Configure SSL and TLS protocol version support for secure connections between Splunk platform instances
You can control the individual versions of SSL or TLS protocol that Splunk Enterprise is to support for secure communications between Splunk platform instances. You perform this configuration using the sslVersions
setting in various configuration files.
You can use the setting to restrict or support older versions of protocols. When you configure the sslVersions
setting in a configuration file, Splunk Enterprise either makes or accepts connections using the protocol versions you specify. Both the instance that makes the connection and the instance that receives the connection must support the same protocol versions.
You must always configure this setting in a configuration file. It's not possible to perform this configuration in Splunk Web.
Supported SSL and TLS protocol versions
The Splunk platform supports the following SSL and TLS versions:
- SSLv2
- SSLv3
- TLS1.0
- TLS1.1
- TLS1.2
The SSL* protocol versions are not secure because of various exploits that can take advantage of those protocols. Don't use these protocols unless you have no other option. Instead, use the TLS* versions wherever possible. You can use the special tls
value to specify all available TLS versions.
If you enable Federal Information Processing Standards (FIPS) mode on Splunk Enterprise, it isn't possible to use the SSL* protocol versions. Splunk Enterprise won't communicate on these protocols when it is in FIPS mode even if you explicitly specify the protocols.
Configure SSL and TLS protocol version support with the sslVersions setting
The sslVersions
setting controls the SSL and TLS protocols that each Splunk platform instance uses to connect to Other Splunk platform instances securely. The syntax for configuring the setting follows:
Action you want to perform | Syntax | Example |
---|---|---|
Specify a single protocol to support | sslVersions=<protocol>
|
sslVersions=tls1.0
|
Specify a single protocol to restrict | sslVersions=-<protocol>
|
sslVersions=-ssl2
|
Specify multiple protocols to support | sslVersions=<protocol>,<protocol>,...
|
sslVersions=tls1.0,tls1.1
|
Specify one or more protocols to support and one or more to restrict at the same time | sslVersions=<protocol>,-<protocol>,[-]<protocol>,...
|
sslVersions=-ssl2,-ssl3,tls1.0,tls1.1
|
Specify all protocol versions | sslVersions=*
| |
Specify all but one protocol version | sslVersions=*,-<protocol>
|
sslVersions=*,-ssl2
|
Specify all versions of TLS | sslVersions=tls
|
Older versions of Splunk Enterprise and the universal forwarder might not support newer versions of SSL/TLS protocols, and vice versa. As a reminder, each instance in a network connection must support the protocol version you choose for secure connections between those instances to succeed. Confirm that both the connecting instance and the receiving instance support the protocol you want, and that you set the sslVersions
setting on each instance to a value that both instances can use. If you enable FIPS mode on an instance, that instance won't use the SSL protocol versions at all
- Open the configuration file where you want to configure the protocol versions, depending on the instance type and the connection.
- Edit the sslVersions setting. Establish the versions you want to support or restrict by supplying the appropriate values.
- Save the configuration file and close it.
- Restart Splunk Enterprise for the changes to take effect.
Where you configure the sslVersions
setting depends on the kind of communication that the Splunk platform instances are performing. The general procedure follows:
Service or instance performing connection | Configuration file | Notes |
---|---|---|
Splunk Web | web.conf | |
Splunk forwarder | inputs.conf | The setting is available under many stanzas in the inputs.conf file, see the specification file for details on where you can configure the sslVersions setting.
|
Splunk indexer | server.conf | The setting is available under many stanzas in the server.conf file, see the specification file for details on where you can configure the sslVersions setting.
|
Splunkd as a client | server.conf | The sslVersionsForClient setting is used when the Splunk daemon acts as a client, for example, as a deployment client connecting to a deployment server, or as an indexer or search head cluster. In this case, the instance where the splunkd process connects must also be configured to listen over SSL. See the specification file for details on where you can configure the sslVersionsForClient and enableSplunkdSSL settings.
|
Examples for configuring SSL/TLS protocol versions
See the following configuration examples to better understand how to configure SSL and TLS protocol versions between Splunk platform instances.
Example 1: Forwarder and receiver to communication on TLS 1.1
Forwarder, inputs.conf | Receiver, server.conf |
---|---|
[SSL] sslVersions=tls1.1 |
[sslConfig] sslVersions=tls1.1 enableSplunkdSSL=true |
Example 2: Splunk deployment client and deployment server on SSL v3 and all TLS protocols
Deployment client, server.conf | Deployment server, server.conf |
---|---|
[sslConfig] sslVersionsForClient=ssl3,tls |
[sslConfig] sslVersions=ssl3,tls enableSplunkdSSL=true |
About using SSL tools on Windows and Linux | About creating certificates for Splunk |
This documentation applies to the following versions of Splunk® Enterprise: 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6, 7.3.7, 7.3.8, 7.3.9, 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8, 8.0.9, 8.0.10, 8.1.0, 8.1.1, 8.1.2, 8.1.3, 8.1.4, 8.1.5, 8.1.6, 8.1.7, 8.1.8, 8.1.9, 8.1.10, 8.1.11, 8.1.12, 8.1.13, 8.1.14, 8.2.0, 8.2.1, 8.2.2, 8.2.3, 8.2.4, 8.2.5, 8.2.6, 8.2.7, 8.2.8, 8.2.9, 8.2.10, 8.2.11, 8.2.12, 9.0.0, 9.0.1, 9.0.2, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7, 9.0.8, 9.0.9, 9.0.10, 9.1.0, 9.1.1, 9.1.2, 9.1.3, 9.1.4, 9.1.5, 9.1.6, 9.2.0, 9.2.1, 9.2.2, 9.2.3, 9.3.0, 9.3.1
Feedback submitted, thanks!