How to update

If the default server certificate (cert.pem) used when SSL (HTTPS) is enabled in SplunkWeb is nearing its expiration date, you can update the server certificate by following the steps below.

There are two ways to update your account. Please use one of them.

*$SPLUNK_HOME is the installation directory. By default, it is as follows:

<Linux>

Splunk Enterprise : /opt/splunk

<Windows>

Splunk Enterprise : C:\Program Files\Splunk

Method 1

【procedure】

Copy the current cert.pem and privkey.pem under the $SPLUNK_HOME/etc/auth/splunkweb folder.

Change to a directory outside $SPLUNK_HOME.

Restart the Splunk service.

command:

$SPLUNK_HOME/bin/splunk restart

After rebooting, make sure a new cert.pem is created in $SPLUNK_HOME/etc/auth.

Method 2

The key size of the certificate created by method 1 is 2048 bits.

If you want to change the key size, use this procedure.

【procedure】

Copy the current cert.pem and privkey.pem under the $SPLUNK_HOME/etc/auth/splunkweb folder.

Change to a directory outside $SPLUNK_HOME.

Execute the following command to update the certificate.

command:

cd $SPLUNK_HOME/etc/auth/splunkweb
$SPLUNK_HOME/bin/splunk createssl web-cert 3072

*3072 is the key size of the server certificate.

If omitted, the key size will be the same as in method 1.

Restart the Splunk service.

command:

$SPLUNK_HOME/bin/splunk restart

After reboot, make sure new cert.pem, privkey.pem are created in $SPLUNK_HOME/etc/auth/splunkweb.