Secure deployment servers and clients using certificate authentication

There are certain situations where you might need to use certificate authentication in certain distributed configurations. An example is when you send sensitive server configuration data to a variety of locations outside of your protected network through your firewall. You can manually configure each indexer to communicate with your deployment server.

Splunk Web does not support passwords, so you must remove the password from the private key. For more information, see Get certificates signed by a third party for Splunk Web.

The deployment server cannot properly push certificates to peers. You must configure each member separately.

1. Create one or more certificates using the same root certificate authority (CA). To learn how to create a certificate, see Appendix A in this manual.
2. Distribute the certificates to your deployment server and clients.
3. On each deployment client, edit the $SPLUNK_HOME/etc/system/local/server.conf configuration file to provide the location of your certificates.
   

   [sslConfig]
   enableSplunkdSSL = true
   
   sslVersions = tls1.2
   # This is the default (TLS v1.2). It is
   # also the recommended setting.
   
   serverCert =  <full path to the Privacy Enhanced Mail-format server certificate file>
   # The Splunk daemon generates the default certificate
   # ($SPLUNK_HOME/etc/auth/server.pem) when it starts up. To secure
   # your deployment, replace the default certificate with your own certificate
   # file, in PEM format.
   
   sslPassword = password
   # The password for the server certificate, if it exists.
   
   sslRootCAPath = <full path to the operating system root CA certificate>
   # This is a PEM format file that contains one or more root CAs.
   # Do not configure this setting on Windows.
   

4. Add the requireClientCert setting under the [sslConfig] stanza to force the deployment clients to authenticate using your certificates:
   

   requireClientCert = true
   

This requireClientCert is set to "false" by default. If you change it to true to force Splunk Enterprise to check your client's certificates, Splunk Web and the CLI will also be checked for certificates.

5. Edit the web.conf configuration file to present a certificate signed by the same root CA so that Splunk Web can connect to the server.
   
   The following is an example of an edited settings stanza:
   

   [settings]
   enableSplunkWebSSL = true
   privKeyPath = etc/auth/splunkweb/mySplunkWebPrivateKey.key
   serverCert = etc/auth/splunkweb/mySplunkWebCertificate.pem
   cipherSuite = <your chosen cipher suite (optional)>