@Gregski11 , I've been (painfully) working through some of the 'new SSL' processes myself. Unfortunately the documentation is as helpful as I was hoping and in some cases is actually functionally incorrect.  However I have gotten what I believe to be the correct web.conf config done, server.conf is proving to have a few extra gremlins current. What I suspect is happening here is that you're providing the server PEM you got from the CA but what Splunk's looking really wanting here is a  'combined' cert:   https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/HowtoprepareyoursignedcertificatesforSplunk.  I've had to add a little bit more than what the docs call out, probably because I created the CA cert and the server cert on the Splunk instance but here's my web.conf file looks like:   [settings] enableSplunkWebSSL = true sslPassword = $7$7mytLzGbDj/xZXYnAuZCXks/FYVEAi7AqKXHOqezXPBM1qwfsHRPM8Fe privKeyPath = /opt/splunk/etc/auth/mycerts/myServerPrivateKey.key serverCert = /opt/splunk/etc/auth/mycerts/myServerCert.pem sslRootCAPath = /opt/splunk/etc/auth/mycerts/myCertAuthCertificate.pem   tools.sessions.timeout = 8640 Hope it helps!   ... View more

CMSchelin, The CrowdStrike TAs must be deployed locally as opposed to through a deployment server. This is in part because the credentials are stored locally - which is why the work around you attempted did not work.  The API Secret value is stored in the the KV store and is encrypted. This is to prevent the exact scenario that you are attempting to do - simply copy the passwords.conf file over. If that was something that was possible then anyone could pull that file, drop it into a Splunk system and collect your data - attacker, competitor, former employee, etc. The encryption keys from the original Splunk system are what's needed to decrypt that information.   Thanks Tim ... View more

This answer is only for instance up to v7.2.5 - after v7.2.5 the password is SPLUNK-instance ID  per the docs: https://docs.splunk.com/Documentation/Splunk/8.1.0/Admin/AbouttheSplunkAMI : For Splunk version 7.2.5 and above, log into Splunk Enterprise with the credentials: username: admin password: SPLUNK-$instance id$ It is recommended that you change your password after login. For Splunk version below 7.2.5, log into Splunk Enterprise with the credentials: username: admin password: $instance id$ On the next screen, set a new password. ... View more

The CrowdStrike Streaming API TA uses their legacy API creds which use certificate pinning. That error typically means that something is getting in the way of the communication between Splunk and the API endpoint. This is probably something like a proxy. If the proxy is actively proxying that connection then CrowdStrike's API gateway will reject that authentication because it's essentially a MIM attack. You should make sure that you have an exception (whitelist) in any network devices that the connection will traverse so that that doesn't happen. ... View more