Configure SSL and TLS protocol version support for secure connections between Splunk platform instances

You can control the individual versions of SSL or TLS protocol that Splunk Enterprise is to support for secure communications between Splunk platform instances. You perform this configuration using the sslVersions setting in various configuration files.

You can use the setting to restrict or support older versions of protocols. When you configure the sslVersions setting in a configuration file, Splunk Enterprise either makes or accepts connections using the protocol versions you specify. Both the instance that makes the connection and the instance that receives the connection must support the same protocol versions.

You must always configure this setting in a configuration file. It's not possible to perform this configuration in Splunk Web.

Supported SSL and TLS protocol versions

The Splunk platform supports the following SSL and TLS versions:

• SSLv2
• SSLv3
• TLS1.0
• TLS1.1
• TLS1.2

The SSL* protocol versions are not secure because of various exploits that can take advantage of those protocols. Don't use these protocols unless you have no other option. Instead, use the TLS* versions wherever possible. You can use the special tls value to specify all available TLS versions. If you enable Federal Information Processing Standards (FIPS) mode on Splunk Enterprise, it isn't possible to use the SSL* protocol versions. Splunk Enterprise won't communicate on these protocols when it is in FIPS mode even if you explicitly specify the protocols.

Configure SSL and TLS protocol version support with the sslVersions setting

The sslVersions setting controls the SSL and TLS protocols that each Splunk platform instance uses to connect to Other Splunk platform instances securely. The syntax for configuring the setting follows:

Action you want to perform	Syntax	Example
Specify a single protocol to support	sslVersions=<protocol>	sslVersions=tls1.0
Specify a single protocol to restrict	sslVersions=-<protocol>	sslVersions=-ssl2
Specify multiple protocols to support	sslVersions=<protocol>,<protocol>,...	sslVersions=tls1.0,tls1.1
Specify one or more protocols to support and one or more to restrict at the same time	sslVersions=<protocol>,-<protocol>,[-]<protocol>,...	sslVersions=-ssl2,-ssl3,tls1.0,tls1.1
Specify all protocol versions	sslVersions=*
Specify all but one protocol version	sslVersions=*,-<protocol>	sslVersions=*,-ssl2
Specify all versions of TLS	sslVersions=tls

Older versions of Splunk Enterprise and the universal forwarder might not support newer versions of SSL/TLS protocols, and vice versa. As a reminder, each instance in a network connection must support the protocol version you choose for secure connections between those instances to succeed. Confirm that both the connecting instance and the receiving instance support the protocol you want, and that you set the sslVersions setting on each instance to a value that both instances can use. If you enable FIPS mode on an instance, that instance won't use the SSL protocol versions at all

1. Open the configuration file where you want to configure the protocol versions, depending on the instance type and the connection.
2. Edit the sslVersions setting. Establish the versions you want to support or restrict by supplying the appropriate values.
3. Save the configuration file and close it.
4. Restart Splunk Enterprise for the changes to take effect.

Where you configure the sslVersions setting depends on the kind of communication that the Splunk platform instances are performing. The general procedure follows:

Service or instance performing connection	Configuration file	Notes
Splunk Web	web.conf
Splunk forwarder	inputs.conf	The setting is available under many stanzas in the inputs.conf file, see the specification file for details on where you can configure the sslVersions setting.
Splunk indexer	server.conf	The setting is available under many stanzas in the server.conf file, see the specification file for details on where you can configure the sslVersions setting.
Splunkd as a client	server.conf	The sslVersionsForClient setting is used when the Splunk daemon acts as a client, for example, as a deployment client connecting to a deployment server, or as an indexer or search head cluster. In this case, the instance where the splunkd process connects must also be configured to listen over SSL. See the specification file for details on where you can configure the sslVersionsForClient and enableSplunkdSSLsettings.

Examples for configuring SSL/TLS protocol versions

See the following configuration examples to better understand how to configure SSL and TLS protocol versions between Splunk platform instances.

Example 1: Forwarder and receiver to communication on TLS 1.1

Forwarder, inputs.conf	Receiver, server.conf
[SSL] sslVersions=tls1.1	[sslConfig] sslVersions=tls1.1 enableSplunkdSSL=true

Example 2: Splunk deployment client and deployment server on SSL v3 and all TLS protocols

Deployment client, server.conf	Deployment server, server.conf
[sslConfig] sslVersionsForClient=ssl3,tls	[sslConfig] sslVersions=ssl3,tls enableSplunkdSSL=true