I followed these steps steps below:
http://docs.splunk.com/Documentation/Splunk/6.6.3/Security/Howtoself-signcertificates
http://docs.splunk.com/Documentation/Splunk/6.6.3/Security/HowtoprepareyoursignedcertificatesforSplunk
http://docs.splunk.com/Documentation/Splunk/6.6.3/Security/ConfigureSplunkforwardingtousesignedcertificates
I follow the steps below for my Indexer server, do i have to create self-sign-cert for my Forwarder too? Can I just copy over the cert files I created on the Indexer on to the Forwarder?
steps I follow create cert on Index server
myServerCertificate.pem
myServerPrivateKey.key
myCACertificate.pem
Combine these certs to one NewCert.pem file
update inputs.conf on Indexer to point to new NewCert.pem that I created
copy the NewCert.Pem to Forwarder, update outputs.conf to point to NewCert.pem?
I'm I missing something, because I can't seem to get it working
error i get in logs
ERROR tcpInputProc error encountered for connection from source error 140760FC:SSL routine :SSL23
thank you
↧