Splunk® Enterprise

Securing Splunk Enterprise

Splunk Enterprise version 9.0 will no longer be supported as of June 14, 2024. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
This documentation does not apply to the most recent version of Splunk® Enterprise. For documentation on the most recent version, go to the latest release.

Renew existing certificates

TLS certificates in a Splunk platform deployment secure your Splunk platform instances from potential outside attackers. Whether you generate your own certificates or obtain them from a third party, the certificates last for a certain period of time, typically 3 to 5 years, before they expire.

When a TLS certificate expires, it isn't valid anymore. It no longer provides the security it did when it was in force. This can have various ramifications depending on how you set up Splunk platform deployment and the types of Splunk platform instances that make the secure connections:

  • Instances that use invalid certificates and the instances to which they connect log errors about the invalid certificates, increasing the size of log files on the instances
  • Instances can have problems connecting to other instances because of the invalid certificates, which can result in data loss
  • Malicious attackers can use machines to act as legitimate machines and intercept your data and communications, particularly if those instances are on the internet and not behind a firewall

To prevent problems like these, you must renew the TLS certificates on your instances before they expire.

If you use the Splunk Assist service, the Certificate Assist component provides a list of all of the certificates that it knows about and when they are due to expire. Splunk platform instances whose certificates expire within a month trigger a Warning status and instances whose certificates expire within a week trigger a Critical status.

How to renew TLS certificates

The process of renewing a certificate is the same as creating a new one.

  1. Obtain a signed certificate from a third party certificate authority, or generate and sign your own.
  2. Install the certificate on each instance, replacing the old certificate.
  3. Configure and use the certificate.
  4. Restart the instance so that it recognizes the updated certificate.

The exact process you perform to renew depends on several factors:

  • The type of certificate you used to secure your deployment initially.
  • The topology of your Splunk platform deployment. File management infrastructure helps deliver updated certificates faster.

If you have previously configured certificates for your infrastructure, the process can be as simple as updating the expiring or expired certificate with the new certificate and restarting the Splunk platform instance to recognize the certificate. If the new certificates have updated X.509 common names or subject alternate names, you might need to include those updated names in your configurations.

Get help on renewing your TLS certificates

If you need help with renewing your certificates, see the following suggestions:

  • The Splunk Support team can help if you have an entitlement with Splunk.
  • For larger, more complex deployments, you can use the Professional Services group for assistance.
  • If you don't have a Splunk entitlement, you can post a question on the Splunk Answers community.
  • The Splunk community in Slack is a good place to receive help.
Last modified on 28 February, 2023
Test and troubleshoot TLS connections   Configure TLS certificate host name validation for secured connections between Splunk software components

This documentation applies to the following versions of Splunk® Enterprise: 9.0.0, 9.0.1, 9.0.2, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7, 9.0.8, 9.0.9, 9.0.10


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters