How to update

If the default server certificate (cert.pem) used by SplunkWeb with SSL (HTTPS) is about to expire, you can update the server certificate by following the steps below. There are two ways to update, please use one of them.

Please replace $SPLUNK_HOME in the following procedure with the Splunk installation directory.

*For default installation

<Linux>

$SPLUNK_HOME : /opt/splunk

<Windows>

$SPLUNK_HOME : C:\Program Files\splunk

Method 1

procedure

• Move the current cert.pem and privkey.pem under the $SPLUNK_HOME/etc/auth/splunkweb folder to a directory outside $SPLUNK_HOME.
• Restart the Splunk service.
  command:

  $SPLUNK_HOME/bin/splunk restart

• After rebooting, make sure a new cert.pem is created in $SPLUNK_HOME/etc/auth.

Method 2

The key size of the certificate created by Method 1 is 2048bit. Use this procedure to change the key size

procedure

• Move the current cert.pem and privkey.pem under the $SPLUNK_HOME/etc/auth/splunkweb folder to a directory outside $SPLUNK_HOME.
• Execute the following command to renew the certificate.
  command:
  

  cd $SPLUNK_HOME/etc/auth/splunkweb
  $SPLUNK_HOME/bin/splunk createssl web-cert 3072

  *3072 is the key size of the server certificate. If omitted, the key size will be the same as method 1.
• Restart the Splunk service.
  command:
  

  $SPLUNK_HOME/bin/splunk restart

• After reboot, make sure new cert.pem, privkey.pem are created in $SPLUNK_HOME/etc/auth/splunkweb.