> ## Documentation Index
> Fetch the complete documentation index at: https://syteca.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Create a self-signed certificate for SIEM TLS

> Create a self-signed certificate for SIEM TLS

## Create a self-signed certificate for Splunk TLS

This certificate is required to configure [SIEM integration](/docs/administration/integrations/siem) with Splunk over TLS.

### 1. Prepare a working directory

<Steps>
  <Step title="Log in to the Splunk server">
    Connect to the Splunk server.
  </Step>

  <Step title="Navigate to the auth directory">
    ```bash theme={"system"}
    cd /opt/splunk/etc/auth/
    ```
  </Step>

  <Step title="Create and enter a certificates folder">
    ```bash theme={"system"}
    mkdir myCerts
    cd myCerts
    ```
  </Step>
</Steps>

### 2. Create a root Certificate Authority

<Steps>
  <Step title="Create a CA private key">
    ```bash theme={"system"}
    openssl genrsa -aes256 -passout pass:1234 -out myCAPrivateKey.key 2048
    ```

    Replace `1234` with your own password.
  </Step>

  <Step title="Remove the passphrase from the key">
    ```bash theme={"system"}
    openssl rsa -passin pass:1234 -in myCAPrivateKey.key -out myCAPrivateKey.key
    ```
  </Step>

  <Step title="Create a root certificate request">
    ```bash theme={"system"}
    openssl req -new -key myServerPrivateKey.key -out myServerCertificate.csr
    ```

    Enter your organization's details when prompted.
  </Step>

  <Step title="Self-sign the root certificate">
    ```bash theme={"system"}
    openssl x509 -req -in myCACertificate.csr -sha512 -signkey myCAPrivateKey.key -CAcreateserial -out myCACertificate.pem -days 1095
    ```
  </Step>
</Steps>

### 3. Create a server certificate

<Steps>
  <Step title="Create a server private key">
    ```bash theme={"system"}
    openssl genrsa -aes256 -passout pass:1234 -out myServerPrivateKey.key 2048
    ```
  </Step>

  <Step title="Remove the passphrase from the key">
    ```bash theme={"system"}
    openssl rsa -passin pass:1234 -in myServerPrivateKey.key -out myServerPrivateKey.key
    ```
  </Step>

  <Step title="Create a server certificate request">
    ```bash theme={"system"}
    openssl req -new -key myServerPrivateKey.key -out myServerCertificate.csr
    ```
  </Step>

  <Step title="Sign the server certificate with the CA">
    ```bash theme={"system"}
    openssl x509 -req -in myServerCertificate.csr -sha256 -CA myCACertificate.pem -CAkey myCAPrivateKey.key -CAcreateserial -out myServerCertificate.pem -days 1095
    ```
  </Step>
</Steps>

### 4. Bundle and configure Splunk

<Steps>
  <Step title="Combine the certificate chain">
    ```bash theme={"system"}
    cat myServerCertificate.pem myServerPrivateKey.key myCACertificate.pem > mySplunkServerCertificate.pem
    ```
  </Step>

  <Step title="Open the Splunk inputs configuration">
    ```bash theme={"system"}
    cd /opt/splunk/etc/system/local
    ```

    Open `inputs.conf`.
  </Step>

  <Step title="Configure SSL settings">
    ```ini theme={"system"}
    [default]
    host = splunk

    [tcp-ssl:9996]
    sourcetype = LEEF
    disabled = 0

    [SSL]
    sslVersions = tls1.2
    serverCert = $SPLUNK_HOME/etc/auth/myCerts/mySplunkServerCertificate.pem
    password = 1234
    rootCA = $SPLUNK_HOME/etc/auth/myCerts/myCACertificate.pem
    requireClientCert = false
    ```

    <Note>
      The `1234` password shown is illustrative only. Splunk encrypts it automatically after the next restart.
    </Note>
  </Step>

  <Step title="Restart Splunk">
    Restart the machine running Splunk.
  </Step>

  <Step title="Verify the configuration">
    ```bash theme={"system"}
    netstat -tulpn
    ```

    Port `9996` should be listed if the configuration was applied correctly.
  </Step>
</Steps>

### 5. Import the certificate into Syteca

<Steps>
  <Step title="Convert the certificate to .cer format">
    ```bash theme={"system"}
    cd /opt/splunk/etc/auth/
    openssl x509 -outform der -in mySplunkServerCertificate.pem -out mySplunkServerCertificate.cer
    ```
  </Step>

  <Step title="Copy the certificate to the Management Tool computer">
    Transfer `mySplunkServerCertificate.cer` to the computer where the Management Tool is installed, then use it when configuring the [SIEM integration](/docs/administration/integrations/siem).
  </Step>
</Steps>