Update Splunk Configuration to match Splunk 10.4 (latest)
Page to fix: https://github.com/mitre/saf/wiki/Splunk-Configuration/f04a84363bb2ad370b874a108d16e3531f4d16ab
Problems
1 . sslVersions = tls1.2 disables TLS 1.3, the default since 10.4.0.
2. Custom cipherSuite string is obsolete; it now governs TLS 1.2 only. Use Splunk defaults.
3. web.conf caCertPath is deprecated; use serverCert.
4. crossOriginSharingPolicy = * is too broad; scope to the Heimdall origin.
5. Cert steps target Amazon Linux 2 (EOL) with dead RPM URLs; sudo cd is a no-op; the cat duplicates the leaf cert.
Proposal
Replace the page with the attached draft (Splunk-Configuration-proposed.md). The draft:
Keeps the limits.conf [kv] and props.conf [HDF2Splunk] stanzas unchanged — both remain valid in Splunk 10.4.
Sets sslVersions = tls1.2,tls1.3 in server.conf, matching the 10.4 default. Adds a note: on 9.x, use tls1.2.
Drops the custom cipherSuite string. Splunk defaults now cover both protocols; a [tls1.3] stanza exists for sites that must override.
Replaces caCertPath with serverCert in web.conf.
Scopes crossOriginSharingPolicy to the Heimdall origin instead of *.
Rewrites the certificate steps for Amazon Linux 2023: certbot via pip/venv (no EPEL), working commands (no sudo cd), and correct PEM assembly — cert.pem + privkey.pem + chain.pem — per Splunk's required order (cert, key, CA chain), without duplicating the leaf.
Adds a "Tested against: Splunk Enterprise 10.4" header so future drift is detectable.
Update Splunk Configuration to match Splunk 10.4 (latest)
Page to fix: https://github.com/mitre/saf/wiki/Splunk-Configuration/f04a84363bb2ad370b874a108d16e3531f4d16ab
Problems
1 . sslVersions = tls1.2 disables TLS 1.3, the default since 10.4.0.
2. Custom cipherSuite string is obsolete; it now governs TLS 1.2 only. Use Splunk defaults.
3. web.conf caCertPath is deprecated; use serverCert.
4. crossOriginSharingPolicy = * is too broad; scope to the Heimdall origin.
5. Cert steps target Amazon Linux 2 (EOL) with dead RPM URLs; sudo cd is a no-op; the cat duplicates the leaf cert.
Proposal
Replace the page with the attached draft (Splunk-Configuration-proposed.md). The draft:
Keeps the limits.conf [kv] and props.conf [HDF2Splunk] stanzas unchanged — both remain valid in Splunk 10.4.
Sets sslVersions = tls1.2,tls1.3 in server.conf, matching the 10.4 default. Adds a note: on 9.x, use tls1.2.
Drops the custom cipherSuite string. Splunk defaults now cover both protocols; a [tls1.3] stanza exists for sites that must override.
Replaces caCertPath with serverCert in web.conf.
Scopes crossOriginSharingPolicy to the Heimdall origin instead of *.
Rewrites the certificate steps for Amazon Linux 2023: certbot via pip/venv (no EPEL), working commands (no sudo cd), and correct PEM assembly — cert.pem + privkey.pem + chain.pem — per Splunk's required order (cert, key, CA chain), without duplicating the leaf.
Adds a "Tested against: Splunk Enterprise 10.4" header so future drift is detectable.