Splunk Enterprise 6.6 and higher includes certificates that are signed with Secure Hash Algorithm (SHA)-256 using a 2048-bit key. These certificates are part of a new installation of the software.

When you upgrade from a previous release, Splunk Enterprise replaces the existing cacert.pem.default and ca.pem.default Privacy Enhanced Mail (PEM) files. Upgrades do not affect existing certificates.

Because of the new default PEM format, you must upgrade all certificates and PEM files to SHA-256 using a 2048-bit key to avoid errors with validation. For example, indexers and forwarders might require updates to meet the same standards as Splunk Enterprise search heads. You might also want to check certificates for your license manager. If you do not update all certificates and PEM files, Splunk Enterprise logs the following error in splunkd.log when it attempts to connect to another instance over SSL:

ERROR TcpOutputFd - Connection to host=10.140.130.102:9997 failed. sock_error = 0. 
SSL Error = error:04091077:rsaroutines:INT_RSA_VERIFY:wrong signature length