How to self-sign certificates

About securing data from forwarders

Forwarders send raw data to your indexers. This data can be vulnerable to snooping and corruption. If data is forwarded outside of a closed or co-located network, or if your data is very sensitive you should use SSL certificates to secure your data. Using the default certificates will discourage casual snoopers but could still leave you vulnerable because the root certificate that ships with Splunk software is the same root certificate in every download, and anyone with the same root certificate can authenticate. The default certificates are generated and configured at startup and can be found in $SPLUNK_HOME/etc/auth/.

Important: If you use the default certificates, keep in mind that they are set to expire three years after they are generated and new certificates must be created and configured at that time using one of the methods described in this manual.

For information about setting up SSL with the default certificate, see Configure Splunk forwarding to use the default certificate.

To ensure that no one can easily snoop on your traffic or send data to your indexers, we recommend that you use new signed certificates that are either self-signed or purchased from a third-party certificate authority. To configure your forwarders and indexers to use certificates, see Configure Splunk forwarding to use your own certificates.

There are several ways you can use self or CA-signed certificates to improve security for your forwarder to indexer:

• You can replace the default certificates with certificates signed by your own root CA.
  You replace the default certificate provided by Splunk with one that you generate and sign yourself. For information about generating and self-signing certificates, see How to self-sign certificates.

• You can replace the default certificates with certificates signed by a trusted certificate authority.
  See How to get certificates signed by a third-party.

• You can further strengthen security by configuring common name checking.
  Common name checking adds an extra layer of security by requiring that the common name provided in the certificates on each indexer match the common name specified in the configuration file on the forwarder. You can also configure multiple certificates with different common names and distribute them to your indexers. You enable common name checking when setting up your certificate. See Configure Splunk forwarding to use your own certificates for more information.

How to self-sign certificates

This topic describes one way you can use OpenSSL to self-sign certificates for securing forwarder-to-indexer and Inter-Splunk communication.

If you already possess or know how to generate the needed certificates, you can skip this topic and go directly to the configuration steps, described later in this manual:

• How to prepare your signed certificates for Splunk
• Configure Splunk forwarding to use your own certificates
• About securing inter-Splunk communication

Self-signed certificates are best for data communication that occurs within an organization or between known entities. If you communicate with unknown entities, we recommend CA-signed certificates to secure your data.

Before you begin

In this discussion, $SPLUNK_HOME refers to the Splunk Enterprise installation directory:

• For Windows, Splunk software is installed in C:\Program Files\splunk by default
• For most Unix platforms, the default installation directory is at /opt/splunk
• For Mac OS, it is /Applications/splunk

See the Administration Guide to learn more about working with Windows and *nix.

Create a new directory for your certificates

Create a new directory to work from when creating your certificates. In our example, we are using $SPLUNK_HOME/etc/auth/mycerts:

# mkdir $SPLUNK_HOME/etc/auth/mycerts
# cd $SPLUNK_HOME/etc/auth/mycerts

This ensures you do not overwrite the Splunk-provided certificates that reside in $SPLUNK_HOME/etc/auth.

Create the root certificate

First you create a root certificate that serves as your root certificate authority. You use this root CA to sign the server certificates that you generate and distribute to your Splunk instances.

Generate a private key for your root certificate

1. Create a key to sign your certificates.

In *nix:

$SPLUNK_HOME/bin/splunk cmd openssl genrsa -aes256 -out myCAPrivateKey.key 2048

In Windows:

$SPLUNK_HOME\bin\splunk cmd openssl genrsa -aes256 -out myCAPrivateKey.key 2048 

2. When prompted, create a password for the key.

When the step is completed, the private key myCAPrivateKey.key appears in your directory.

Generate and sign the certificate

1. Generate a new Certificate Signing Request (CSR):

In *nix:

$SPLUNK_HOME/bin/splunk cmd openssl req -new -key myCAPrivateKey.key -out myCACertificate.csr

In Windows:

$SPLUNK_HOME\bin\splunk cmd openssl req -new -key myCAPrivateKey.key -out myCACertificate.csr

2. When prompted, enter the password you created for the private key in $SPLUNK_HOME/etc/auth/mycerts/myCAPrivateKey.key.

3. Provide the requested certificate information, including the common name if you plan to use common name checking in your configuration.

A new CSR myCACertificate.csr appears in your directory.

4. Use the CSR myCACertificate.csr to generate the public certificate:

In *nix:

$SPLUNK_HOME/bin/splunk cmd openssl x509 -req -in myCACertificate.csr -sha512
 -signkey myCAPrivateKey.key -CAcreateserial -out myCACertificate.pem -days 1095

In Windows:

$SPLUNK_HOME\bin\splunk cmd openssl x509 -req -in myCACertificate.csr -sha512
 -signkey myCAPrivateKey.key -CAcreateserial -out myCACertificate.pem -days 1095

5. When prompted, enter the password for the private key myCAPrivateKey.key.

A new file myCACertificate.pem appears in your directory. This is the public CA certificate that you will distribute to your Splunk instances.

Create the server certificate

Now that you have created a root certificate to serve as your CA, you must create and sign your server certificate.

A note about common name checking

This topic shows you how to create a new private key and server certificate.

You can distribute this server certificate to all forwarders, indexers as well your Splunk instances that communicate on the management port. If you plan to use a different common name for each instance, you simply repeat the process described here to create different certificates (each with a different common name) for your Splunk instances.

For example, if configuring multiple forwarders, you can use the following example to create the certificate myServerCertificate.pem for your indexer, then create another certificate myForwarderCertificate.pem using the same root CA and install that certificate on your forwarder. Note that an indexer will only accept a properly generated and configured certificate from a forwarder that is signed by the same root CA.

See Configure Splunk forwarding to use your own certificates for more information about configuring your forwarders and indexers.

Generate a key for your server certificate

1. Generate a new RSA private key for your server certificate. In this example we are again using AES encryption and a 2048 bit key length:

In *nix:

$SPLUNK_HOME/bin/splunk cmd openssl genrsa -aes256 -out myServerPrivateKey.key 2048

In Windows:

$SPLUNK_HOME\bin\splunk cmd openssl genrsa -aes256 -out myServerPrivateKey.key 2048

2. When prompted, create a new password for your key.

A new key myServerPrivateKey.key is created. You will use this key to encrypt the outgoing data on any Splunk Software instance where you install it as part of the server certificate.

Generate and sign a new server certificate

1. Use your new server private key myServerPrivateKey.key to generate a CSR for your server certificate.

In *nix:

$SPLUNK_HOME/bin/splunk cmd openssl req -new -key 
myServerPrivateKey.key -out myServerCertificate.csr

In Windows:

$SPLUNK_HOME\bin\splunk cmd openssl req -new -key 
myServerPrivateKey.key -out myServerCertificate.csr

2. When prompted, provide the password to the private key myServerPrivateKey.key.

3. Provide the requested information for your certificate, including a Common Name if you plan to configure Splunk Software to authenticate via common-name checking.

A new CSR myServerCertificate.csr appears in your directory.

4. Use the CSR myServerCertificate.csr and your CA certificate and private key to generate a server certificate.

In *nix:

$SPLUNK_HOME/bin/splunk cmd openssl x509 -req -in 
myServerCertificate.csr -SHA256 -CA myCACertificate.pem -CAkey myCAPrivateKey.key 
-CAcreateserial -out myServerCertificate.pem -days 1095

In Windows:

$SPLUNK_HOME\bin\splunk cmd openssl x509 -req -in 
myServerCertificate.csr -SHA256 -CA myCACertificate.pem -CAkey myCAPrivateKey.key 
-CAcreateserial -out myServerCertificate.pem -days 1095

5. When prompted, provide the password for the certificate authority private key myCAPrivateKey.key. Make sure to sign this with your private key and not the server key you just created.

A new public server certificate myServerCertificate.pem appears in your directory.

Next steps

You should now have the following files in the directory you created, which is everything you need to configure indexers, forwarders, and Splunk instances that communicate over the management port:

• myServerCertificate.pem
• myServerPrivateKey.key
• myCACertificate.pem

Now that you have the certificates you need, prepare your server certificate (including appending any intermediate certificates), and then configure Splunk to find and use them:

• See How to prepare your signed certificates for Splunk to learn how to set up your certificates to work with Splunk.
• See Configure Splunk forwarding to use your own certificates to learn more about configuring certificate authentication for forwarding.
• See About securing inter-Splunk communication to learn more about configuring certificate authentication for Splunk to Splunk communications.