About self-renewing default splunk certificates

Applicability

Description

It's important to know that Splunk, when needed, creates default certificates such as ca.pem and server.pem on new installations when there aren't certificates.

Investigation

Currently Splunk does not have self monitoring or alerting mechanism to alert the Splunk admin that a cert is close to expire or is expired, and Splunk does not has a self-renew mechanism for default certificates.

Resolution

To identify the server certificate in use, run the following command, with the output resembling the example below:

# splunk btool server list --debug |grep serverCert 
/opt/splunk/etc/system/default/server.conf                             serverCert = $SPLUNK_HOME/etc/auth/server.pem

To confirm the certificate's expiration date, run the following command, replacing the certificate name if necessary:

splunk cmd openssl x509 -enddate -noout -in $SPLUNK_HOME/etc/auth/server.pem 

If the default Splunk certificate is being used and it's expired, it can be renewed by doing the following:

1) Make a backup of the expired server.pem

mv $SPLUNK_HOME/etc/auth/server.pem  $SPLUNK_HOME/etc/auth/server.pem.expired

2) Restart Splunk 

If generating a new server certificate does not resolve the issue, the CA (Certificate Authority) certificates could also be expired. Check the information for both ca.pem and cacert.pem by running the same commands as above. 

If either of the CA certificates are expired, proceed with the following:

1) Make a backup of server.pem, ca.pem and cacert.pem

mv $SPLUNK_HOME/etc/auth/server.pem  $SPLUNK_HOME/etc/auth/server.pem.expiredmv $SPLUNK_HOME/etc/auth/ca.pem  $SPLUNK_HOME/etc/auth/ca.pem.expiredmv $SPLUNK_HOME/etc/auth/cacert.pem  $SPLUNK_HOME/etc/auth/cacert.pem.expired

Run the following command to generate new CA certificates:

$SPLUNK_HOME/bin/genRootCA.sh -d $SPLUNK_HOME/etc/auth

After the new ca.pem and cacert.pem files have been generated,  a new server certificate has to be created using the new CA certificates. Restart Splunk to generate the new server.pem file.

Related Links

Community article

Introduction to securing the Splunk platform with TLS