Hi, We have setup our Splunk cluster, version 7.3.3 in AWS and seeing that on logging into splunk UI, some of the web elements are not loading - like User id, 'Search and Reporting' App(sometimes) etc. Also when we are performing any search we see that it displays "Cannot get username when all users are selected" Our search heads are behind AWS NLB. Our policies do not support ALB and hence we have to settle with NLB, which at this time do not support Sticky sessions or persistence. I have gone thru some of the Splunk Answers on this similar issue and came to know that this is probably because of missing sticky sessions.  Is this really a missing sticky session issue? If yes, Is there any alternate way to resolve this apart from moving from NLB to ALB? ... View more

Hi All, I want enable mTLS in splunk cluster on all the communication channels. I have peer certificate that works as both server and client. Enabling ssl is successful when I set requiredClientCert = false in web.conf. However when I make requiredClientCert = true I am getting below errors ERROR X509Verify - X509 certificate (CN=myCompanyCN) failed validation; error=19, reason="self signed certificate in certificate chain" WARN SSLCommon - Received fatal SSL3 alert. ssl_state='SSLv3 read client certificate B', alert_description='unknown CA'. WARN HttpListener - Socket error from 127.0.0.1:60580 while idling: error:14089086:SSL routines:ssl3_get_client_certificate:certificate verify failed - please check the output of the `openssl verify` command for the certificates involved; note that if certificate verification is enabled (requireClientCert or sslVerifyServerCert set to "true"), the CA certificate and the server certificate should not have the same Common Name. Here are my conf files server.conf [sslConfig] enableSplunkdSSL = true useClientSSLCompression = true sslVersions = tls1.2 serverCert = $SPLUNK_HOME/etc/auth/mycerts/peer-chain-with-key.pem <=== contains peer cert, key, intermediate certs, root CA cert in this order caCertFile = $SPLUNK_HOME/etc/auth/mycerts/ca-chain.pem sslVerifyServerCert = true requireClientCert = true web.conf # Securing splunk web enableSplunkWebSSL = true privKeyPath = etc/auth/mycerts/peer-key.pem serverCert = etc/auth/mycerts/peer-chain-cert-without-key.pem <==== contains peer cert, int certs & root CA cert in this order sslVersions = tls1.2 requireClientCert = true Any help please ... View more

Hi All, I want to enable SSL for Splunk management port(8089) for securing inter-splunk communications. I have below settings in my Cluster Master server.conf [sslConfig] enableSplunkdSSL = true useClientSSLCompression = true sslVersions = tls1.2 serverCert = $SPLUNK_HOME/etc/auth/mycerts/server-chain-with-key.pem sslRootCAPath = $SPLUNK_HOME/etc/auth/mycerts/ca-chain.pem sslVerifyServerCert = true requireClientCert = true But I see below errors in CM Splunkd.log ERROR X509Verify - X509 certificate (CN=XXXX,OU=YYYY,O=ZZZ..) failed validation; error=26, reason="unsupported certificate purpose" WARN SSLCommon - Received fatal SSL3 alert. ssl_state='SSLv3 read client certificate B', alert_description='unsupported certificate'. WARN HttpListener - Socket error from <indexer_ip>:47154 while idling: error:14089086:SSL routines:ssl3_get_client_certificate:certificate verify failed - please check the output of the `openssl verify` command for the certificates involved; note that if certificate verification is enabled (requireClientCert or sslVerifyServerCert set to "true"), the CA certificate and the server certificate should not have the same Common Name. And I see this in my Indexer splunkd.log WARN SSLCommon - Received fatal SSL3 alert. ssl_state='SSLv3 read server session ticket A', alert_description='unsupported certificate'. Can anyone help me in understanding why I'm seeing this issue? I have gone thru lot of answers and even the 2015 .conf slides, but do not understand why requireClientCert should be made false.I don't see anyone explaining the reason for this. I basically want to enable mutual authentication between CM and indexers on management port and hence made requireClientCert = true. Is mutual TLS supported by Splunk on management port? If yes, how should I provide client certs for mTLS? Thanks in advance ... View more

Hi All, We want to enable ssl in our aws splunk Enterprise cluster on management port 8089 with own certs(provided by my company) I followed all the required steps from various documents and enabled splunkd ssl in server.conf in all splunk components - cm, indexer cluster, sh cluster and deployer How can I verify that the ssl is correctly enabled and is using our own certs? I don't see any errors in any of splunkd logs. But I do not know how to prove that splunk instances are communicating with own certs. Also how is the secure communication happening without client certs? Don't we need both client and server certs in all splunk instances to securely communicate on port 8089(for that matter any port) Any help is highly appreciated ... View more