You can add and manage TLS certificates and keys in Cribl Stream to be reused across multiple purposes, including:

• Securing Leader-Node Communication with TLS
• Securing Sources and Destinations with TLS and mTLS
• Configuring TLS for API and UI Access

Certificate Requirements ​

Cribl Stream expects certificates and keys to be formatted in privacy-enhanced mail (.pem) format.

You can use:

• Certificates from a public certificate authority (recommended for production; trusted by most clients by default).
• Certificates issued by your organization internal PKI (requires adding the root and intermediate CA certificates to client trust stores).
• Self-signed certificates (for lab/test environments only; requires manual trust configuration).

Generate a Self-Signed Certificate (Optional) ​

For non-production or lab environments, you can generate a self-signed certificate and private key using OpenSSL:

openssl req -nodes -new -x509 -newkey rsa:2048 \
  -keyout myKey.pem \
  -out myCert.pem \
  -days 420

This command generates:

• myCert.pem: a self-signed certificate (valid for 420 days).
• myKey.pem: an unencrypted 2048-bit RSA private key.

Add a Certificate ​

Once you have a certificate generated or prepared, you can add it on the on-prem Leader or Worker Group.

On the Leader ​

Add a certificate on an on-prem Leader Node to secure communications from Outposts or Worker Nodes to the Leader.

You do not need to add certificates to Cribl.Cloud Leaders. Leaders in Cribl.Cloud are secured with TLS certificates managed and configured by Cribl.

1. In the sidebar, navigate to Settings > Global > Security > Certificates.

2. Select Add Certificate.

3. Enter a descriptive Name (for example, leader-ui-tls or worker-tls).

4. In the Certificate field, do one of the following:

   • Drag and drop your .pem certificate file into the field.
   • Select the upload button to browse for the file.
   • Open the certificate file, copy its contents, and paste them into the field.

   Certificate should have the following form:

   -----BEGIN CERTIFICATE-----
   CERTIFICATE CONTENT
   -----END CERTIFICATE-----

   Copy

5. In the Private key field, upload or paste the corresponding private key in PEM format.

   An unencrypted private key should have the following form:

   -----BEGIN RSA PRIVATE KEY-----
   HIDDEN PRIVATE KEY
   -----END RSA PRIVATE KEY-----

   Copy

   An encrypted private key uses a different heading and footer:

   -----BEGIN ENCRYPTED PRIVATE KEY-----
   HIDDEN ENCRYPTED PRIVATE KEY
   -----END ENCRYPTED PRIVATE KEY-----

   Copy

6. (Optional) If your private key is encrypted, enter the Passphrase.

7. (Optional) If you’re using a certificate signed by an external certificate authority (for example, a downloaded Splunk Cloud certificate), you have mTLS enabled, and need to validate client certificates, upload or paste the CA certificate chain into the CA certificate field. For details, see Obtain the Certificate Chain (TLS/SSL).

8. (Optional) Add a Description to help identify the certificate’s purpose.

9. Select Save.

On a Worker Group ​

You can use certificates added at Worker Group level to secure connection to external services through Sources.

To add certificates at the Worker Group level:

1. In the sidebar, select Worker Groups, then select the Worker Group you want to configure.

2. Select Worker Group Settings.

3. Navigate to Security > Certificates.

4. Select Add Certificate.

5. Enter a descriptive Name (for example, leader-ui-tls or worker-tls).

6. In the Certificate field, do one of the following:

   • Drag and drop your .pem certificate file into the field.
   • Select the upload button to browse for the file.
   • Open the certificate file, copy its contents, and paste them into the field.

   Certificate should have the following form:

   -----BEGIN CERTIFICATE-----
   CERTIFICATE CONTENT
   -----END CERTIFICATE-----

   Copy

7. In the Private key field, upload or paste the corresponding private key in PEM format.

   Private key should have the following form:

   -----BEGIN RSA PRIVATE KEY-----
   HIDDEN PRIVATE KEY
   -----END RSA PRIVATE KEY-----

   Copy

   An encrypted private key uses a different heading and footer:

   -----BEGIN ENCRYPTED PRIVATE KEY-----
   HIDDEN ENCRYPTED PRIVATE KEY
   -----END ENCRYPTED PRIVATE KEY-----

   Copy

8. (Optional) If your private key is encrypted, enter the Passphrase.

9. (Optional) If you’re using a certificate signed by an external certificate authority (for example, a downloaded Splunk Cloud certificate), upload or paste the CA certificate chain into the CA certificate field. For details, see Obtain the Certificate Chain (TLS/SSL).

10. (Optional) Add a Description to help identify the certificate’s purpose.

11. Select Save.

12. Commit and Deploy the Worker Group’s new configuration.

Manage Existing Certificates ​

To view and manage certificates you’ve already added:

1. Navigate to Settings > Global > Security > Certificates (Leader) or Worker Group Settings > Security > Certificates (Worker Group level).
2. Select a certificate name to view or edit its details.
3. To delete a certificate, click the delete icon next to the certificate entry.

Before deleting a certificate, verify it’s not in use by any TLS configuration (Leader UI/API, Leader-Worker Node communications, Sources, or Destinations).

Using Certificates ​

After adding a certificate, you can reference it by name in various TLS configurations:

Maintaining TLS Certificates ​

Certificate revocation can lead to unexpected service interruptions. To mitigate risks:

• Regularly review and renew certificates.
• Implement robust monitoring and alerting systems to detect potential issues.
• Ensure secure storage of certificates and private keys.
• In case of emergency, have a well-defined recovery plan to restore service quickly.