Learn about TLS end verification in inter-sidecar communication.

On the Splunk platform, a sidecar can communicate with other sidecars using one of the following connection types:

• Through the Splunk REST API.

  • Sidecars communicate on the Splunk management port, which is the TCP/IP network port 8089.

  • If you specify settings, such as a serverCert value, in the [sslConfig] stanza of the server.conf file and reload the Splunk platform configuration, the Splunk REST API uses these settings.

  To learn more about the Splunk REST API, see Splunk REST API reference. To learn how to reload the Splunk platform configuration, see How to renew TLS certificates.

• Through the direct port of the destination sidecar, for example, https://localhost:8194.

  • Each sidecar uses a server data plane certificate specified in the serverCertDataplane setting in the [dataplaneSslConfig] stanza of server.conf to secure its own data plane server. Through a Transport Layer Security (TLS) connection on the direct port, a connecting sidecar can verify the certificate of the destination sidecar.

    The splunkd process auto-generates all certificates when you start Splunk Enterprise the first time.

  • The Storage, Data Orchestration, Edge Processor Control Plane, and OpAmp sidecars, that support enhanced data management in Splunk Enterprise, use the ephemeral certificate-based authorization which enhances security. This authorization uses digital certificates generated for a specific task. These sidecars configure a server data plane certificate for each session.

Localhost sidecars skip hostname verification during TLS connections. The settings of the server certificates do not include the localhost name.