1. Edit information for root CA and save content as file rootCA_openssl.cnf.

   [ req ]
   distinguished_name = req_distinguished_name
   req_extensions = v3_req
    
   [ req_distinguished_name ]
   countryName = Country Name (2 letter code)
   countryName_default = US
   stateOrProvinceName = State or Province Name (full name)
   stateOrProvinceName_default = OR
   organizationName = Organization Name (eg, company)
   organizationName_default = TrendMicro
   commonName = Common Name
   commonName_default = ssl-ca-cert
    
   [ v3_req ]
   basicConstraints = CA:true
   keyUsage = critical, keyCertSign

   Root CA private key is used to sign a root CA certificate.

2. Enter a passphrase when prompted.

   openssl genrsa -aes256 -out rootCA.key 2048

3. Create a CSR (Certificate Signing Request) file for root CA certificate.
4. Enter the passphrase for rootCA.key you just specified.

   openssl req -new -key rootCA.key -out rootCA.csr -config rootCA_openssl.cnf

5. Generate root CA certificate file rootCA.pem.

   openssl x509 -req -in rootCA.csr -sha512 -signkey rootCA.key -out rootCA.pem -days 1095 -extensions v3_req -extfile rootCA_openssl.cnf

1. Edit information for root CA and save content as file server_openssl.cnf.
2. Under section alt_names:
   • If you are signing a certificate for IP address only, remove the line "DNS.1".
   • If you are signing a certificate for domain only, remove the line "IP.1". For wildcard domain, use *.example.com as value.
   • You may keep both lines to sign certificate for both IP address and domain.

   [ req ]
   distinguished_name = req_distinguished_name
   req_extensions = v3_req
    
   [ req_distinguished_name ]
   countryName = Country Name (2 letter code)
   countryName_default = US
   stateOrProvinceName = State or Province Name (full name)
   stateOrProvinceName_default = OR
   localityName = Locality Name (eg, city)
   localityName_default = Portland
   organizationName = Organization Name (eg, company)
   organizationName_default = TrendMicro
   commonName = Common Name
   commonName_default = ssl-server-cert
   commonName_max = 64
    
   [ v3_req ]
   basicConstraints = CA:FALSE
   keyUsage = nonRepudiation, digitalSignature, keyEncipherment
   subjectAltName = @alt_names
    
   [ alt_names ]
   IP.1 = 127.0.0.1
   DNS.1 = localhost

   Server private key is used to sign a server certificate.

3. Enter a passphrase when prompted.

   openssl genrsa -aes256 -out server.key 2048

4. Create a CSR (Certificate Signing Request) file for server certificate.
5. Enter the passphrase for server.key you just specified.

   openssl req -new -key server.key -out server.csr -config server_openssl.cnf

6. Generate root CA certificate file server.pem.

   openssl x509 -req -in server.csr -sha256 -CA rootCA.pem -CAkey rootCA.key -out server.pem -days 1095 -extensions v3_req -extfile server_openssl.cnf

1. Refer to the command:

   openssl verify -verbose -CAfile rootCA.pem server.pem

2. You should see this message if verification success.

   server.pem: OK

3. If you see error message like shown below, check your certificates and make sure the Common Name value must be different in rootCA.pem and server.pem.

   error 20 at 0 depth lookup: unable to get local issuer certificate
   error server.pem: verification failed

Usually, client certificate is unnecessary unless you enforce a mutual TLS verification for the traffic between Syslog server and Trend Vision One server. Signing a client certificate is similar to the previous section, "Generate Certificate for Server".
To enable client certificate:

1. Go to Third-Party Integration > Syslog Server Connection on the Trend Vision One console.
2. Check "Server requires client authentication" option.
3. Upload client certificate file.
4. Input passphrase for client certificate.

For more information, refer to the Splunk article, Securing Splunk Enterprise.

1. Refer to the following command:

   cat server.pem server.key > server_bundle.pem

2. Configure sslConfig section in Splunk. For example, /opt/splunk/etc/system/local/server.conf.

   [sslConfig]
   sslRootCAPath = $SPLUNK_HOME/cert/rootCA.pem
   sslPassword = 123456
   serverCert = $SPLUNK_HOME/cert/server_bundle.pem