Secure Splunk Web with your own certificate

This example assumes that you have already generated self-signed certificates or purchased third-party certificates. If you have not done this and are unsure how to proceed, we've provided some simple examples:

• Self-sign certificates for Splunk Web.
• Get a certificates signed by a third-party for Splunk Web.

Before you begin: make sure your certificate and key are available from your folder. In this example we are using $SPLUNK_HOME/etc/auth/mycerts/:

• $SPLUNK_HOME/etc/auth/mycerts/mySplunkWebCertificate.pem
• $SPLUNK_HOME/etc/auth/mycerts/mySplunkWebPrivateKey.key

Configure Splunk Web to use the key and certificate files

Perform the following steps to configure Splunk Web to use the key and certificate files.

Prerequisites

• Only users with file system access, such as system administrators, can configure Splunk Web to use the key and certificate files using configuration files.
• Review the steps in How to edit a configuration file in the Splunk Enterprise Admin Manual.
• You can have configuration files with the same name in your default, local, and app directories. Read Where you can place (or find) your modified configuration files in the Splunk Enterprise Admin Manual.

Never change or copy the configuration files in the default directory. The files in the default directory must remain intact and in their original location. Make changes to the files in the local directory.

1. Open or create a local web.conf file for the Search app in $SPLUNK_HOME/etc/system/local/web.conf, or in any other application location if you're using a deployment server.
2. Under the [settings] stanza, configure the path to the file containing the web server SSL certificate private key and the path to the PEM format Splunk web server certificate file.
   The following example shows an edited settings stanza:

   [settings]
   enableSplunkWebSSL = true
   privKeyPath = </home/etc/auth/mycerts/mySplunkWebPrivateKey.key > 
   Absolute paths may be used. Non-absolute paths are relative to $SPLUNK_HOME.
   
   serverCert = </home/etc/auth/mycerts/mySplunkWebCertificate.pem > 
   Absolute paths may be used. Non-absolute paths are relative to $SPLUNK_HOME.
   

3. Restart your Splunk software:
   # $SPLUNK_HOME/bin/splunk restart splunkd