Create a self-signed certificate for SIEM TLS

Create a self-signed certificate for Splunk TLS

This certificate is required to configure SIEM integration with Splunk over TLS.

1. Prepare a working directory

Connect to the Splunk server.

Navigate to the auth directory

cd /opt/splunk/etc/auth/

Create and enter a certificates folder

mkdir myCerts
cd myCerts

2. Create a root Certificate Authority

Create a CA private key

openssl genrsa -aes256 -passout pass:1234 -out myCAPrivateKey.key 2048

Replace 1234 with your own password.

Remove the passphrase from the key

openssl rsa -passin pass:1234 -in myCAPrivateKey.key -out myCAPrivateKey.key

Create a root certificate request

openssl req -new -key myServerPrivateKey.key -out myServerCertificate.csr

Enter your organization’s details when prompted.

Self-sign the root certificate

openssl x509 -req -in myCACertificate.csr -sha512 -signkey myCAPrivateKey.key -CAcreateserial -out myCACertificate.pem -days 1095

3. Create a server certificate

Create a server private key

openssl genrsa -aes256 -passout pass:1234 -out myServerPrivateKey.key 2048

Remove the passphrase from the key

openssl rsa -passin pass:1234 -in myServerPrivateKey.key -out myServerPrivateKey.key

Create a server certificate request

openssl req -new -key myServerPrivateKey.key -out myServerCertificate.csr

Sign the server certificate with the CA

openssl x509 -req -in myServerCertificate.csr -sha256 -CA myCACertificate.pem -CAkey myCAPrivateKey.key -CAcreateserial -out myServerCertificate.pem -days 1095

4. Bundle and configure Splunk

Combine the certificate chain

cat myServerCertificate.pem myServerPrivateKey.key myCACertificate.pem > mySplunkServerCertificate.pem

Open the Splunk inputs configuration

cd /opt/splunk/etc/system/local

Open inputs.conf.

Configure SSL settings

[default]
host = splunk

[tcp-ssl:9996]
sourcetype = LEEF
disabled = 0

[SSL]
sslVersions = tls1.2
serverCert = $SPLUNK_HOME/etc/auth/myCerts/mySplunkServerCertificate.pem
password = 1234
rootCA = $SPLUNK_HOME/etc/auth/myCerts/myCACertificate.pem
requireClientCert = false

The 1234 password shown is illustrative only. Splunk encrypts it automatically after the next restart.

Restart Splunk

Restart the machine running Splunk.

Verify the configuration

netstat -tulpn

Port 9996 should be listed if the configuration was applied correctly.

5. Import the certificate into Syteca

Convert the certificate to .cer format

cd /opt/splunk/etc/auth/
openssl x509 -outform der -in mySplunkServerCertificate.pem -out mySplunkServerCertificate.cer

Copy the certificate to the Management Tool computer

Transfer mySplunkServerCertificate.cer to the computer where the Management Tool is installed, then use it when configuring the SIEM integration.

Overview

FAQ

Troubleshooting

Reference

Create a self-signed certificate for SIEM TLS

Create a self-signed certificate for Splunk TLS

1. Prepare a working directory

2. Create a root Certificate Authority

3. Create a server certificate

4. Bundle and configure Splunk

5. Import the certificate into Syteca

​Create a self-signed certificate for Splunk TLS

​1. Prepare a working directory

​2. Create a root Certificate Authority

​3. Create a server certificate

​4. Bundle and configure Splunk

​5. Import the certificate into Syteca

Create a self-signed certificate for Splunk TLS

1. Prepare a working directory

2. Create a root Certificate Authority

3. Create a server certificate

4. Bundle and configure Splunk

5. Import the certificate into Syteca