HOME/bin/splunk cmd openssl rsa -in mySplunkWebPrivateKey.key -text

In Windows:

$SPLUNK_HOME\bin\splunk cmd openssl rsa -in mySplunkWebPrivateKey.key -text

You should be able to read the contents of your certificate without providing a password.

Create a single PEM file for Splunk

Combine your server certificate and public certificates, in that order, into a single PEM file.

Set up certificate chains for Splunk

To use multiple certificates, append the intermediate certificate to the end of the server's certificate file in the following order:

[ server certificate]
[ intermediate certificate]
[ root certificate (if required) ]

So for example, a certificate chain might look like this:

	
-----BEGIN CERTIFICATE-----
... (certificate for your server)...
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
... (the intermediate certificate)...
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
... (the root certificate for the CA)...
-----END CERTIFICATE-----