Documentation: 3.3
|  Print Version Contents
This page last updated: 09/02/08 11:09am

Enable HTTPS

You can enable HTTPS via Splunk Web or web.conf.

Note: Your Splunk server can listen on either HTTP or HTTPS. It cannot listen on both.

You can also enable SSL through separate configurations.

Important: If you are using Firefox 3, enabling SSL for a Splunk deployment may result in an "invalid security exception" being displayed in the browser. Refer to this workaround documentation for more information.

Configuration

In Splunk Web

To enable HTTPS in Splunk Web, click the Admin link in the upper right hand corner. Then, click Server and choose View Settings. Under Web interface, change the radio button to Yes for Enable SSL (HTTPS) in Splunk Web?

Note: You must restart Splunk to enable the new settings. Also, you must now append "https://" to the URI you use to access Splunk Web.

In web.conf

In order to enable HTTPS, modify web.conf. Edit this file in $SPLUNK_HOME/etc/system/local/, or your own custom application directory in $SPLUNK_HOME/etc/apps/. For more information on configuration files in general, see how configuration files work.

[settings]
httpport = <port number>
enableSplunkWebSSL = true
  • httpport
    • Set the port number to your HTTPS port.
  • enableSplunkWebSSL
    • Set this key to true to enable SSL for Splunk Web.

Once you have made the changes to web.conf restart your Splunk server to read the new changes in.

Certificates

The certificates used for SSL between Splunk Web and the client browser is located in $SPLUNK_HOME/share/splunk/certs/. You can replace the self-signed default certificate with your own.

The certificates for SSL are specified in web.conf. You can change the defaults to your own certificate names.

privKeyPath = /certs/privkey.pem
caCertPath = /certs/cert.pem

Restart Splunk Web from the CLI for your changes to take effect. To use Splunk's CLI, navigate to the $SPLUNK_HOME/bin/ directory and use the ./splunk command. You can also add Splunk to your path and use the splunk command.

./splunk restart splunkweb

If your self-signed certificate for Splunk Web expires, you can generate a new one by deleting cert.pem and privkey.pem in $SPLUNK_HOME/share/splunk/certs/.

Previous: Security options    |    Next: SSL

Comments

  1. the files do not actually need to keep the same names, as long as you specify the correct names in web.conf. i have updated the documentation to reflect this. if you still have issues, please let us know. thanks!
    Posted by emma on Sep 02 2008, 12:10pm

  2. When replacing the certificates , the pem encoded files need to keep the same names - cert.pem and privkey.pem.

    Also if a passphrase was specified when the private key was generated it will need to be manually entered whenever splunkweb is restarted. Workaround would be to remove the passphrase from the key and have it only readable by root.
    Posted by briang67 on Jul 07 2008, 9:58am

Log in to comment.