Cribl offers two methods for securing communications between Worker Nodes and Sources or Destinations:

• Transport Layer Security (TLS) - Encrypts data during transmission and authenticates the server.
• Mutual TLS (mTLS) - Adds client authentication on top of standard TLS.

For encrypting data in transit and simple server verification, standard TLS is sufficient. Opt for mTLS when security policies mandate additional client verification.

Use Cribl-Provided Certificates ​

In Cribl.Cloud, you can use Cribl-provided certificates to secure the communication between Worker Nodes and selected Sources.

Cribl-provided certificates offer the following benefits:

• Reliable, ready-to-use security: When you enable TLS and enter the correct environment variables for Cribl-provided certificates in the Source configuration, data in transit is always encrypted.
• Zero maintenance: Cribl-provided certificates are publicly valid and automatically managed and rotated before they expire. No action is required from you. The certificate issuer can change, so do not pin a Cribl-provided certificate or its issuer.
• Simplified deployment: No need to generate or install custom certificates.

You only need to use your own private key or configure mTLS if specifically required by your security team or company policies. If you need custom certificates, see Secure Source and Destinations Comms with a Custom Certificate.

While TLS encryption ends at individual Nodes upon data arrival in Cribl.Cloud, data at rest is protected by other robust security measures within the platform.

Cribl-provided certificates are unique to each Workspace and Organization.

Cribl.Cloud supports Cribl-provided certificates for Sources including Cribl TCP, Cribl HTTP, Syslog, HTTP, and Splunk TCP. To view a complete list of the supported Sources, along with their corresponding ports and ingress addresses:

1. On the top bar, select Products, and then select Workspace under Cribl.
2. In the sidebar, select Data Sources.

Enable TLS on Sources Using Cribl-Provided Certificates ​

To enable TLS using Cribl-provided certificates for a supported Source, configure the following TLS Settings for the Source:

• Enabled: Toggle on.

• Private key path: Enter $CRIBL_CLOUD_KEY. This environment variable represents the path to the default private key in Cribl.Cloud.

• Certificate path: Enter $CRIBL_CLOUD_CRT. This environment variable represents the path to the default certificate in Cribl.Cloud.

• Minimum TLS version: Select TLSv1.2.

• Maximum TLS version: Select TLSv1.3.

When a Source is configured to listen on a port in the Cribl.Cloud ingress range (20000-20010), you must set Private key path to $CRIBL_CLOUD_KEY and Certificate path to $CRIBL_CLOUD_CRT. These environment variables resolve to the Cribl.Cloud-managed certificates that are valid for those ports. Using any other certificate paths will cause TLS initialization to fail on those ports.

The Minimum TLS version and Maximum TLS version settings on the Source must be compatible with the corresponding settings on its peer Destination. If the two version ranges do not overlap, the TLS handshake will fail and no data will flow. Set the same version range on both sides – for example, TLSv1.2 minimum and TLSv1.3 maximum. For details and configuration examples, see Match TLS Versions Between Source and Destination.

When you finish configuring the Source, select Save, then Commit and Deploy.

For an example on how to securely forward syslog data to your Cribl.Cloud instance, see Syslog TLS to Cribl.Cloud (Palo Alto Example). This topic demonstrates a vendor-specific configuration (Palo Alto) for secure data ingestion.

Secure Source and Destinations Comms with a Custom Certificate ​

In on-prem deployments, or in Cribl.Cloud where no Cribl-provided certificate exists, you need to provide TLS certificates for Sources and Destinations manually.

Cribl Stream stores and manages custom TLS certificates at the Worker Group level. When you add a certificate to a Source or Destination, Cribl Stream creates it within the same Worker Group where you configured the integration.

For information about how certificate references work in Packs, see Use Named TLS Certificates.

1. Add a certificate on the Worker Group your integration is in. Refer to the instructions for adding a certificate on a Worker Group for details.

2. Open the configuration settings for your Source or Destination.

3. Select TLS Settings (Client Side) or TLS Settings (Server Side), depending on the integration.

4. Toggle Enabled on.

5. In the Certificate drop-down, select the name of the certificate you created. This will auto-populate the related fields.

6. Select Save.

Enable mTLS Authentication for Source/Destination Communications ​

When standard TLS isn’t sufficient and you need client authentication, you can enable mTLS.

Enabling mTLS for Source/Destination communication requires:

• A CA certificate chain that can validate the client certificates.
• Client certificates issued to each client that will connect to Cribl.Cloud.
• Client systems configured to present their certificates during connection.

You configure mTLS authentication separately for each Source.

This requires a CA certificate chain that can validate the client certificate used for authentication. For secure communication using mTLS authentication, you need to provide the root CA certificate of your client certificate. If you don’t have the root CA certificate, you can also provide a CA certificate chain that includes all intermediate certificates leading back to a trusted root certificate.

1. Create a CA certificate. Refer to the instructions for adding a certificate on a Worker Group for details.

   While the Add Certificate form requires you to provide a Private Key and Certificate, these fields are not necessary for client certificate validation. This is a design limitation that requires you to provide some properly formatted values to proceed. You can use a self-signed certificate for this purpose.

2. Navigate to the Source where you want to enable mTLS and open the configuration modal. In the TLS Settings tab:

   1. Toggle Enable TLS to Yes and configure TLS setting as usual.
   2. Set Authenticate Client to Yes.
   3. Paste the path to your certificate in the CA certificate path field.
   4. Select Save, then Commit & Deploy.