Splunk® Enterprise

Securing Splunk Enterprise

Splunk Enterprise version 7.2 is no longer supported as of April 30, 2021. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
This documentation does not apply to the most recent version of Splunk® Enterprise. For documentation on the most recent version, go to the latest release.

Self-sign certificates for Splunk Web

On Splunk Enterprise only, you can use the version of OpenSSL that comes with the software to create and self-sign certificates for use with Splunk Web.

There are multiple ways to create signed certificates, depending on the policies of your organization and the tools that you use. If you have already generated these certificates and keys, or if you have experience in obtaining certificates, you can proceed directly to configuring them for Splunk Web. See Secure Splunk Web with your own certificate.

Since your organization signs self-signed certificates, they do not appear in browser certificate stores. Because of this, web browsers consider self-signed certificates "untrusted". This produces a warning page to users that access the Splunk Web instance, and some browsers might prevent access to the page.

Self-signed certificates are best for browser-to-Splunk Web communication that happens within an organization or between known entities where you can add your own certificate authority (CA) to all browser certificate stores that will contact Splunk Web. For any other scenario, CA-signed certificates are recommended. See Get certificates signed by a third party for Splunk Web for more information.

Prerequisites

Before you attempt to perform these commands, you must understand what the $SPLUNK_HOME directory means. In this procedure, $SPLUNK_HOME refers to the Splunk Enterprise installation directory.

  • For Windows, the default installation directory is C:\Program Files\splunk.
  • For most *nix platforms, the default installation directory is /opt/splunk.
  • For Mac OS, the default installation directory is /Applications/splunk.

You must also have experience using either a shell prompt (on Unix) or a command prompt or PowerShell window (on Windows.)

Generate a new root certificate to be your Certificate Authority

  1. Create a new directory on your Splunk Enterprise installation to host certificates and keys. For example, $SPLUNK_HOME/etc/auth/mycerts.

    Place your new certificates in a different directory than the default of $SPLUNK_HOME/etc/auth/splunkweb. Doing this prevents you from overwriting existing certificates. This ensures that you can use the certificates that ship with Splunk Enterprise in the $SPLUNK_HOME/etc/auth/splunkweb directory for other Splunk components as necessary.

    If you created a self-signed certificate, you can copy that root certificate into your directory and skip to the next step: Create a new private key for Splunk Web.

  2. Using the OpenSSL binary that comes with your Splunk Enterprise installation, generate a new RSA private key. Splunk Web supports 2048-bit keys, but you can specify larger keys if your browser supports them.
    Unix command Windows command
    $SPLUNK_HOME/bin/splunk cmd openssl genrsa -aes256 -out myCAPrivateKey.key 2048
    $SPLUNK_HOME\bin\splunk cmd openssl genrsa -aes256 -out myCAPrivateKey.key 2048 

    You might need to append the location of the openssl.cnf file on Windows.

  3. When the OpenSSL command prompts you, create a password. After you create the password, the private key file myCAPrivateKey.key appears in your directory. This is your root certificate private key.
  4. Generate a certificate signing request using the root certificate private key myCAPrivateKey.key:
    Unix command Windows command
    $SPLUNK_HOME/bin/splunk cmd openssl req -new -key myCAPrivateKey.key -out myCACertificate.csr
    $SPLUNK_HOME\bin\splunk cmd openssl req -new -key myCAPrivateKey.key -out myCACertificate.csr
  5. Provide the password you created to the private key myCAPrivateKey.key. A new CSR file myCACertificate.csr appears in your directory.
  6. Use the CSR to generate a new root certificate and sign it with your private key:
    Unix command Windows command
    $SPLUNK_HOME/bin/splunk cmd openssl x509 -req -in myCACertificate.csr 
    -signkey myCAPrivateKey.key -out myCACertificate.pem -days 3650
    $SPLUNK_HOME\bin\splunk cmd openssl x509 -req -in myCACertificate.csr 
    -signkey myCAPrivateKey.key -out myCACertificate.pem -days 3650
  7. When the OpenSSL command prompts you, provide for the password to the private key myCAPrivateKey.key. A new certificate myCACertificate.pem appears in your directory. This is your public certificate.

Create a new private key for Splunk Web

  1. Using the OpenSSL binary that comes with your Splunk Enterprise instance, generate a new private key:
    Unix command Windows command
    $SPLUNK_HOME/bin/splunk cmd openssl genrsa -aes256 -out mySplunkWebPrivateKey.key 2048
    $SPLUNK_HOME\bin\splunk cmd openssl genrsa -aes256 -out mySplunkWebPrivateKey.key 2048
  2. When the OpenSSL command prompts you, create a password. After you type in the password, a new key file, mySplunkWebPrivateKey.key appears in your directory.
  3. Remove the password from your key. You must do this because Splunk Web does not support password-protected private keys.
    Unix command Windows command
    $SPLUNK_HOME/bin/splunk cmd openssl rsa -in mySplunkWebPrivateKey.key
     -out mySplunkWebPrivateKey.key
    $SPLUNK_HOME\bin\splunk cmd openssl rsa -in mySplunkWebPrivateKey.key
     -out mySplunkWebPrivateKey.key


    You can verify that your successfully removed the password with the following command. If successful, you can read the contents fo the certificate without having to provide a password:

    Unix command Windows command
    $SPLUNK_HOME/bin/splunk cmd openssl rsa -in mySplunkWebPrivateKey.key -text
    $SPLUNK_HOME\bin\splunk cmd openssl rsa -in mySplunkWebPrivateKey.key -text

Create and sign a server certificate

  1. Create a new certificate signature request using your private keymySplunkWebPrivateKey.key:
    Unix command Windows command
    $SPLUNK_HOME/bin/splunk cmd openssl req -new -key mySplunkWebPrivateKey.key
     -out mySplunkWebCert.csr
    $SPLUNK_HOME\bin\splunk cmd openssl req -new -key mySplunkWebPrivateKey.key
     -out mySplunkWebCert.csr

    The CSR mySplunkWebCert.csr appears in your directory.
  2. Self-sign the CSR with the root certificate private key myCAPrivateKey.key:
    Unix command Windows command
    $SPLUNK_HOME/bin/splunk cmd openssl x509 -req -in mySplunkWebCert.csr -CA myCACertificate.pem 
    -CAkey myCAPrivateKey.key -CAcreateserial -out mySplunkWebCert.pem -days 1095
    $SPLUNK_HOME\bin\splunk cmd openssl x509 -req -in mySplunkWebCert.csr -CA myCACertificate.pem 
    -CAkey myCAPrivateKey.key -CAcreateserial -out mySplunkWebCert.pem -days 1095
  3. When the OpenSSL binary prompts you, provide the password to the root certificate private key myCAPrivateKey.key. The certificate mySplunkWebCert.pem appears in your directory. This is your server certificate.

Combine your server certificate and public certificates into a single privancy-enhanced mail (PEM) format file

Combine your server certificate and the public certificates, in that order, into a single file.

Unix command Windows command
cat mySplunkWebCert.pem myCACertificate.pem > mySplunkWebCertificate.pem
type mySplunkWebCert.pem myCACertificate.pem > mySplunkWebCertificate.pem

Set up certificate chains

To use multiple certificates, append the intermediate certificate to the end of the server's certificate file in the following order:

[ server certificate]
[ intermediate certificate]
[ root certificate (if required) ]

For example, a certificate chain might look like the following:

	
-----BEGIN CERTIFICATE-----
... (certificate for your server)...
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
... (the intermediate certificate)...
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
... (the root certificate for the CA)...
-----END CERTIFICATE-----

Next steps

Now that you have your certificates, you must distribute them and configure splunkd and Splunk Web to use them. See Secure Splunk Web with your own certificate for more information.

Last modified on 13 June, 2022
How to obtain certificates signed by a third-party for inter-Splunk communication   Obtain certificates signed by a third-party for Splunk Web

This documentation applies to the following versions of Splunk® Enterprise: 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6, 7.3.7, 7.3.8, 7.3.9, 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8, 8.0.9, 8.0.10, 8.1.0, 8.1.1, 8.1.2, 8.1.3, 8.1.4, 8.1.5, 8.1.6, 8.1.7, 8.1.8, 8.1.9, 8.1.10, 8.1.11, 8.1.12, 8.1.13, 8.1.14, 8.2.0, 8.2.1, 8.2.2, 8.2.3, 8.2.4, 8.2.5, 8.2.6, 8.2.7, 8.2.8, 8.2.9, 8.2.10, 8.2.11, 8.2.12


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters