Self-sign certificates for Splunk Web
On Splunk Enterprise only, you can use the version of OpenSSL that comes with the software to create and self-sign certificates for use with Splunk Web.
There are multiple ways to create signed certificates, depending on the policies of your organization and the tools that you use. If you have already generated these certificates and keys, or if you have experience in obtaining certificates, you can proceed directly to configuring them for Splunk Web. See Secure Splunk Web with your own certificate.
Since your organization signs self-signed certificates, they do not appear in browser certificate stores. Because of this, web browsers consider self-signed certificates "untrusted". This produces a warning page to users that access the Splunk Web instance, and some browsers might prevent access to the page.
Self-signed certificates are best for browser-to-Splunk Web communication that happens within an organization or between known entities where you can add your own certificate authority (CA) to all browser certificate stores that will contact Splunk Web. For any other scenario, CA-signed certificates are recommended. See Get certificates signed by a third party for Splunk Web for more information.
Prerequisites
Before you attempt to perform these commands, you must understand what the $SPLUNK_HOME
directory means. In this procedure, $SPLUNK_HOME
refers to the Splunk Enterprise installation directory.
- For Windows, the default installation directory is
C:\Program Files\splunk
. - For most *nix platforms, the default installation directory is
/opt/splunk
. - For Mac OS, the default installation directory is
/Applications/splunk
.
You must also have experience using either a shell prompt (on Unix) or a command prompt or PowerShell window (on Windows.)
Generate a new root certificate to be your Certificate Authority
- Create a new directory on your Splunk Enterprise installation to host certificates and keys. For example,
$SPLUNK_HOME/etc/auth/mycerts
.
Place your new certificates in a different directory than the default of
$SPLUNK_HOME/etc/auth/splunkweb
. Doing this prevents you from overwriting existing certificates. This ensures that you can use the certificates that ship with Splunk Enterprise in the$SPLUNK_HOME/etc/auth/splunkweb
directory for other Splunk components as necessary.
If you created a self-signed certificate, you can copy that root certificate into your directory and skip to the next step: Create a new private key for Splunk Web. - Using the OpenSSL binary that comes with your Splunk Enterprise installation, generate a new RSA private key. Splunk Web supports 2048-bit keys, but you can specify larger keys if your browser supports them.
Unix command Windows command $SPLUNK_HOME/bin/splunk cmd openssl genrsa -aes256 -out myCAPrivateKey.key 2048
$SPLUNK_HOME\bin\splunk cmd openssl genrsa -aes256 -out myCAPrivateKey.key 2048
You might need to append the location of the
openssl.cnf
file on Windows. - When the OpenSSL command prompts you, create a password. After you create the password, the private key file
myCAPrivateKey.key
appears in your directory. This is your root certificate private key. - Generate a certificate signing request using the root certificate private key
myCAPrivateKey.key
:
Unix command Windows command $SPLUNK_HOME/bin/splunk cmd openssl req -new -key myCAPrivateKey.key -out myCACertificate.csr
$SPLUNK_HOME\bin\splunk cmd openssl req -new -key myCAPrivateKey.key -out myCACertificate.csr
- Provide the password you created to the private key
myCAPrivateKey.key
. A new CSR filemyCACertificate.csr
appears in your directory. - Use the CSR to generate a new root certificate and sign it with your private key:
Unix command Windows command $SPLUNK_HOME/bin/splunk cmd openssl x509 -req -in myCACertificate.csr -signkey myCAPrivateKey.key -out myCACertificate.pem -days 3650
$SPLUNK_HOME\bin\splunk cmd openssl x509 -req -in myCACertificate.csr -signkey myCAPrivateKey.key -out myCACertificate.pem -days 3650
- When the OpenSSL command prompts you, provide for the password to the private key
myCAPrivateKey.key
. A new certificatemyCACertificate.pem
appears in your directory. This is your public certificate.
Create a new private key for Splunk Web
- Using the OpenSSL binary that comes with your Splunk Enterprise instance, generate a new private key:
Unix command Windows command $SPLUNK_HOME/bin/splunk cmd openssl genrsa -aes256 -out mySplunkWebPrivateKey.key 2048
$SPLUNK_HOME\bin\splunk cmd openssl genrsa -aes256 -out mySplunkWebPrivateKey.key 2048
- When the OpenSSL command prompts you, create a password. After you type in the password, a new key file,
mySplunkWebPrivateKey.key
appears in your directory. - Remove the password from your key. You must do this because Splunk Web does not support password-protected private keys.
Unix command Windows command $SPLUNK_HOME/bin/splunk cmd openssl rsa -in mySplunkWebPrivateKey.key -out mySplunkWebPrivateKey.key
$SPLUNK_HOME\bin\splunk cmd openssl rsa -in mySplunkWebPrivateKey.key -out mySplunkWebPrivateKey.key
You can verify that your successfully removed the password with the following command. If successful, you can read the contents fo the certificate without having to provide a password:Unix command Windows command $SPLUNK_HOME/bin/splunk cmd openssl rsa -in mySplunkWebPrivateKey.key -text
$SPLUNK_HOME\bin\splunk cmd openssl rsa -in mySplunkWebPrivateKey.key -text
Create and sign a server certificate
- Create a new certificate signature request using your private key
mySplunkWebPrivateKey.key
:Unix command Windows command $SPLUNK_HOME/bin/splunk cmd openssl req -new -key mySplunkWebPrivateKey.key -out mySplunkWebCert.csr
$SPLUNK_HOME\bin\splunk cmd openssl req -new -key mySplunkWebPrivateKey.key -out mySplunkWebCert.csr
The CSRmySplunkWebCert.csr
appears in your directory. - Self-sign the CSR with the root certificate private key
myCAPrivateKey.key
:Unix command Windows command $SPLUNK_HOME/bin/splunk cmd openssl x509 -req -in mySplunkWebCert.csr -CA myCACertificate.pem -CAkey myCAPrivateKey.key -CAcreateserial -out mySplunkWebCert.pem -days 1095
$SPLUNK_HOME\bin\splunk cmd openssl x509 -req -in mySplunkWebCert.csr -CA myCACertificate.pem -CAkey myCAPrivateKey.key -CAcreateserial -out mySplunkWebCert.pem -days 1095
- When the OpenSSL binary prompts you, provide the password to the root certificate private key
myCAPrivateKey.key
. The certificatemySplunkWebCert.pem
appears in your directory. This is your server certificate.
Combine your server certificate and public certificates into a single privancy-enhanced mail (PEM) format file
Combine your server certificate and the public certificates, in that order, into a single file.
Unix command | Windows command |
---|---|
cat mySplunkWebCert.pem myCACertificate.pem > mySplunkWebCertificate.pem |
type mySplunkWebCert.pem myCACertificate.pem > mySplunkWebCertificate.pem |
Set up certificate chains
To use multiple certificates, append the intermediate certificate to the end of the server's certificate file in the following order:
[ server certificate] [ intermediate certificate] [ root certificate (if required) ]
For example, a certificate chain might look like the following:
-----BEGIN CERTIFICATE----- ... (certificate for your server)... -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- ... (the intermediate certificate)... -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- ... (the root certificate for the CA)... -----END CERTIFICATE-----
Next steps
Now that you have your certificates, you must distribute them and configure splunkd and Splunk Web to use them. See Secure Splunk Web with your own certificate for more information.
How to obtain certificates signed by a third-party for inter-Splunk communication | Obtain certificates signed by a third-party for Splunk Web |
This documentation applies to the following versions of Splunk® Enterprise: 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6, 7.3.7, 7.3.8, 7.3.9, 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8, 8.0.9, 8.0.10, 8.1.0, 8.1.1, 8.1.2, 8.1.3, 8.1.4, 8.1.5, 8.1.6, 8.1.7, 8.1.8, 8.1.9, 8.1.10, 8.1.11, 8.1.12, 8.1.13, 8.1.14, 8.2.0, 8.2.1, 8.2.2, 8.2.3, 8.2.4, 8.2.5, 8.2.6, 8.2.7, 8.2.8, 8.2.9, 8.2.10, 8.2.11, 8.2.12
Feedback submitted, thanks!