Configure SSL and TLS protocol version support for secure connections between Splunk platform instances

You can control the individual versions of SSL or TLS protocol that Splunk Enterprise is to support for secure communications between Splunk platform instances. You perform this configuration using the sslVersions setting in various configuration files.

You can use the setting to restrict or support older versions of protocols. When you configure the sslVersions setting in a configuration file, Splunk Enterprise either makes or accepts connections using the protocol versions you specify. Both the instance that makes the connection and the instance that receives the connection must support the same protocol versions.

You must always configure this setting in a configuration file. It's not possible to perform this configuration in Splunk Web.

Supported SSL and TLS protocol versions

The Splunk platform supports the following SSL and TLS versions:

• SSLv2
• SSLv3
• TLS1.0
• TLS1.1
• TLS1.2

The SSL* protocol versions are not secure because of various exploits that can take advantage of those protocols. Don't use these protocols unless you have no other option. Instead, use the TLS* versions wherever possible. You can use the special tls value to specify all available TLS versions. If you enable Federal Information Processing Standards (FIPS) mode on Splunk Enterprise, it isn't possible to use the SSL* protocol versions. Splunk Enterprise won't communicate on these protocols when it is in FIPS mode even if you explicitly specify the protocols.

Configure SSL and TLS protocol version support with the sslVersions setting

The sslVersions setting controls the SSL and TLS protocols that each Splunk platform instance uses to connect to Other Splunk platform instances securely. The syntax for configuring the setting follows:

Older versions of Splunk Enterprise and the universal forwarder might not support newer versions of SSL/TLS protocols, and vice versa. As a reminder, each instance in a network connection must support the protocol version you choose for secure connections between those instances to succeed. Confirm that both the connecting instance and the receiving instance support the protocol you want, and that you set the sslVersions setting on each instance to a value that both instances can use. If you enable FIPS mode on an instance, that instance won't use the SSL protocol versions at all

1. Open the configuration file where you want to configure the protocol versions, depending on the instance type and the connection.
2. Edit the sslVersions setting. Establish the versions you want to support or restrict by supplying the appropriate values.
3. Save the configuration file and close it.
4. Restart Splunk Enterprise for the changes to take effect.

Where you configure the sslVersions setting depends on the kind of communication that the Splunk platform instances are performing. The general procedure follows:

Examples for configuring SSL/TLS protocol versions

See the following configuration examples to better understand how to configure SSL and TLS protocol versions between Splunk platform instances.

Example 1: Forwarder and receiver to communication on TLS 1.1

[SSL]
sslVersions=tls1.1

[sslConfig]
sslVersions=tls1.1
enableSplunkdSSL=true

Example 2: Splunk deployment client and deployment server on SSL v3 and all TLS protocols

[sslConfig]
sslVersionsForClient=ssl3,tls

[sslConfig]
sslVersions=ssl3,tls
enableSplunkdSSL=true