These docs are for Cribl Stream 4.17 and are no longer actively maintained.

See the latest version (4.18).

This topic explains how to import and manage TLS/SSL certificates and keys in Cribl Stream. Certificates you import here can be reused across multiple purposes, including:

• Secure TLS for API and UI Access
• Securing Leader-Worker Node Communication
• Secure Sources and Destinations with Certificates

Certificate Requirements ​

Cribl Stream expects certificates and keys to be formatted in privacy-enhanced mail (.pem) format.

You can use:

• Certificates from a public certificate authority (recommended for production; trusted by most clients by default).
• Certificates issued by your organization internal PKI (requires adding the root and intermediate CA certificates to client trust stores).
• Self-signed certificates (for lab/test environments only; requires manual trust configuration).

Generate a Self-Signed Certificate (Optional) ​

For non-production or lab environments, you can generate a self-signed certificate and private key using OpenSSL:

openssl req -nodes -new -x509 -newkey rsa:2048 \
  -keyout myKey.pem \
  -out myCert.pem \
  -days 420

This command generates:

• myCert.pem: a self-signed certificate (valid for 420 days).
• myKey.pem: an unencrypted 2048-bit RSA private key.

Import a Certificate ​

On the Leader ​

1. Navigate to Settings > Global > Security > Certificates.
2. Select Add Certificate.
3. Enter a descriptive Name (for example, leader-ui-tls or worker-tls).
4. In the Certificate field, do one of the following:
   • Drag and drop your .pem certificate file into the field.
   • Click the upload button to browse for the file.
   • Open the certificate file, copy its contents, and paste them into the field.
5. In the Private key field, upload or paste the corresponding private key in PEM format.
6. (Optional) If your private key is encrypted, enter the Passphrase.
7. (Optional) If you’re using a certificate signed by an external certificate authority (for example, a downloaded Splunk Cloud certificate), upload or paste the CA certificate chain into the CA certificate field. For details, see Obtain the Certificate Chain (TLS/SSL).
8. (Optional) Add a Description to help identify the certificate’s purpose.
9. Select Save.

On a Worker Group ​

For distributed deployments, you can also import certificates at the Worker Group level:

1. In the sidebar, select Worker Groups, then select the Worker Group you want to configure.
2. Select Worker Group Settings.
3. Navigate to Security > Certificates.
4. Select Add Certificate.
5. Follow the same steps as above to upload your certificate and private key.
6. Select Save.
7. Commit and Deploy the Worker Group’s new configuration.

Manage Existing Certificates ​

To view and manage certificates you’ve already imported:

1. Navigate to Settings > Global > Security > Certificates (Leader) or Worker Group Settings > Security > Certificates (Worker Group level).
2. Select a certificate name to view or edit its details.
3. To delete a certificate, click the delete icon next to the certificate entry.

Before deleting a certificate, verify it’s not in use by any TLS configuration (Leader UI/API, Leader-Worker Node communications, Sources, or Destinations).

Using Imported Certificates ​

After importing a certificate, you can reference it by name in various TLS configurations:

For step-by-step instructions on enabling TLS for specific use cases, see:

• Configure TLS for API and UI Access
• Secure Leader/Worker Nodes Communication