Configure TLS protocol version support for secure connections between Splunk platform instances

You can control the individual versions of TLS protocol that Splunk Enterprise is to support for secure communications between Splunk platform instances. You perform this configuration using the sslVersions setting in various configuration files.

You can use the setting to restrict or support older versions of protocols. When you configure the sslVersions setting in a configuration file, Splunk Enterprise either makes or accepts connections using the protocol versions you specify. Both the instance that makes the connection and the instance that receives the connection must support the same protocol versions.

You must always configure this setting in a configuration file. It's not possible to perform this configuration in Splunk Web.

Supported SSL and TLS protocol versions

The Splunk platform supports the following SSL and TLS versions:

• SSLv3 (deprecated)
• TLS1.0 (deprecated)
• TLS1.1 (deprecated)
• TLS1.2

Splunk has deprecated the use of version 3.0 of the Secure Sockets Layer (SSL) and versions 1.0 and 1.1 of the transport layer security (TLS) network encryption protocols for version 9.4 and higher of Splunk Enterprise. While these protocols remain supported for the encryption of network traffic between Splunk services such as the Splunk daemon, deployment servers and clients, App Key Value Store (KV store), and forwarders and receivers, Splunk Enterprise will warn you about these deprecated protocols if you use them.

The Internet Engineering Task Force (IETF) deprecated version 3.0 of the SSL protocol in 2015, and the TLS 1.0 and 1.1 protocols in 2021. Splunk will eventually remove these protocols as options to encrypt Splunk network traffic. When possible, configure communication between Splunk clients and services using TLS version 1.2 or higher. This might require that you obtain new certificates for use in your Splunk Enterprise deployment.

If you enable Federal Information Processing Standards (FIPS) mode on Splunk Enterprise, it isn't possible to use any of the SSL* protocol versions. Splunk Enterprise won't communicate on these protocols when it is in FIPS mode, even if you explicitly specify the protocols.

Configure TLS protocol version support with the sslVersions setting

The sslVersions setting controls the TLS protocols that each Splunk platform instance uses to connect to other Splunk platform instances securely. The syntax for configuring the setting follows:

Action you want to perform	Syntax	Example
Specify a single protocol to support	sslVersions=<protocol>	sslVersions=tls1.2
Specify a single protocol to restrict	sslVersions=-<protocol>	sslVersions=-tls1.0
Specify multiple protocols to support	sslVersions=<protocol>,<protocol>,...	sslVersions=tls1.1,tls1.2
Specify one or more protocols to support and one or more to restrict at the same time	sslVersions=<protocol>,-<protocol>,[-]<protocol>,...	sslVersions=-ssl2,-ssl3,tls1.2
Specify all protocol versions	sslVersions=*
Specify all but one protocol version	sslVersions=*,-<protocol>	sslVersions=*,-ssl2
Specify all versions of TLS	sslVersions=tls

Older versions of Splunk Enterprise and the universal forwarder might not support newer versions of TLS protocols, and vice versa. As a reminder, each instance in a network connection must support the protocol version you choose for secure connections between those instances to succeed. Confirm that both the connecting instance and the receiving instance support the protocol you want, and that you set the sslVersions setting on each instance to a value that both instances can use. If you enable FIPS mode on an instance, that instance won't use the SSL protocol versions at all, even if you specific them explicitly

1. Open the configuration file where you want to configure the protocol versions, depending on the instance type and the connection.
2. Edit the sslVersions setting. Establish the versions you want to support or restrict by supplying the appropriate values.
3. Save the configuration file and close it.
4. Restart Splunk Enterprise for the changes to take effect.

Where you configure the sslVersions setting depends on the kind of communication that the Splunk platform instances are performing. The general procedure follows:

Service or instance performing connection	Configuration file	Notes
Splunk Web	web.conf
Splunk forwarder	inputs.conf	The setting is available under many stanzas in the inputs.conf file, see the specification file for details on where you can configure the sslVersions setting.
Splunk indexer	server.conf	The setting is available under many stanzas in the server.conf file, see the specification file for details on where you can configure the sslVersions setting.
Splunkd as a client	server.conf	The sslVersionsForClient setting is used when the Splunk daemon acts as a client, for example, as a deployment client connecting to a deployment server, or as an indexer or search head cluster. In this case, the instance where the splunkd process connects must also be configured to listen over TLS. See the specification file for details on where you can configure the sslVersionsForClient and enableSplunkdSSLsettings.

Examples for configuring TLS protocol versions

See the following configuration examples to better understand how to configure TLS protocol versions between Splunk platform instances.

Example 1: Forwarder and receiver to communication on TLS 1.2

Forwarder, inputs.conf	Receiver, server.conf
[SSL] sslVersions=tls1.2	[sslConfig] sslVersions=tls1.2 enableSplunkdSSL=true

Example 2: Splunk deployment client and deployment server on all TLS protocols

Deployment client, server.conf	Deployment server, server.conf
[sslConfig] sslVersionsForClient=tls	[sslConfig] sslVersions=tls enableSplunkdSSL=true

Splunk Enterprise warns you if you use deprecated protocols.