ON THIS PAGE

Home / Stream/ Securing· Secure Leader and Communication·TLS Defaults and System-wide Settings

TLS Defaults and System-wide Settings

Cribl Stream prioritizes secure communication by default. This ensures the integrity and confidentiality of data transmitted between your Cribl Stream instance and various Sources and Destinations.

TLS Version Support and Defaults
​

The minimum supported TLS version in Cribl Stream is TLS 1.2 by default. This default applies to all secure connections, including supported Sources and Destinations, Worker/Leader communications, and Cribl.Cloud.

Cribl.Cloud and on-prem deployments use the same TLS settings, with TLS 1.2 being the default minimum version.

You can check whether a Source or Destination supports TLS by reviewing the information box at the beginning of its corresponding documentation page.

TLS Settings and Traffic Types
​

This table shows TLS client/server pairs, and encryption defaults, per traffic type.

Traffic TypeTLS ClientTLS ServerEncryptionCert AuthCN* Check
UIBrowserCribl StreamDefault disabledDefault disabledDefault disabled
APIWorker/Edge NodeLeaderDefault disabledDefault disabledDefault disabled
Worker-to-LeaderWorker/Edge NodeLeaderDefault disabledDefault disabledDefault disabled
DataAny data senderCribl Stream (Source)Default disabledDefault disabledDefault disabled
DataCribl Stream (Destination)Any data receiverDefault disabledDefault disabledDefault disabled
Authentication————————————————————
Local*BrowserCribl StreamDefault DisabledN/AN/A
LDAP*Cribl StreamLDAP ProviderCustomN/ADefault Disabled
Splunk*Cribl StreamSplunk Search HeadDefault EnabledN/ADefault Disabled
OIDC†/​Okta*Browser and Cribl StreamOktaDefault EnabledN/AEnabled (Browser)
OIDC†/​Google*Browser and Cribl StreamGoogleDefault EnabledN/AEnabled (Browser)

* Common name
† OpenID Connect

System-wide TLS Settings Including Ciphers
​

You can configure advanced, system-wide TLS settings – minimum and maximum TLS versions, default cipher lists, and ECDH curve names. Select Settings > Global Settings > System > General Settings > Default TLS Settings.

In the Default cipher list field, you can specify one or more ciphers from the following list:

  • ECDHE-RSA-AES128-GCM-SHA256
  • ECDHE-ECDSA-AES128-GCM-SHA256
  • ECDHE-RSA-AES256-GCM-SHA384
  • ECDHE-ECDSA-AES256-GCM-SHA384
  • DHE-RSA-AES128-GCM-SHA256
  • ECDHE-RSA-AES128-SHA256
  • DHE-RSA-AES128-SHA256
  • ECDHE-RSA-AES256-SHA384
  • DHE-RSA-AES256-SHA384
  • ECDHE-RSA-AES256-SHA256
  • DHE-RSA-AES256-SHA256
  • HIGH
  • !aNULL
  • !eNULL
  • !EXPORT
  • !DES
  • !RC4
  • !MD5
  • !PSK
  • !SRP
  • !CAMELLIA

CA Certificates and Environment Variables
​

For any Cribl Stream Source or Destination that supports TLS, you can configure a CA Certificate Path field that points to a Certificate Authority (CA) .pem file(s). However, you can also use environment variables to manage CAs globally. Here are some common scenarios:

  • Add a set of trusted root CAs to the list of trusted CAs that Cribl Stream trusts. Set the NODE_EXTRA_CA_CERTS environment variable for each Worker Node. For example, if you are using systemd, add the following line in each Worker Node’s systemd unit file (replace /opt/cribl/local/cribl/auth/certs/ca.pem with the path to your CA .pem file):

    ...
[Service]
Environment="NODE_EXTRA_CA_CERTS=/opt/cribl/local/cribl/auth/certs/ca.pem"
...

    For details about NODE_EXTRA_CA_CERTS, see the node.js documentation.

  • Configure Cribl Stream to accept all TLS certificates, regardless of their validity. Set the NODE_TLS_REJECT_UNAUTHORIZED environment variable for each Worker Node. For example, if you are using systemd, add the following line in each Worker Node’s systemd unit file:

    ...
[Service]
Environment="NODE_TLS_REJECT_UNAUTHORIZED=0"
...

    NODE_TLS_REJECT_UNAUTHORIZED=0 disables TLS certificate validation, which can decrease the security posture of your Cribl installation. For this reason, we recommend avoiding NODE_TLS_REJECT_UNAUTHORIZED=0 in production environments. Instead, use the NODE_EXTRA_CA_CERTS environment variable to explicity trust the necessary certificates.

    For details about NODE_TLS_REJECT_UNAUTHORIZED, see the node.js documentation.