Applicability

Description

Bear in mind that changing the path to the certificates or the name of them will be required.

a. To check the OpenSSL version that is installed in Splunk run the following command:

$SPLUNK_HOME/bin/splunk cmd openssl version

b. Cipher suites are available based on the version of OpenSSL that is installed.  To find out the ciphers that are supported/installed run this command:

$SPLUNK_HOME/bin/splunk cmd openssl ciphers -v

c. The OpenSSL utility that comes with Splunk software allows to randomly generate a passphrase that can then be used to set pass4SymmKey on all nodes of the Splunk deployment.  To generate a random password run the following command:

$SPLUNK_HOME/bin/splunk cmd openssl rand -base64 9

d. To check that the MD5 hash of the public key matches with what is in a CSR or private key.  Run the following two commands:
    d.1- Run this command against the certificate in PEM format:

$SPLUNK_HOME/bin/splunk cmd openssl x509 -noout -modulus -in /path/to/the/server.pem | /opt/splunk/bin/splunk cmd openssl md5

    d.2- Run this command against the private key:

$SPLUNK_HOME/bin/splunk cmd openssl rsa -noout -modulus -in /path/to/the/PrivateKey.key | /opt/splunk/bin/splunk cmd openssl md5

e. After setting up SSL in Splunk, the user may want to test the certificates.  A good certificate will return the following code Verify return code: 0 (ok).  Please run the following two commands:
    e.1- Run the following command in the server.  Port 21524 was used in this case, but different port can be used as long as it is open and available:

$SPLUNK_HOME/bin/splunk cmd openssl s_server -accept 21524 -cert /path/to/the/server.pem

    e.2- Run this command in the client.  Port 21524 was used.  Use IP address of the server, and the port number:

$SPLUNK_HOME/bin/splunk cmd openssl s_client -connect x.x.x.x:21524 -CAfile /path/to/the/cacert.pem

f. To view the contents of a certificate, run this command:

$SPLUNK_HOME/bin/splunk cmd openssl x509 -in /path/to/the/Certificate.pem -text

g. Converting certificates to PEM format:

    g.1- In case it is needed to convert a DER certificate into PEM certificate run this command:

$SPLUNK_HOME/bin/splunk cmd openssl x509 -in /path/to/the/Certificate.crt -inform DER -out /path/to/your/newCertificate.pem -outform PEM

    g.2- In case it is needed to convert a PKCS#12 file (.pfx .p12) containing a private key and certificates to PEM:

$SPLUNK_HOME/bin/splunk pkcs12 -in /path/to/mycert.pfx -out /path/to/mycert.pem -nodes

h. In case it is needed to remove the password from the private key for Splunk Web run this command:

$SPLUNK_HOME/bin/splunk cmd openssl rsa -in /path/to/the/PrivateKey.key -out /path/to/the/PrivateKey.key

i. To check if a private key contains or not a password run the following command.  If the contents of the certificate can be seen then the certificate does not have a password: 

$SPLUNK_HOME/bin/splunk cmd openssl rsa -in /path/to/the/PrivateKey.key -text

j. To check the dates of the certificate to confirm its expiration date run this command: 

$SPLUNK_HOME/bin/splunk cmd openssl x509 -noout -in /path/to/the/certicate.pem -dates

k. To inspect a PKCS#12 certificate complies with FIPS standards (using PBE-SHA1-3DES):

openssl pkcs12 -info -in existing_certificate.p12 -noout

What to look for in the output:

• Encryption Algorithms: Verify the ciphers listed for both the certificate encryption and the private key encryption.
• FIPS Compatibility: If you see legacy algorithms like RC2, weak ciphers, or unsupported PBES2 variants, the FIPS-enabled Splunk environment will reject the file. Both should explicitly show PBE-SHA1-3DES (or FIPS-approved AES variants). 

Related Links

External Documentation:
openssl-quick-reference-guide.htm