Renew existing TLS certificates

TLS certificates in a Splunk platform deployment secure your Splunk platform instances from potential outside attackers. Whether you generate your own certificates or obtain them from a third party, the certificates last for a certain period of time, typically 1 to 3 years, before they expire. Some certificates have shorter or longer validity periods.

When a TLS certificate expires, it isn't valid anymore. It no longer provides the security it did when it was in force. This can have various ramifications depending on how you set up Splunk platform deployment and the types of Splunk platform instances that make the secure connections:

• Instances that use invalid certificates and the instances to which they connect log errors about the invalid certificates, increasing the size of log files on the instances
• Instances can have problems connecting to other instances because of the invalid certificates, which can result in data loss or downtime
• Malicious attackers can use machines to act as legitimate machines and intercept your data and communications, particularly if those instances are on the internet and not behind a firewall

To prevent problems like these, you must renew the TLS certificates on your instances before they expire. The exact process you perform to renew depends on several factors:

• The type of certificate you used to secure your deployment initially.
• The topology of your Splunk platform deployment. File management infrastructure helps deliver updated certificates faster.

If you have previously configured certificates for your infrastructure, the process can be as simple as updating the expiring or expired certificate with the new certificate and reloading the Splunk platform configuration to recognize the certificate. If the new certificates have updated X.509 common names or subject alternative names, you might need to include those updated names in your configurations.

If you use the Splunk Assist service to monitor your Splunk Enterprise deployment, the Certificate Assist component provides a list of all of the certificates that it knows about and when they are due to expire. Splunk platform instances whose certificates expire within a month trigger a Warning status and instances whose certificates expire within a week trigger a Critical status.

How to renew TLS certificates

The process of renewing a certificate is the same as creating a new one.

1. Obtain new certificates.
   1. You can get a signed certificate from a third party. See How to obtain certificates from a third party for inter-Splunk communication.
   2. Or, you can generate and sign your own. See How to create and sign your own TLS certificates.
2. Prepare the certificates for use on the Splunk platform. See How to prepare TLS certificates for use with the Splunk platform.
3. Install the certificates on each instance, replacing the old certificates. Where you install the certificates depends on your existing certificate configuration. To replace the existing certificates, the new certificates must have the same file names.
4. (Optional) Configure the Splunk instance to use the certificates. You might need to change the configuration if certain elements of the certificates, such as their X.509 common names or subject alternative names have changed.
5. Use a shell or command prompt to reload the configuration on the instance. See the table after this procedure to determine the command to use.

You can also restart the instance to enable the new certificate by entering the following command: ./splunk restart.

Instance type	Reload command
Indexer	curl -u <username>:<password> -X POST https://<url of indexer>:<port>/services/cluster/config/_reload -d reload_replication_port=true
Search head	curl -u <username>:<password> -X POST https://<url of search head>:<port>/services/shcluster/config/_reload -d reload_replication_port=true
Forwarder (any type)	curl -u <username>:<password> https://<url of forwarder>:<port>/services/data/outputs/tcp/default/_reload

In these examples, <username> and <password> are the credentials for the instance and <port> is the management port of the instance that you use.

By default, Windows does not include the curl web transfer tool. You can download the tool from the curl website.

Get help on renewing your TLS certificates

If you need help with renewing your certificates, see the following suggestions:

• The Splunk Support team can help if you have an entitlement with Splunk.
• For larger, more complex deployments, you can use the Professional Services group for assistance.
• If you don't have a Splunk entitlement, you can post a question on the Splunk Answers community.
• The Splunk community in Slack is a good place to receive guidance.