Security

'Configure Splunk forwarding to use your own certificates' possible documentation error

jorcabro
Explorer

Hi,

I'm trying to configure Splunk forwarders and indexers to use our own certificates and while checking the documentation (https://docs.splunk.com/Documentation/Splunk/7.2.6/Security/ConfigureSplunkforwardingtousesignedcert...) I've seen the following:

**Configure your forwarders to use your certificates**
...
[tcpout:group1]

server=10.1.1.197:9997

disabled = 0

clientCert = <path> The full path to the client SSL certificate in PEM format. If this value is provided, the connection will use SSL.

useClientSSLCompression = <true> Disabling tls compression can cause bandwidth issues.

**sslPassword = The password for the CAcert**

I don't understand how can the CAcert password needed as this is a private password.
Is this correct? Is the documentation okay? Could someone explain the reason for this?

Thanks.

1 Solution

jorcabro
Explorer

The documentation has been updated and the error has been fixed.

[tcpout:group1]

server=10.1.1.197:9997

disabled = 0

clientCert = <The full path to the client SSL certificate, in PEM format. If this value is provided, the connection will use SSL.>

useClientSSLCompression = true (Disabling TLS compression can cause bandwidth issues.)

sslPassword = <password for the client certificate>

View solution in original post

0 Karma

jorcabro
Explorer

The documentation has been updated and the error has been fixed.

[tcpout:group1]

server=10.1.1.197:9997

disabled = 0

clientCert = <The full path to the client SSL certificate, in PEM format. If this value is provided, the connection will use SSL.>

useClientSSLCompression = true (Disabling TLS compression can cause bandwidth issues.)

sslPassword = <password for the client certificate>
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Passwords keep private certificates private.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...